BleepingComputer.com: Vista Blue Screen on new configuration

Hi,

I have recently assembled a computer :ASUS P5Q Deluxe / Q9550 / ASUS EN9600GT SILENT/HTDI/512M GeForce 9600GT / DDR2 1066MHz 4x2GB Corsair DOMINATOR- 5-5-5-15, plus ANTEC 500W power source.

I have Vista Business x64 sp1 installed. The problem is that i get a bluescreen once in a while and i have no ideea what the problem is.

To keep it short, this is what windows showed me today after another bluescreen:

Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.0.6001.2.1.0.256.6
Locale ID: 1033

Additional information about the problem:
BCCode: 1000007e
BCP1: FFFFFFFFC0000005
BCP2: FFFFF80002456AEA
BCP3: FFFFFA60005AFA08
BCP4: FFFFFA60005AF3E0
OS Version: 6_0_6001
Service Pack: 1_0
Product: 256_1

Files that help describe the problem:
C:\Windows\Minidump\Mini032809-01.dmp
C:\Users\cos\AppData\Local\Temp\WER-65910-0.sysdata.xml
C:\Users\cos\AppData\Local\Temp\WER5041.tmp.version.txt

Read our privacy statement:
http://go.microsoft.com/fwlink/?linkid=501...mp;clcid=0x0409

I went googleing and i found your forum. I followed the steps on the http://www.bleepingcomputer.com/forums/topic176011.html thred and ended up with this:

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002456aea, The address that the exception occurred at
Arg3: fffffa60005afa08, Exception Record Address
Arg4: fffffa60005af3e0, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
nt!MiMapPagesForZeroPageThread+9a
fffff800`02456aea 0fb64f1a movzx ecx,byte ptr [rdi+1Ah]

EXCEPTION_RECORD: fffffa60005afa08 -- (.exr 0xfffffa60005afa08)
ExceptionAddress: fffff80002456aea (nt!MiMapPagesForZeroPageThread+0x000000000000009a)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 000000000000001a
Attempt to read from address 000000000000001a

CONTEXT: fffffa60005af3e0 -- (.cxr 0xfffffa60005af3e0)
rax=aaaaac8000000000 rbx=0000058000000000 rcx=0000058000000000
rdx=000000eaaaaaaaaa rsi=000000000000096b rdi=0000000000000000
rip=fffff80002456aea rsp=fffffa60005afc40 rbp=0000000000000040
r8=fffff6fd300024e8 r9=0000000000000001 r10=0000fffffffff000
r11=2aaaaaaaaaaaaaab r12=fffffa80058b7d40 r13=000000000000001d
r14=fffffa8006900600 r15=0000000000000040
iopl=0 ov up ei pl nz ac pe cy
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010a13
nt!MiMapPagesForZeroPageThread+0x9a:
fffff800`02456aea 0fb64f1a movzx ecx,byte ptr [rdi+1Ah] ds:002b:00000000`0000001a=??
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

CURRENT_IRQL: 0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: 000000000000001a

READ_ADDRESS: 000000000000001a

FOLLOWUP_IP:
nt!MiMapPagesForZeroPageThread+9a
fffff800`02456aea 0fb64f1a movzx ecx,byte ptr [rdi+1Ah]

BUGCHECK_STR: 0x7E

DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE

LAST_CONTROL_TRANSFER: from fffff80002456442 to fffff80002456aea

STACK_TEXT:


SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!MiMapPagesForZeroPageThread+9a

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 48d1ba35

STACK_COMMAND: .cxr 0xfffffa60005af3e0 ; kb

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: X64_0x7E_nt!MiMapPagesForZeroPageThread+9a

BUCKET_ID: X64_0x7E_nt!MiMapPagesForZeroPageThread+9a

Followup: MachineOwner
---------

I can't really make much sense out of this, but i hope one of you can.

I must say that i previously tried and changed the video card, i tested the ram with memcheck for more than 6 hours, and scanned my machine with lots of antiviruses.

I hope you can help me, please

The debugger isn't printing the stack text (and the stack text may help us ID Arg 2 - where the error occurred). Please be sure that you're using the correct version of the debugger. You use the 32 bit version if the debugger is running on a 32 bit system. It doesn't matter if the dump file comes from a 64 bit system or a 32 bit system.

If you're running the debugger on the 64 bit system, then please be sure you're using the 64 bit version.

Then, please follow the directions in this topic exactly: http://www.bleepingcomputer.com/forums/topic176011.html
This includes running the !analyze -v command.
Once you've run the !analyze -v command, also run the lm (lower case LM) command by typing "lm" (without the quotes) and pressing Enter. Post all that back here and we'll have a bit more to go on.

Sorry for that. Here is the complete (i hope) log. I also found other minidumps in the windows/minidump folder. I could debug them too if it helped (maybe they have something in common).

Anyway, there it goes:

Microsoft ® Windows Debugger Version 6.11.0001.402 AMD64
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Work\error dumps\1\Mini032809-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2008/Windows Vista Kernel Version 6001 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6001.18145.amd64fre.vistasp1_gdr.080917-1612
Machine Name:
Kernel base = 0xfffff800`0240d000 PsLoadedModuleList = 0xfffff800`025d2db0
Debug session time: Sat Mar 28 19:57:08.226 2009 (GMT+3)
System Uptime: 0 days 0:29:14.309
Loading Kernel Symbols
...............................................................
................................................................
........................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff80002456aea, fffffa60005afa08, fffffa60005af3e0}

Probably caused by : memory_corruption ( nt!MiMapPagesForZeroPageThread+9a )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002456aea, The address that the exception occurred at
Arg3: fffffa60005afa08, Exception Record Address
Arg4: fffffa60005af3e0, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
nt!MiMapPagesForZeroPageThread+9a
fffff800`02456aea 0fb64f1a movzx ecx,byte ptr [rdi+1Ah]

EXCEPTION_RECORD: fffffa60005afa08 -- (.exr 0xfffffa60005afa08)
ExceptionAddress: fffff80002456aea (nt!MiMapPagesForZeroPageThread+0x000000000000009a)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 000000000000001a
Attempt to read from address 000000000000001a

CONTEXT: fffffa60005af3e0 -- (.cxr 0xfffffa60005af3e0)
rax=aaaaac8000000000 rbx=0000058000000000 rcx=0000058000000000
rdx=000000eaaaaaaaaa rsi=000000000000096b rdi=0000000000000000
rip=fffff80002456aea rsp=fffffa60005afc40 rbp=0000000000000040
r8=fffff6fd300024e8 r9=0000000000000001 r10=0000fffffffff000
r11=2aaaaaaaaaaaaaab r12=fffffa80058b7d40 r13=000000000000001d
r14=fffffa8006900600 r15=0000000000000040
iopl=0 ov up ei pl nz ac pe cy
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010a13
nt!MiMapPagesForZeroPageThread+0x9a:
fffff800`02456aea 0fb64f1a movzx ecx,byte ptr [rdi+1Ah] ds:002b:00000000`0000001a=??
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

CURRENT_IRQL: 0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: 000000000000001a

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002636080
000000000000001a

FOLLOWUP_IP:
nt!MiMapPagesForZeroPageThread+9a
fffff800`02456aea 0fb64f1a movzx ecx,byte ptr [rdi+1Ah]

BUGCHECK_STR: 0x7E

DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE

LAST_CONTROL_TRANSFER: from fffff80002456442 to fffff80002456aea

STACK_TEXT:
fffffa60`005afc40 fffff800`02456442 : 00000000`0000001d 00000000`0000003f 00000000`00000040 fffff800`0081af18 : nt!MiMapPagesForZeroPageThread+0x9a
fffffa60`005afc80 fffff800`0284eb1e : 00000000`00000000 fffffa80`00000000 00000000`00000000 fffff800`0289d000 : nt!MmZeroPageThread+0x362
fffffa60`005afd20 fffff800`02684ff3 : 00000000`00000000 fffff800`0249c539 00000000`00000010 00000000`00000286 : nt!Phase1Initialization+0xe
fffffa60`005afd50 fffff800`0249c546 : fffff800`02581680 fffffa80`069e0bb0 fffff800`02586b80 fffff800`0081af18 : nt!PspSystemThreadStartup+0x57
fffffa60`005afd80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16


SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!MiMapPagesForZeroPageThread+9a

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 48d1ba35

STACK_COMMAND: .cxr 0xfffffa60005af3e0 ; kb

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: X64_0x7E_nt!MiMapPagesForZeroPageThread+9a

BUCKET_ID: X64_0x7E_nt!MiMapPagesForZeroPageThread+9a

Followup: MachineOwner
---------

Not a problem.
Please run the lm (lower case LM) command also (on this dump only).

You can post the rest of the minidump files that you've found, but please be sure to keep them in order of the date that they occurred.
What we're looking for in them is differences between this one and the others.

Also, try running the Windows Memory Diagnostic on the system: http://www.bleepingcomputer.com/tutorials/using-vista-windows-memory-diagnostics-tool/

This is the lm output:

0: kd> lm
start end module name
fffff800`0240d000 fffff800`02925000 nt (pdb symbols) c:\symbols\ntkrnlmp.pdb\149C563625CA49CEA2881CEDF5D55CCF2\ntkrnlmp.pdb
fffff800`02925000 fffff800`0296b000 hal (deferred)
fffff960`00050000 fffff960`00301000 win32k (deferred)
fffff960`00440000 fffff960`0044a000 TSDDD (deferred)
fffff960`00680000 fffff960`00691000 cdd (deferred)
fffff960`00810000 fffff960`00871000 ATMFD (deferred)
fffffa60`0060c000 fffffa60`00616000 kdcom (deferred)
fffffa60`00616000 fffffa60`00643000 mcupdate_GenuineIntel (deferred)
fffffa60`00643000 fffffa60`00657000 PSHED (deferred)
fffffa60`00657000 fffffa60`006b4000 CLFS (deferred)
fffffa60`006b4000 fffffa60`00766000 CI (deferred)
fffffa60`00766000 fffffa60`007cc000 volmgrx (deferred)
fffffa60`007cc000 fffffa60`007f0000 ataport (deferred)
fffffa60`0080e000 fffffa60`008e8000 Wdf01000 (deferred)
fffffa60`008e8000 fffffa60`008f6000 WDFLDR (deferred)
fffffa60`008f6000 fffffa60`0094c000 acpi (deferred)
fffffa60`0094c000 fffffa60`00955000 WMILIB (deferred)
fffffa60`00955000 fffffa60`0095f000 msisadrv (deferred)
fffffa60`0095f000 fffffa60`0098f000 pci (deferred)
fffffa60`0098f000 fffffa60`009a4000 partmgr (deferred)
fffffa60`009a4000 fffffa60`009b8000 volmgr (deferred)
fffffa60`009b8000 fffffa60`009bf000 pciide (deferred)
fffffa60`009bf000 fffffa60`009cf000 PCIIDEX (deferred)
fffffa60`009cf000 fffffa60`009e2000 mountmgr (deferred)
fffffa60`009e2000 fffffa60`009f5000 monitor (deferred)
fffffa60`00a06000 fffffa60`00acd000 iastorv (deferred)
fffffa60`00acd000 fffffa60`00bdb000 iaStor (deferred)
fffffa60`00bdb000 fffffa60`00be3000 atapi (deferred)
fffffa60`00be3000 fffffa60`00bf5000 HIDCLASS (deferred)
fffffa60`00c0a000 fffffa60`00c4e000 mv61xx (deferred)
fffffa60`00c4e000 fffffa60`00c7c000 SCSIPORT (deferred)
fffffa60`00c7c000 fffffa60`00cc2000 fltmgr (deferred)
fffffa60`00cc2000 fffffa60`00cd6000 fileinfo (deferred)
fffffa60`00cd6000 fffffa60`00ce1ae0 PxHlpa64 (deferred)
fffffa60`00ce2000 fffffa60`00d67000 ksecdd (deferred)
fffffa60`00d67000 fffffa60`00db7000 msrpc (deferred)
fffffa60`00db7000 fffffa60`00de3000 CLASSPNP (deferred)
fffffa60`00de3000 fffffa60`00dfb200 usbaudio (deferred)
fffffa60`00e02000 fffffa60`00fc5000 ndis (deferred)
fffffa60`00fc5000 fffffa60`00ff1000 ecache (deferred)
fffffa60`00ff1000 fffffa60`00ffb000 crcdisk (deferred)
fffffa60`01005000 fffffa60`0105d000 NETIO (deferred)
fffffa60`0105d000 fffffa60`011d1000 tcpip (deferred)
fffffa60`011d1000 fffffa60`011fd000 fwpkclnt (deferred)
fffffa60`01208000 fffffa60`0138c000 Ntfs (deferred)
fffffa60`0138c000 fffffa60`013d0000 volsnap (deferred)
fffffa60`013d0000 fffffa60`013d8000 spldr (deferred)
fffffa60`013d8000 fffffa60`013ea000 mup (deferred)
fffffa60`013ea000 fffffa60`013fe000 disk (deferred)
fffffa60`03400000 fffffa60`0350e000 dump_iaStor (deferred)
fffffa60`03515000 fffffa60`03521000 tunnel (deferred)
fffffa60`03521000 fffffa60`0352a000 tunmp (deferred)
fffffa60`0352a000 fffffa60`0353d000 intelppm (deferred)
fffffa60`0353d000 fffffa60`0359a000 storport (deferred)
fffffa60`0359a000 fffffa60`035a7000 TDI (deferred)
fffffa60`035a7000 fffffa60`035ca000 rasl2tp (deferred)
fffffa60`035ca000 fffffa60`035d6000 ndistapi (deferred)
fffffa60`035d6000 fffffa60`035ea000 NDProxy (deferred)
fffffa60`035ea000 fffffa60`035ff000 USBSTOR (deferred)
fffffa60`03608000 fffffa60`03f80e00 nvlddmkm (deferred)
fffffa60`03f81000 fffffa60`03f82400 nvBridge (deferred)
fffffa60`03f83000 fffffa60`03fa0000 serial (deferred)
fffffa60`03fa0000 fffffa60`03fac000 serenum (deferred)
fffffa60`03fac000 fffffa60`03fc8000 cdrom (deferred)
fffffa60`03fc8000 fffffa60`04000000 msiscsi (deferred)
fffffa60`04000000 fffffa60`040df000 dxgkrnl (deferred)
fffffa60`040df000 fffffa60`040ee000 watchdog (deferred)
fffffa60`040ee000 fffffa60`040fa000 usbuhci (deferred)
fffffa60`040fa000 fffffa60`04140000 USBPORT (deferred)
fffffa60`04140000 fffffa60`04151000 usbehci (deferred)
fffffa60`04151000 fffffa60`04164000 HDAudBus (deferred)
fffffa60`04164000 fffffa60`041c9000 yk60x64 (deferred)
fffffa60`041c9000 fffffa60`041daa00 ohci1394 (deferred)
fffffa60`041db000 fffffa60`041eaf00 1394BUS (deferred)
fffffa60`041eb000 fffffa60`041f8000 fdc (deferred)
fffffa60`041f8000 fffffa60`04200000 ASACPI (deferred)
fffffa60`04200000 fffffa60`0420b000 mouhid (deferred)
fffffa60`0420d000 fffffa60`0423e000 ndiswan (deferred)
fffffa60`0423e000 fffffa60`0424e000 raspppoe (deferred)
fffffa60`0424e000 fffffa60`0426c000 raspptp (deferred)
fffffa60`0426c000 fffffa60`04284000 rassstp (deferred)
fffffa60`04284000 fffffa60`0431e000 rdpdr (deferred)
fffffa60`0431e000 fffffa60`04330000 termdd (deferred)
fffffa60`04330000 fffffa60`0433e000 kbdclass (deferred)
fffffa60`0433e000 fffffa60`0434a000 mouclass (deferred)
fffffa60`0434a000 fffffa60`0434b480 swenum (deferred)
fffffa60`0434c000 fffffa60`04380000 ks (deferred)
fffffa60`04380000 fffffa60`0438b000 mssmbios (deferred)
fffffa60`0438b000 fffffa60`0439b000 umbus (deferred)
fffffa60`0439b000 fffffa60`043a3000 vmnetadapter (deferred)
fffffa60`043a3000 fffffa60`043ad000 VMNET (deferred)
fffffa60`043ad000 fffffa60`043f4000 usbhub (deferred)
fffffa60`043f4000 fffffa60`043ff000 flpydisk (deferred)
fffffa60`04c00000 fffffa60`04c0a000 kbdhid (deferred)
fffffa60`04c0a000 fffffa60`04c81000 ADIHdAud (deferred)
fffffa60`04c81000 fffffa60`04cbc000 portcls (deferred)
fffffa60`04cbc000 fffffa60`04cdf000 drmk (deferred)
fffffa60`04cdf000 fffffa60`04ce4180 ksthunk (deferred)
fffffa60`04ce5000 fffffa60`04cef000 Fs_Rec (deferred)
fffffa60`04cef000 fffffa60`04cf8000 Null (deferred)
fffffa60`04cf8000 fffffa60`04d02000 VMkbd (deferred)
fffffa60`04d02000 fffffa60`04d09b80 HIDPARSE (deferred)
fffffa60`04d0a000 fffffa60`04d18000 vga (deferred)
fffffa60`04d18000 fffffa60`04d3d000 VIDEOPRT (deferred)
fffffa60`04d3d000 fffffa60`04d46000 RDPCDD (deferred)
fffffa60`04d46000 fffffa60`04d4f000 rdpencdd (deferred)
fffffa60`04d4f000 fffffa60`04d5a000 Msfs (deferred)
fffffa60`04d5a000 fffffa60`04d6b000 Npfs (deferred)
fffffa60`04d6b000 fffffa60`04d74000 rasacd (deferred)
fffffa60`04d74000 fffffa60`04d91000 tdx (deferred)
fffffa60`04d91000 fffffa60`04dac000 smb (deferred)
fffffa60`04dac000 fffffa60`04dc9000 dfsc (deferred)
fffffa60`04dc9000 fffffa60`04dd5000 Dxapi (deferred)
fffffa60`04dd5000 fffffa60`04df1000 usbccgp (deferred)
fffffa60`04df1000 fffffa60`04dfa000 hidusb (deferred)
fffffa60`04e00000 fffffa60`04e01e00 USBD (deferred)
fffffa60`04e08000 fffffa60`04e75000 afd (deferred)
fffffa60`04e75000 fffffa60`04eb9000 netbt (deferred)
fffffa60`04eb9000 fffffa60`04ed7000 pacer (deferred)
fffffa60`04ed7000 fffffa60`04ee6000 netbios (deferred)
fffffa60`04ee6000 fffffa60`04f01000 wanarp (deferred)
fffffa60`04f01000 fffffa60`04f1a000 SCDEmu (deferred)
fffffa60`04f1a000 fffffa60`04f68000 rdbss (deferred)
fffffa60`04f68000 fffffa60`04f74000 nsiproxy (deferred)
fffffa60`04f74000 fffffa60`04fea000 csc (deferred)
fffffa60`04fea000 fffffa60`04ff1000 AsIO (deferred)
fffffa60`04ff1000 fffffa60`04fff000 crashdmp (deferred)
fffffa60`08402000 fffffa60`084b8000 peauth (deferred)
fffffa60`084b8000 fffffa60`084c3000 secdrv (deferred)
fffffa60`084c3000 fffffa60`084cb000 SSPORT (deferred)
fffffa60`084cb000 fffffa60`084da000 tcpipreg (deferred)
fffffa60`084da000 fffffa60`084e4000 vmnetuserif (deferred)
fffffa60`084e4000 fffffa60`08504000 WUDFRd (deferred)
fffffa60`08504000 fffffa60`0851a000 WUDFPf (deferred)
fffffa60`0851a000 fffffa60`08536000 cdfs (deferred)
fffffa60`08c09000 fffffa60`08c2b000 luafv (deferred)
fffffa60`08c2b000 fffffa60`08cc5000 spsys (deferred)
fffffa60`08cc5000 fffffa60`08cd0000 vmnetbridge (deferred)
fffffa60`08cd0000 fffffa60`08ce4000 lltdio (deferred)
fffffa60`08ce4000 fffffa60`08cfc000 rspndr (deferred)
fffffa60`08cfc000 fffffa60`08d97000 HTTP (deferred)
fffffa60`08d97000 fffffa60`08dbf000 srvnet (deferred)
fffffa60`08dbf000 fffffa60`08ddd000 bowser (deferred)
fffffa60`08ddd000 fffffa60`08df7000 mpsdrv (deferred)
fffffa60`09409000 fffffa60`09430000 mrxdav (deferred)
fffffa60`09430000 fffffa60`09458000 mrxsmb (deferred)
fffffa60`09458000 fffffa60`094a1000 mrxsmb10 (deferred)
fffffa60`094a1000 fffffa60`094c0000 mrxsmb20 (deferred)
fffffa60`094c0000 fffffa60`094f1000 srv2 (deferred)
fffffa60`094f1000 fffffa60`09585000 srv (deferred)
fffffa60`09585000 fffffa60`09590000 asyncmac (deferred)
fffffa60`09590000 fffffa60`095a8000 adfs (deferred)

Unloaded modules:
fffffa60`095a8000 fffffa60`095b8000 DgiVecp.sys
fffffa60`00de3000 fffffa60`00df1000 crashdmp.sys
fffffa60`03407000 fffffa60`03515000 dump_iaStor.
fffffa60`04cf8000 fffffa60`04d02000 kbdhid.sys




Microsoft memory said theres no error, I will run it again with all the options turned on later today.
I will also post other dump files soon enough.

Thanks for your help



LE:

Crash dump on 24.01.2009:


Microsoft ® Windows Debugger Version 6.11.0001.402 AMD64
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Work\error dumps\Mini012409-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2008/Windows Vista Kernel Version 6001 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6001.18145.amd64fre.vistasp1_gdr.080917-1612
Machine Name:
Kernel base = 0xfffff800`02248000 PsLoadedModuleList = 0xfffff800`0240ddb0
Debug session time: Sat Jan 24 17:51:15.215 2009 (GMT+3)
System Uptime: 0 days 0:00:22.276
Loading Kernel Symbols
...............................................................
....................................................
Loading User Symbols
Loading unloaded module list
.
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffa6084f3584c, 8, fffffa6084f3584c, 5}

Unable to load image \??\C:\Windows\system32\drivers\VMkbd.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for VMkbd.sys
*** ERROR: Module load completed but symbols could not be loaded for VMkbd.sys

Could not read faulting driver name
Probably caused by : kbdclass.sys ( kbdclass!KeyboardClassPower+137 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa6084f3584c, memory referenced.
Arg2: 0000000000000008, value 0 = read operation, 1 = write operation.
Arg3: fffffa6084f3584c, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000005, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002471080
fffffa6084f3584c

FAULTING_IP:
+0
fffffa60`84f3584c ?? ???

MM_INTERNAL_CODE: 5

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: System

CURRENT_IRQL: 0

TRAP_FRAME: fffffa6001bb4480 -- (.trap 0xfffffa6001bb4480)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000016 rbx=0000000000000000 rcx=fffffa800a93d040
rdx=fffffa800a916010 rsi=0000000000000000 rdi=0000000000000000
rip=fffffa6084f3584c rsp=fffffa6001bb4618 rbp=fffffa800a93dab0
r8=fffffa800a895d10 r9=0000000000000016 r10=0000007ffffffff8
r11=fffffa6001bb4680 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
fffffa60`84f3584c ?? ???
Resetting default scope

LOCK_ADDRESS: fffff80002443c20 -- (!locks fffff80002443c20)

Resource @ nt!PiEngineLock (0xfffff80002443c20) Available

WARNING: SystemResourcesList->Flink chain invalid. Resource may be corrupted, or already deleted.


WARNING: SystemResourcesList->Blink chain invalid. Resource may be corrupted, or already deleted.

1 total locks

PNP_TRIAGE:
Lock address : 0xfffff80002443c20
Thread Count : 0
Thread address: 0x0000000000000000
Thread wait : 0x0

LAST_CONTROL_TRANSFER: from fffff800022ab4e2 to fffff8000229d350

STACK_TEXT:
fffffa60`01bb4388 fffff800`022ab4e2 : 00000000`00000050 fffffa60`84f3584c 00000000`00000008 fffffa60`01bb4480 : nt!KeBugCheckEx
fffffa60`01bb4390 fffff800`0229bed9 : 00000000`00000008 fffff6fb`7ea002a0 00000000`00000000 00000000`00000000 : nt!MmAccessFault+0x4f2
fffffa60`01bb4480 fffffa60`84f3584c : fffffa60`042b4aaf 00000000`00000000 fffffa80`0a93dab0 00000000`00000000 : nt!KiPageFault+0x119
fffffa60`01bb4618 fffffa60`042b4aaf : 00000000`00000000 fffffa80`0a93dab0 00000000`00000000 00000000`00000001 : 0xfffffa60`84f3584c
fffffa60`01bb4620 fffff800`02358b43 : 00000000`00000005 fffffa80`0a93da00 00000000`00000000 fffffa80`0a916010 : kbdclass!KeyboardClassPower+0x137
fffffa60`01bb4680 fffff800`02360ce3 : 00000000`00000005 fffffa80`0a93da00 00000000`00000000 11d156ef`00000000 : nt!IofCallDriverSpecifyReturn+0x73
fffffa60`01bb46b0 fffffa60`042b495a : 00000000`c0000001 fffffa80`0a93dab0 00000000`00000000 fffffa80`0a93dab0 : nt!PoRequestPowerIrp+0xf3
fffffa60`01bb4700 fffffa60`042ae43c : 00000000`c00000bb fffffa80`0a93dab0 00000000`00000000 00000000`00000000 : kbdclass!KeyboardClassCreateWaitWakeIrp+0x32
fffffa60`01bb4740 fffffa60`04f43182 : fffffa80`0a9ec260 fffffa80`0a8930b0 fffffa80`0a9ec110 fffffa80`0a9ec110 : kbdclass!KeyboardPnP+0x54c
fffffa60`01bb47e0 fffffa80`0a9ec260 : fffffa80`0a8930b0 fffffa80`0a9ec110 fffffa80`0a9ec110 fffffa80`0a8930b0 : VMkbd+0x5182
fffffa60`01bb47e8 fffffa80`0a8930b0 : fffffa80`0a9ec110 fffffa80`0a9ec110 fffffa80`0a8930b0 fffff800`025df191 : 0xfffffa80`0a9ec260
fffffa60`01bb47f0 fffffa80`0a9ec110 : fffffa80`0a9ec110 fffffa80`0a8930b0 fffff800`025df191 00000000`00000000 : 0xfffffa80`0a8930b0
fffffa60`01bb47f8 fffffa80`0a9ec110 : fffffa80`0a8930b0 fffff800`025df191 00000000`00000000 fffffa80`0a915010 : 0xfffffa80`0a9ec110
fffffa60`01bb4800 fffffa80`0a8930b0 : fffff800`025df191 00000000`00000000 fffffa80`0a915010 fffffa80`0a9ec110 : 0xfffffa80`0a9ec110
fffffa60`01bb4808 fffff800`025df191 : 00000000`00000000 fffffa80`0a915010 fffffa80`0a9ec110 fffffa80`0a899ab0 : 0xfffffa80`0a8930b0
fffffa60`01bb4810 fffff800`023567c6 : 00000000`00000000 fffff800`02355c90 00000000`00000000 00000000`00000000 : nt!PnpAsynchronousCall+0xd1
fffffa60`01bb4850 fffff800`02655258 : fffffa80`0a8918f0 fffffa80`0a8918f0 00000000`00000001 fffffa80`0a8930b0 : nt!PnpStartDevice+0xf6
fffffa60`01bb4900 fffff800`02661f57 : fffffa80`0a8918f0 fffffa80`0a2c002d fffffa80`0a2c4de0 00000000`00000001 : nt!PnpStartDeviceNode+0x168
fffffa60`01bb4990 fffff800`0267e42c : fffffa80`0a8918f0 fffffa80`0a2c4de0 00000000`00000002 00000000`00000000 : nt!PipProcessStartPhase1+0x77
fffffa60`01bb49c0 fffff800`0267e95a : 00000000`00000000 fffffa80`069e9bb0 00000000`00000001 fffff800`024b3481 : nt!PipProcessDevNodeTree+0x28c
fffffa60`01bb4c30 fffff800`02375bbd : fffff801`00000003 fffffa80`0a87fa00 00000000`00000000 00000002`00000005 : nt!PiProcessReenumeration+0x8a
fffffa60`01bb4c80 fffff800`022aa05a : fffff800`02375990 fffff800`023da801 fffff800`023da8f8 fffffa80`00000001 : nt!PnpDeviceActionWorker+0x22d
fffffa60`01bb4cf0 fffff800`024bfff3 : fffff800`024415a0 ffffffff`ffffffff fffffa80`069e9bb0 00000000`00000080 : nt!ExpWorkerThread+0x11a
fffffa60`01bb4d50 fffff800`022d7546 : fffffa60`01966180 fffffa80`069e9bb0 fffffa60`0196fd40 00000000`00000001 : nt!PspSystemThreadStartup+0x57
fffffa60`01bb4d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
kbdclass!KeyboardClassPower+137
fffffa60`042b4aaf 8bf0 mov esi,eax

SYMBOL_STACK_INDEX: 4

SYMBOL_NAME: kbdclass!KeyboardClassPower+137

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: kbdclass

IMAGE_NAME: kbdclass.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 47919875

FAILURE_BUCKET_ID: X64_0x50_kbdclass!KeyboardClassPower+137

BUCKET_ID: X64_0x50_kbdclass!KeyboardClassPower+137

Followup: MachineOwner
---------

Crash dump 13.12.2008


Microsoft ® Windows Debugger Version 6.11.0001.402 AMD64
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Work\error dumps\Mini121308-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2008/Windows Vista Kernel Version 6001 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6001.18145.amd64fre.vistasp1_gdr.080917-1612
Machine Name:
Kernel base = 0xfffff800`01c56000 PsLoadedModuleList = 0xfffff800`01e1bdb0
Debug session time: Sat Dec 13 17:36:49.212 2008 (GMT+3)
System Uptime: 0 days 0:21:24.276
Loading Kernel Symbols
...............................................................
................................................................
............
Loading User Symbols
Loading unloaded module list
...
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {8884, fffffa8000771c90, fffffa80011c5800, 600}

Probably caused by : memory_corruption ( nt!MiRelinkStandbyPage+a2 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000008884, The subtype of the bugcheck.
Arg2: fffffa8000771c90
Arg3: fffffa80011c5800
Arg4: 0000000000000600

Debugging Details:
------------------


BUGCHECK_STR: 0x1a_8884

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: svchost.exe

CURRENT_IRQL: 2

LAST_CONTROL_TRANSFER: from fffff80001d22722 to fffff80001cab350

STACK_TEXT:
fffffa60`08af68c8 fffff800`01d22722 : 00000000`0000001a 00000000`00008884 fffffa80`00771c90 fffffa80`011c5800 : nt!KeBugCheckEx
fffffa60`08af68d0 fffff800`01d76dbf : fffffa80`0ba35700 fffffa80`08dae648 fffffa80`0ba35700 fffffa80`08dae648 : nt!MiRelinkStandbyPage+0xa2
fffffa60`08af6910 fffff800`02044ce4 : 00000000`00000000 fffffa60`00000000 00000000`00000000 fffffa80`08dad000 : nt!MmSetPfnListPriorities+0x28f
fffffa60`08af6980 fffff800`02084cb2 : 00000004`007e8c0a 00000000`00000000 fffffa80`08dab000 00000000`00000001 : nt!PfpPfnPrioRequest+0x84
fffffa60`08af69d0 fffff800`020973f8 : 00000000`00000000 00000000`00000004 00000004`482e6532 00000000`00000001 : nt!PfSetSuperfetchInformation+0x191
fffffa60`08af6ab0 fffff800`01caadf3 : fffffa80`0ba35700 00000000`03c33130 00000000`04e21ff0 00000000`00000000 : nt!NtSetSystemInformation+0x8fb
fffffa60`08af6c20 00000000`77b070ea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`02e1ee28 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77b070ea


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiRelinkStandbyPage+a2
fffff800`01d22722 cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MiRelinkStandbyPage+a2

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 48d1ba35

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: X64_0x1a_8884_nt!MiRelinkStandbyPage+a2

BUCKET_ID: X64_0x1a_8884_nt!MiRelinkStandbyPage+a2

Followup: MachineOwner
---------



I have 4 more crash dumps, I could post them too, just tell me if you need them.
Thanks again for your help, it's very apreciated

lm didn't tell us anything we didn't already know (that it happened in nt.dll)

The middle dump file suggests there was an issue with either a virus or a virtual machine keyboard driver. Are you running any virtual machines? Have you scanned for viruses with an independent scanner (in case your current protection has been compromised)? Here's a link for some free, online scanners: http://www.bleepingcomputer.com/blogs/usas...?showentry=1252

I used to have a virtual machine but it was unistalled a while back. I used the free online panda virus scanner and it turned out alright. I will scan with the other ones in the list tomorrow.

Do you know any good vista cleaners, because i think maybe vmware or other software could have been only partially unistalled. And also,are there any more ways i can monitor my pc? Could it be a hardware problem?

Nice freeware system tools listed here: http://www.bleepingcomputer.com/forums/topic3616.html
Others may have specific recommendations.
Please don't use any registry cleaners. They cause more problems than they're worth (and there's been lot's of discussions here about that)!
I do recommend the Windows Installer CleanUp Utility available for free from here: http://support.microsoft.com/kb/290301

Once everything's cleaned up, let's see if that affects the BSOD's.

Another bluescreen today:


Microsoft ® Windows Debugger Version 6.11.0001.402 AMD64
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Work\error dumps\02\Mini040209-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2008/Windows Vista Kernel Version 6001 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6001.18145.amd64fre.vistasp1_gdr.080917-1612
Machine Name:
Kernel base = 0xfffff800`02415000 PsLoadedModuleList = 0xfffff800`025dadb0
Debug session time: Thu Apr 2 20:24:34.409 2009 (GMT+3)
System Uptime: 0 days 8:48:11.996
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, 1f4279, 2, 1f1bb8}

Probably caused by : memory_corruption ( nt!MiBadShareCount+4b )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 00000000001f4279, page frame number
Arg3: 0000000000000002, current page state
Arg4: 00000000001f1bb8, 0

Debugging Details:
------------------


BUGCHECK_STR: 0x4E_99

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: explorer.exe

CURRENT_IRQL: 2

LAST_CONTROL_TRANSFER: from fffff800024e13bb to fffff8000246a350

STACK_TEXT:
fffffa60`0b141b18 fffff800`024e13bb : 00000000`0000004e 00000000`00000099 00000000`001f4279 00000000`00000002 : nt!KeBugCheckEx
fffffa60`0b141b20 fffff800`0245b49f : fffff880`0e65cfc0 00000000`00000fc0 00000000`00000040 fffff880`0e2a2c50 : nt!MiBadShareCount+0x4b
fffffa60`0b141b60 fffff800`0245b683 : 00000000`00000000 fffffa80`096a8e01 00000000`00000000 00000000`00000000 : nt!MmPurgeSection+0x82f
fffffa60`0b141bf0 fffff800`02444ec7 : fffffa80`08a6af50 00000000`2621a000 fffff880`001821c0 00000000`00000000 : nt!CcPurgeCacheSection+0x147
fffffa60`0b141c50 fffff800`0248d9a7 : fffffa80`096a8e30 fffffa80`096a8e30 fffffa60`0b142798 fffffa60`012ec282 : nt!CcPurgeAndClearCacheSection+0x6b
fffffa60`0b141cf0 fffffa60`012b8d99 : fffff880`0e2a2ba0 00000000`2621a000 00000000`2621a000 fffff880`0e2a2ba0 : nt!CcSetFileSizesEx+0x237
fffffa60`0b141d70 fffffa60`012abb0b : fffff880`0e2a2ba0 fffffa80`09577b80 fffffa60`0b142701 00000000`00000000 : Ntfs!NtfsDeleteAllocation+0x309
fffffa60`0b141e50 fffffa60`012aa1ce : fffffa60`0b142740 fffff880`0e2a2a01 fffff880`0e2a2ba0 00000000`00000001 : Ntfs!NtfsDeleteAllocationFromRecord+0x17b
fffffa60`0b141f10 fffffa60`012d22da : fffffa60`0b142740 fffff880`0e2a2a70 fffff880`0ab18a00 fffffa60`0b142203 : Ntfs!NtfsDeleteFile+0x8fe
fffffa60`0b1421a0 fffffa60`0121f999 : 00000000`00000000 00001f80`00000000 fffffa60`0b1426a0 00000000`00000000 : Ntfs!NtfsCommonCleanup+0xe8a
fffffa60`0b1425b0 fffff800`0248b3d1 : fffffa60`0b1426a0 5000ee17`b6bf0002 fffffa80`09d2f5f0 00000000`00000000 : Ntfs!NtfsCommonCleanupCallout+0x19
fffffa60`0b1425e0 fffffa60`0121f162 : fffffa60`0121f980 fffffa60`0b1426a0 fffffa60`0b142740 fffffa60`0b142740 : nt!KeExpandKernelStackAndCalloutEx+0x2e1
fffffa60`0b142670 fffffa60`012d5fa8 : fffffa60`0b142740 fffffa80`09d58b80 fffffa60`0b142740 fffffa60`0b1428f0 : Ntfs!NtfsCommonCleanupOnNewStack+0x42
fffffa60`0b1426e0 fffffa60`00c73e17 : fffffa60`0b142740 fffffa80`09d58b80 fffffa80`09d58e90 fffffa80`086cb410 : Ntfs!NtfsFsdCleanup+0x138
fffffa60`0b142940 fffffa60`00c730dd : fffffa80`09d58b80 00000000`00000000 fffffa80`081e4401 00000000`00000000 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x227
fffffa60`0b1429b0 fffff800`026e92e4 : fffffa80`0adcad70 00000000`00000000 fffffa80`09d2f5f0 fffffa80`09d2f5f0 : fltmgr!FltpDispatch+0xcd
fffffa60`0b142a10 fffff800`026e6950 : 00000000`00000000 fffffa80`0adcad70 fffff880`0a83c350 fffffa80`0adcad70 : nt!IopCloseFile+0x184
fffffa60`0b142aa0 fffff800`026e6d07 : fffff880`0a83c350 fffffa80`00000001 fffffa80`0b53cc10 00000000`00000000 : nt!ObpDecrementHandleCount+0xc0
fffffa60`0b142b30 fffff800`026e6ec4 : fffff880`0a572a80 fffff880`0a572a00 00000000`00000001 00000000`000004d4 : nt!ObpCloseHandleTableEntry+0xb7
fffffa60`0b142bd0 fffff800`02469df3 : fffffa80`0c7bd200 fffffa60`0b142ca0 00000000`80004000 00000000`00000000 : nt!ObpCloseHandle+0x94
fffffa60`0b142c20 00000000`77b75b6a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`099bec18 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77b75b6a


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiBadShareCount+4b
fffff800`024e13bb cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MiBadShareCount+4b

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 48d1ba35

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4b

BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4b

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 00000000001f4279, page frame number
Arg3: 0000000000000002, current page state
Arg4: 00000000001f1bb8, 0

Debugging Details:
------------------


BUGCHECK_STR: 0x4E_99

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: explorer.exe

CURRENT_IRQL: 2

LAST_CONTROL_TRANSFER: from fffff800024e13bb to fffff8000246a350

STACK_TEXT:
fffffa60`0b141b18 fffff800`024e13bb : 00000000`0000004e 00000000`00000099 00000000`001f4279 00000000`00000002 : nt!KeBugCheckEx
fffffa60`0b141b20 fffff800`0245b49f : fffff880`0e65cfc0 00000000`00000fc0 00000000`00000040 fffff880`0e2a2c50 : nt!MiBadShareCount+0x4b
fffffa60`0b141b60 fffff800`0245b683 : 00000000`00000000 fffffa80`096a8e01 00000000`00000000 00000000`00000000 : nt!MmPurgeSection+0x82f
fffffa60`0b141bf0 fffff800`02444ec7 : fffffa80`08a6af50 00000000`2621a000 fffff880`001821c0 00000000`00000000 : nt!CcPurgeCacheSection+0x147
fffffa60`0b141c50 fffff800`0248d9a7 : fffffa80`096a8e30 fffffa80`096a8e30 fffffa60`0b142798 fffffa60`012ec282 : nt!CcPurgeAndClearCacheSection+0x6b
fffffa60`0b141cf0 fffffa60`012b8d99 : fffff880`0e2a2ba0 00000000`2621a000 00000000`2621a000 fffff880`0e2a2ba0 : nt!CcSetFileSizesEx+0x237
fffffa60`0b141d70 fffffa60`012abb0b : fffff880`0e2a2ba0 fffffa80`09577b80 fffffa60`0b142701 00000000`00000000 : Ntfs!NtfsDeleteAllocation+0x309
fffffa60`0b141e50 fffffa60`012aa1ce : fffffa60`0b142740 fffff880`0e2a2a01 fffff880`0e2a2ba0 00000000`00000001 : Ntfs!NtfsDeleteAllocationFromRecord+0x17b
fffffa60`0b141f10 fffffa60`012d22da : fffffa60`0b142740 fffff880`0e2a2a70 fffff880`0ab18a00 fffffa60`0b142203 : Ntfs!NtfsDeleteFile+0x8fe
fffffa60`0b1421a0 fffffa60`0121f999 : 00000000`00000000 00001f80`00000000 fffffa60`0b1426a0 00000000`00000000 : Ntfs!NtfsCommonCleanup+0xe8a
fffffa60`0b1425b0 fffff800`0248b3d1 : fffffa60`0b1426a0 5000ee17`b6bf0002 fffffa80`09d2f5f0 00000000`00000000 : Ntfs!NtfsCommonCleanupCallout+0x19
fffffa60`0b1425e0 fffffa60`0121f162 : fffffa60`0121f980 fffffa60`0b1426a0 fffffa60`0b142740 fffffa60`0b142740 : nt!KeExpandKernelStackAndCalloutEx+0x2e1
fffffa60`0b142670 fffffa60`012d5fa8 : fffffa60`0b142740 fffffa80`09d58b80 fffffa60`0b142740 fffffa60`0b1428f0 : Ntfs!NtfsCommonCleanupOnNewStack+0x42
fffffa60`0b1426e0 fffffa60`00c73e17 : fffffa60`0b142740 fffffa80`09d58b80 fffffa80`09d58e90 fffffa80`086cb410 : Ntfs!NtfsFsdCleanup+0x138
fffffa60`0b142940 fffffa60`00c730dd : fffffa80`09d58b80 00000000`00000000 fffffa80`081e4401 00000000`00000000 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x227
fffffa60`0b1429b0 fffff800`026e92e4 : fffffa80`0adcad70 00000000`00000000 fffffa80`09d2f5f0 fffffa80`09d2f5f0 : fltmgr!FltpDispatch+0xcd
fffffa60`0b142a10 fffff800`026e6950 : 00000000`00000000 fffffa80`0adcad70 fffff880`0a83c350 fffffa80`0adcad70 : nt!IopCloseFile+0x184
fffffa60`0b142aa0 fffff800`026e6d07 : fffff880`0a83c350 fffffa80`00000001 fffffa80`0b53cc10 00000000`00000000 : nt!ObpDecrementHandleCount+0xc0
fffffa60`0b142b30 fffff800`026e6ec4 : fffff880`0a572a80 fffff880`0a572a00 00000000`00000001 00000000`000004d4 : nt!ObpCloseHandleTableEntry+0xb7
fffffa60`0b142bd0 fffff800`02469df3 : fffffa80`0c7bd200 fffffa60`0b142ca0 00000000`80004000 00000000`00000000 : nt!ObpCloseHandle+0x94
fffffa60`0b142c20 00000000`77b75b6a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`099bec18 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77b75b6a


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiBadShareCount+4b
fffff800`024e13bb cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MiBadShareCount+4b

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 48d1ba35

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4b

BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4b

Followup: MachineOwner
---------


I tried the microsoft cleaup utility but i can only see software that i can uninstall in the control panel.
I think vmware installed some drivers which weren't unistalled that may couse all this.

ok i went with a more sophisticated ram test and it turned out one module was returning errors. i pulled it out and now as i am waiting for the replacement i keeo an eye for any more bsods.
i hope this will fix it, thanks for all your help