Hi There!! I have sometimes every 30 minutes the following Blue Screen. PC System: Windows 7 64bits (installed days ago) Intel E7400 2x2GB A Data Ram 800mhz Mobo Gigabyte G31M-es2l Ati Radeon 4350 with last catalystics Drivers Its happens just with Mozilla Opens,Nod32 .. nothing more.. Thanks in Advance Copy/paste Report Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Windows\Minidump\121109-15256-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (2 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16385.amd64fre.win7_rtm.090713-1255 Machine Name: Kernel base = 0xfffff800`02c19000 PsLoadedModuleList = 0xfffff800`02e56e50 Debug session time: Fri Dec 11 21:38:25.378 2009 (GMT+1) System Uptime: 0 days 7:06:14.110 Loading Kernel Symbols ............................................................... ................................................................ ..................... Loading User Symbols Loading unloaded module list ..... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck A, {fffff47fffffffd0, 2, 1, fffff80002cac4c9} Probably caused by : memory_corruption ( nt!MiUnlinkPageFromLockedList+6c9 ) Followup: MachineOwner --------- 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* IRQL_NOT_LESS_OR_EQUAL (a) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If a kernel debugger is available get the stack backtrace. Arguments: Arg1: fffff47fffffffd0, memory referenced Arg2: 0000000000000002, IRQL Arg3: 0000000000000001, bitfield : bit 0 : value 0 = read operation, 1 = write operation bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status) Arg4: fffff80002cac4c9, address which referenced memory Debugging Details: ------------------ WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ec10e0 fffff47fffffffd0 CURRENT_IRQL: 2 FAULTING_IP: nt!MiUnlinkPageFromLockedList+6c9 fffff800`02cac4c9 488914c1 mov qword ptr [rcx+rax*8],rdx CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0xA PROCESS_NAME: System TRAP_FRAME: fffff880031328f0 -- (.trap 0xfffff880031328f0) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=ffffff3ffffffffa rbx=0000000000000000 rcx=fffffa8000000000 rdx=000000000002fcd4 rsi=0000000000000000 rdi=0000000000000000 rip=fffff80002cac4c9 rsp=fffff88003132a80 rbp=fffff880009e9180 r8=0000058000000000 r9=fffffa8000000008 r10=00000000000115a5 r11=2aaaaaaaaaaaaaab r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei ng nz ac po cy nt!MiUnlinkPageFromLockedList+0x6c9: fffff800`02cac4c9 488914c1 mov qword ptr [rcx+rax*8],rdx ds:0010:fffff47f`ffffffd0=???????????????? Resetting default scope LAST_CONTROL_TRANSFER: from fffff80002c8a469 to fffff80002c8af00 STACK_TEXT: fffff880`031327a8 fffff800`02c8a469 : 00000000`0000000a fffff47f`ffffffd0 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx fffff880`031327b0 fffff800`02c890e0 : fffff880`031328f8 fffffa80`008f7f90 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69 fffff880`031328f0 fffff800`02cac4c9 : 00000000`00000000 fffffa80`039eac68 0000003b`8b5ba449 fffff800`02c94756 : nt!KiPageFault+0x260 fffff880`03132a80 fffff800`02cc142c : 00000000`00000003 fffff800`00000000 00000000`00000000 fffffa80`008f7f90 : nt!MiUnlinkPageFromLockedList+0x6c9 fffff880`03132b10 fffff800`02cc2258 : 00000000`00000000 fffffa80`046757c0 fffffa80`04675858 00000000`0000000f : nt!MiGatherMappedPages+0x108 fffff880`03132c10 fffff800`02f2e166 : fffffa80`039eab60 00000000`00000080 fffffa80`039ca040 7b1bffef`7fbf7bf7 : nt!MiMappedPageWriter+0x198 fffff880`03132d00 fffff800`02c69486 : fffff800`02e03e80 fffffa80`039eab60 fffffa80`039ea040 96fffbfa`fbdffbff : nt!PspSystemThreadStartup+0x5a fffff880`03132d40 00000000`00000000 : fffff880`03133000 fffff880`0312d000 fffff880`03132890 00000000`00000000 : nt!KxStartSystemThread+0x16 STACK_COMMAND: kb FOLLOWUP_IP: nt!MiUnlinkPageFromLockedList+6c9 fffff800`02cac4c9 488914c1 mov qword ptr [rcx+rax*8],rdx SYMBOL_STACK_INDEX: 3 SYMBOL_NAME: nt!MiUnlinkPageFromLockedList+6c9 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc600 IMAGE_NAME: memory_corruption FAILURE_BUCKET_ID: X64_0xA_nt!MiUnlinkPageFromLockedList+6c9 BUCKET_ID: X64_0xA_nt!MiUnlinkPageFromLockedList+6c9 Followup: MachineOwner

Hello,I think the fastest way to track this on is to use a testing tool called Driver Verifier.If this tool finds a problem, your machine will crash again. Hopefully with it enabled, it will allow you to easily identify the bad driver.Enable driver verifier1) Open an elevated command prompt2) Type "verifier /standard /all" (no quotes)3) Reboot your machine4) Use machine again until it crashes (hopefully this will be fast :)After the crash & reboot, go into safe mode. http://windowshelp.microsoft.com/Windows/en-US/Help/323ef48f-7b93-4079-a48a-5c58eec904a11033.mspxDisable driver verifier1) Open an elevated command prompt2) Type "verifier /reset" (no quotes)3) Reboot your machineThen using the steps you followed before, take a look at the new memory dump.Want to know if your current hardware & software will work with Windows 7? Check out these links: **Windows 7 Upgrade Advisor ** **Windows 7 Compatibility Center**

Hi Mark Thanks by your help. I follow your steps and the result is: Use !analyze -v to get detailed debugging information. BugCheck C4, {f6, 174, fffffa80049f9450, fffff88002cc540a} Unable to load image ElbyCDIO.sys, Win32 error 0n2 *** WARNING: Unable to verify timestamp for ElbyCDIO.sys *** ERROR: Module load completed but symbols could not be loaded for ElbyCDIO.sys Probably caused by : ElbyCDIO.sys ( ElbyCDIO+240a ) Followup: MachineOwner --------- 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* DRIVER_VERIFIER_DETECTED_VIOLATION (c4) A device driver attempting to corrupt the system has been caught. This is because the driver was specified in the registry as being suspect (by the administrator) and the kernel has enabled substantial checking of this driver. If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will be among the most commonly seen crashes. Arguments: Arg1: 00000000000000f6, Referencing user handle as KernelMode. Arg2: 0000000000000174, Handle value being referenced. Arg3: fffffa80049f9450, Address of the current process. Arg4: fffff88002cc540a, Address inside the driver that is performing the incorrect reference. Debugging Details: ------------------ BUGCHECK_STR: 0xc4_f6 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: VCDDaemon.exe CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from fffff800031583dc to fffff80002ccef00 STACK_TEXT: fffff880`07425568 fffff800`031583dc : 00000000`000000c4 00000000`000000f6 00000000`00000174 fffffa80`049f9450 : nt!KeBugCheckEx fffff880`07425570 fffff800`0316dae4 : 00000000`00000174 fffffa80`049f9450 00000000`00000002 fffff980`15604000 : nt!VerifierBugCheckIfAppropriate+0x3c fffff880`074255b0 fffff800`02f29720 : 00000000`00000000 fffff880`074257e0 00000000`00000000 fffff980`18940e00 : nt!VfCheckUserHandle+0x1b4 fffff880`07425690 fffff800`02fa3425 : fffffa80`05560500 00000000`00000080 00000000`00000000 fffff800`02fa3400 : nt! ?? ::NNGAKEGL::`string'+0x2105e fffff880`07425760 fffff800`0316d878 : 00000000`00000081 fffff800`0316a107 fffff880`02cc53be 00000000`001e01b8 : nt!ObReferenceObjectByHandle+0x25 fffff880`074257b0 fffff880`02cc540a : 00000000`00000174 00000000`001e01b8 fffff980`18940ee0 00000000`00000002 : nt!VerifierObReferenceObjectByHandle+0x48 fffff880`07425800 00000000`00000174 : 00000000`001e01b8 fffff980`18940ee0 00000000`00000002 fffff880`07425830 : ElbyCDIO+0x240a fffff880`07425808 00000000`001e01b8 : fffff980`18940ee0 00000000`00000002 fffff880`07425830 00000000`00000000 : 0x174 fffff880`07425810 fffff980`18940ee0 : 00000000`00000002 fffff880`07425830 00000000`00000000 00000000`00000010 : 0x1e01b8 fffff880`07425818 00000000`00000002 : fffff880`07425830 00000000`00000000 00000000`00000010 00000000`00010202 : 0xfffff980`18940ee0 fffff880`07425820 fffff880`07425830 : 00000000`00000000 00000000`00000010 00000000`00010202 fffff880`07425858 : 0x2 fffff880`07425828 00000000`00000000 : 00000000`00000010 00000000`00010202 fffff880`07425858 fffffa80`05592e90 : 0xfffff880`07425830 STACK_COMMAND: kb FOLLOWUP_IP: ElbyCDIO+240a fffff880`02cc540a 85c0 test eax,eax SYMBOL_STACK_INDEX: 6 SYMBOL_NAME: ElbyCDIO+240a FOLLOWUP_NAME: MachineOwner MODULE_NAME: ElbyCDIO IMAGE_NAME: ElbyCDIO.sys DEBUG_FLR_IMAGE_TIMESTAMP: 499aefbb FAILURE_BUCKET_ID: X64_0xc4_f6_ElbyCDIO+240a BUCKET_ID: X64_0xc4_f6_ElbyCDIO+240a Followup: MachineOwner What can i do now ?

It looks as if you have unsupported software.Elaborate Bytes Virtual CloneDrive and ANYDVD.You should uninstall those two packages and run a complete virus / malware scan.

It looks as if you have unsupported software. Elaborate Bytes Virtual CloneDrive and ANYDVD. You should uninstall those two packages and run a complete virus / malware scan. Hi Bubbapcguy, Clone software now Uninstalled. I had aleatory bluescreens without clonedrive installed,now im checking with Nod32 and cccleaner... Thanks in advance

It's possible that there are multiple problems then. After uninstalling that app, enable driver verifier again and see if you get any more crashes.Want to know if your current hardware & software will work with Windows 7? Check out these links: **Windows 7 Upgrade Advisor ** **Windows 7 Compatibility Center**

It's possible that there are multiple problems then. After uninstalling that app, enable driver verifier again and see if you get any more crashes. Want to know if your current hardware & software will work with Windows 7? Check out these links: **Windows 7 Upgrade Advisor ** **Windows 7 Compatibility Center ** Hi Mark. Once time enabled the verifier option i had multiple crashed,about Gigabyte software and another without info but continues with memory corruption Im thinking to reinstalling the W7 again,maybe something is wrong from the begining(in the OS) because any bad software. No viruses or malware in my PC. My last crash : IRQL_NOT_LESS_OR_EQUAL (a) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If a kernel debugger is available get the stack backtrace. Arguments: Arg1: fffff47fffffffd0, memory referenced Arg2: 0000000000000002, IRQL Arg3: 0000000000000001, bitfield : bit 0 : value 0 = read operation, 1 = write operation bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status) Arg4: fffff80002cae4c9, address which referenced memory Debugging Details: ------------------ WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ec30e0 fffff47fffffffd0 CURRENT_IRQL: 2 FAULTING_IP: nt!MiUnlinkPageFromLockedList+6c9 fffff800`02cae4c9 488914c1 mov qword ptr [rcx+rax*8],rdx CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0xA PROCESS_NAME: System TRAP_FRAME: fffff8800317f8f0 -- (.trap 0xfffff8800317f8f0) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=ffffff3ffffffffa rbx=0000000000000000 rcx=fffffa8000000000 rdx=000000000010a394 rsi=0000000000000000 rdi=0000000000000000 rip=fffff80002cae4c9 rsp=fffff8800317fa80 rbp=fffff80002e05e80 r8=0000058000000000 r9=fffffa8000000008 r10=fffff80002c1b000 r11=2aaaaaaaaaaaaaab r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei ng nz ac po cy nt!MiUnlinkPageFromLockedList+0x6c9: fffff800`02cae4c9 488914c1 mov qword ptr [rcx+rax*8],rdx ds:7a30:fffff47f`ffffffd0=???????????????? Resetting default scope LAST_CONTROL_TRANSFER: from fffff80002c8c469 to fffff80002c8cf00 STACK_TEXT: fffff880`0317f7a8 fffff800`02c8c469 : 00000000`0000000a fffff47f`ffffffd0 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx fffff880`0317f7b0 fffff800`02c8b0e0 : fffffa80`065bf000 fffffa80`015f3f90 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69 fffff880`0317f8f0 fffff800`02cae4c9 : 00000000`00000000 fffffa80`04417a08 00000014`d692ea11 fffff800`02c96756 : nt!KiPageFault+0x260 fffff880`0317fa80 fffff800`02cc342c : 00000000`00000002 fffff800`00000000 00000000`00000000 fffffa80`015f3f90 : nt!MiUnlinkPageFromLockedList+0x6c9 fffff880`0317fb10 fffff800`02cc4258 : 00000000`00000000 fffffa80`065bfc00 fffffa80`065bfc98 00000000`0000000a : nt!MiGatherMappedPages+0x108 fffff880`0317fc10 fffff800`02f30166 : fffffa80`04417900 00000000`00000080 fffffa80`0398f890 00000000`00000000 : nt!MiMappedPageWriter+0x198 fffff880`0317fd00 fffff800`02c6b486 : fffff800`02e05e80 fffffa80`04417900 fffffa80`04416680 00000000`00000000 : nt!PspSystemThreadStartup+0x5a fffff880`0317fd40 00000000`00000000 : fffff880`03180000 fffff880`0317a000 fffff880`0317f890 00000000`00000000 : nt!KxStartSystemThread+0x16 STACK_COMMAND: kb FOLLOWUP_IP: nt!MiUnlinkPageFromLockedList+6c9 fffff800`02cae4c9 488914c1 mov qword ptr [rcx+rax*8],rdx SYMBOL_STACK_INDEX: 3 SYMBOL_NAME: nt!MiUnlinkPageFromLockedList+6c9 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc600 IMAGE_NAME: memory_corruption FAILURE_BUCKET_ID: X64_0xA_nt!MiUnlinkPageFromLockedList+6c9 BUCKET_ID: X64_0xA_nt!MiUnlinkPageFromLockedList+6c9 Followup: MachineOwner ---------

Try upgrading to the latest BIOS for your motherboard

Once time enabled the verifier option i had multiple crashed,about Gigabyte software and another without info but continues with memory corruption Your most recent crash is not verifier related, but still references memory corruption. Was verifier running at the time you hit that crash?Want to know if your current hardware & software will work with Windows 7? Check out these links: **Windows 7 Upgrade Advisor ** **Windows 7 Compatibility Center**

Hi Again. The bios is the last one. Since 4 days that I installed W7 32bits the bluescreens are history,so by the moment its working ok. Maybe any driver of my new PC for w7 64bits is not ready yet. Thanks to all.