BSOD:system service exception

[cris.]

ciao a tutti da un po di tempo quando accendo il pc mi dà la schermata blu solo che non la fa sempre ma passa pure qualche giorno o settimana e non è sempre lo stesso tipo di errore che sembrava sempre riferito a dei driver, comunque ho fatto 2 passaggi di memtest e non si è riavviato.
ieri ho formattato perchè avevo l'hd pieno di roba e oggi mi ha ridato la schermata blu
posto il log del minidump

Spoiler:

********************************************************** *********************
* *
* Bugcheck Analysis *
* *
********************************************************** *********************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff960000f4c5f, fffff88002944ca0, 0}

Probably caused by : win32k.sys ( win32k!XEPALOBJ::vUnrefPalette+f )

Followup: MachineOwner
---------

2: kd> !analyze -v
********************************************************** *********************
* *
* Bugcheck Analysis *
* *
********************************************************** *********************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff960000f4c5f, Address of the instruction which caused the bugcheck
Arg3: fffff88002944ca0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - L'istruzione a 0x%08lx ha fatto riferimento alla memoria a 0x%08lx. La memoria non poteva essere %s.

FAULTING_IP:
win32k!XEPALOBJ::vUnrefPalette+f
fffff960`000f4c5f 488b08 mov rcx,qword ptr [rax]

CONTEXT: fffff88002944ca0 -- (.cxr 0xfffff88002944ca0)
rax=fffdf900c0097f20 rbx=fffff88002945760 rcx=fffff88002945760
rdx=fffff90000002000 rsi=fffff900c2378010 rdi=0000000000000001
rip=fffff960000f4c5f rsp=fffff88002945680 rbp=0000000000000001
r8=0000000000000820 r9=0000000000000000 r10=fffff80002a5a000
r11=0000000000000034 r12=fffff900c2378238 r13=0000000000000001
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0000 ds=002b es=002b fs=0053 gs=002b efl=00010246
win32k!XEPALOBJ::vUnrefPalette+0xf:
fffff960`000f4c5f 488b08 mov rcx,qword ptr [rax] ds:002b:fffdf900`c0097f20=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x3B

PROCESS_NAME: Xfire.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff960000f4c5f

STACK_TEXT:
fffff880`02945680 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!XEPALOBJ::vUnrefPalette+0xf


FOLLOWUP_IP:
win32k!XEPALOBJ::vUnrefPalette+f
fffff960`000f4c5f 488b08 mov rcx,qword ptr [rax]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: win32k!XEPALOBJ::vUnrefPalette+f

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc5e0

STACK_COMMAND: .cxr 0xfffff88002944ca0 ; kb

FAILURE_BUCKET_ID: X64_0x3B_win32k!XEPALOBJ::vUnrefPalette+f

BUCKET_ID: X64_0x3B_win32k!XEPALOBJ::vUnrefPalette+f

Followup: MachineOwner
---------

l'errore sembra essere causato da xfire ma prima di formattare lo dava anche con xfire chiuso


metto anche i minidump dei bsod che mi dava prima di formattare

Spoiler:

********************************************************** *********************
* *
* Bugcheck Analysis *
* *
********************************************************** *********************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {3, fffffa8003646880, fffdfa8003646880, fffffa8003646880}

Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+a56 )

Followup: Pool_corruption
---------

3: kd> !analyze -v
********************************************************** *********************
* *
* Bugcheck Analysis *
* *
********************************************************** *********************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000003, the pool freelist is corrupt.
Arg2: fffffa8003646880, the pool entry being checked.
Arg3: fffdfa8003646880, the read back flink freelist value (should be the same as 2).
Arg4: fffffa8003646880, the read back blink freelist value (should be the same as 2).

Debugging Details:
------------------


BUGCHECK_STR: 0x19_3

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: svchost.exe

CURRENT_IRQL: 0

LOCK_ADDRESS: fffff800030c9400 -- (!locks fffff800030c9400)

Resource @ nt!PiEngineLock (0xfffff800030c9400) Available

WARNING: SystemResourcesList->Flink chain invalid. Resource may be corrupted, or already deleted.


WARNING: SystemResourcesList->Blink chain invalid. Resource may be corrupted, or already deleted.

1 total locks

PNP_TRIAGE:
Lock address : 0xfffff800030c9400
Thread Count : 0
Thread address: 0x0000000000000000
Thread wait : 0x0

LAST_CONTROL_TRANSFER: from fffff80002ff8d6f to fffff80002ec5700

STACK_TEXT:
fffff880`06991818 fffff800`02ff8d6f : 00000000`00000019 00000000`00000003 fffffa80`03646880 fffdfa80`03646880 : nt!KeBugCheckEx
fffff880`06991820 fffff800`03131799 : 00000980`00000004 fffff880`069919c0 00000000`00000001 00000000`00000000 : nt!ExDeferredFreePool+0xa56
fffff880`06991910 fffff800`031318d3 : 00000000`00000002 00000000`00000001 fffff880`06991ae0 00000000`00000000 : nt!IopAllocateBuffer+0x21
fffff880`06991940 fffff800`03132c81 : 00000000`00000002 00000000`00000000 fffff880`06991b40 00000000`00000001 : nt!IopGetDeviceInterfaces+0xa7
fffff880`06991ab0 fffff800`03130abd : 00000000`00000002 00000000`00000000 00000000`00000000 fffff8a0`038eaa50 : nt!PiGetInterfaceDeviceList+0x41
fffff880`06991b10 fffff800`03166180 : fffff8a0`038eaa50 fffff800`00008000 fffff880`06991c01 fffff800`03390da0 : nt!PiControlGetInterfaceDeviceList+0x111
fffff880`06991b90 fffff800`02ec4953 : fffffa80`05705b60 00000000`007eed40 fffff880`06991c60 00000000`007eedc8 : nt!NtPlugPlayControl+0x100
fffff880`06991be0 00000000`76d8070a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`007eed08 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76d8070a


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!ExDeferredFreePool+a56
fffff800`02ff8d6f cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!ExDeferredFreePool+a56

FOLLOWUP_NAME: Pool_corruption

IMAGE_NAME: Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: Pool_Corruption

FAILURE_BUCKET_ID: X64_0x19_3_nt!ExDeferredFreePool+a56

BUCKET_ID: X64_0x19_3_nt!ExDeferredFreePool+a56

Followup: Pool_corruption
---------

Spoiler:

********************************************************** *********************
* *
* Bugcheck Analysis *
* *
********************************************************** *********************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002e9f93d, Address of the instruction which caused the bugcheck
Arg3: fffff8800936b9d0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - L'istruzione a 0x%08lx ha fatto riferimento alla memoria a 0x%08lx. La memoria non poteva essere %s.

FAULTING_IP:
nt!KeAcquireGuardedMutex+1d
fffff800`02e9f93d f00fba3100 lock btr dword ptr [rcx],0

CONTEXT: fffff8800936b9d0 -- (.cxr 0xfffff8800936b9d0)
rax=fffff8a004e58780 rbx=fffdfa8004475a00 rcx=fffdfa8004475a00
rdx=fffff8a004e58870 rsi=fffff8800936c430 rdi=fffffa8006178060
rip=fffff80002e9f93d rsp=fffff8800936c3a0 rbp=0000000000000001
r8=0000000000000001 r9=fffff8800936c430 r10=fffff88002fd5ca0
r11=fffffa80044758c0 r12=fffff8a004e58801 r13=0000000000000000
r14=0000000000000000 r15=fffffa80037432a0
iopl=0 nv up ei ng nz ac po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00210296
nt!KeAcquireGuardedMutex+0x1d:
fffff800`02e9f93d f00fba3100 lock btr dword ptr [rcx],0 ds:002b:fffdfa80`04475a00=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x3B

PROCESS_NAME: gta-vc.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff80002e9f93d

STACK_TEXT:
fffff880`0936c3a0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeAcquireGuardedMutex+0x1d


FOLLOWUP_IP:
nt!KeAcquireGuardedMutex+1d
fffff800`02e9f93d f00fba3100 lock btr dword ptr [rcx],0

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!KeAcquireGuardedMutex+1d

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4d9fdd34

STACK_COMMAND: .cxr 0xfffff8800936b9d0 ; kb

FAILURE_BUCKET_ID: X64_0x3B_nt!KeAcquireGuardedMutex+1d

BUCKET_ID: X64_0x3B_nt!KeAcquireGuardedMutex+1d

Followup: MachineOwner
---------

Spoiler:

********************************************************** *********************
* *
* Bugcheck Analysis *
* *
********************************************************** *********************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff880033a3248, fffff880033a2ab0, fffff8800125014b}

Probably caused by : Ntfs.sys ( Ntfs!NtfsLookupAllocation+eb )

Followup: MachineOwner
---------

0: kd> !analyze -v
********************************************************** *********************
* *
* Bugcheck Analysis *
* *
********************************************************** *********************

NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff880033a3248
Arg3: fffff880033a2ab0
Arg4: fffff8800125014b

Debugging Details:
------------------


EXCEPTION_RECORD: fffff880033a3248 -- (.exr 0xfffff880033a3248)
ExceptionAddress: fffff8800125014b (Ntfs!NtfsLookupAllocation+0x00000000000000eb)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT: fffff880033a2ab0 -- (.cxr 0xfffff880033a2ab0)
rax=fffdf8a009c71950 rbx=fffff8a009c71970 rcx=fffff8a009c71950
rdx=0000000000000000 rsi=0000000000000000 rdi=fffff8a009c71880
rip=fffff8800125014b rsp=fffff880033a3480 rbp=fffff880033a3920
r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
r11=fffffa8006119770 r12=0000000000000000 r13=0000000000000000
r14=fffff880033a3640 r15=fffff880033a36c0
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010282
Ntfs!NtfsLookupAllocation+0xeb:
fffff880`0125014b 483b7008 cmp rsi,qword ptr [rax+8] ds:002b:fffdf8a0`09c71958=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: svchost.exe

CURRENT_IRQL: 1

ERROR_CODE: (NTSTATUS) 0xc0000005 - L'istruzione a 0x%08lx ha fatto riferimento alla memoria a 0x%08lx. La memoria non poteva essere %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - L'istruzione a 0x%08lx ha fatto riferimento alla memoria a 0x%08lx. La memoria non poteva essere %s.

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030b30e0
ffffffffffffffff

FOLLOWUP_IP:
Ntfs!NtfsLookupAllocation+eb
fffff880`0125014b 483b7008 cmp rsi,qword ptr [rax+8]

FAULTING_IP:
Ntfs!NtfsLookupAllocation+eb
fffff880`0125014b 483b7008 cmp rsi,qword ptr [rax+8]

BUGCHECK_STR: 0x24

LAST_CONTROL_TRANSFER: from fffff880012f9515 to fffff8800125014b

STACK_TEXT:
fffff880`033a3480 fffff880`012f9515 : fffffa80`06119620 fffff8a0`09c71880 00000000`00000000 fffff880`033a3650 : Ntfs!NtfsLookupAllocation+0xeb
fffff880`033a35f0 fffff880`0137ac77 : fffffa80`06119620 fffff8a0`09c71880 fffffa80`046088e0 00000000`00000001 : Ntfs!NtfsPreloadAllocation+0x91
fffff880`033a36b0 fffff880`01344882 : fffffa80`06119620 00000000`00000008 fffffa80`04608800 fffff880`00000020 : Ntfs!NtfsGetRetrievalPointers+0x4d3
fffff880`033a3800 fffff880`012fb3ed : fffffa80`06119620 00000000`00000000 fffff880`033a3920 00000000`00000000 : Ntfs! ?? ::NNGAKEGL::`string'+0x1c8fd
fffff880`033a3840 fffff880`0107623f : fffff880`033a3990 fffffa80`04d93190 fffff880`033a3901 fffffa80`06119620 : Ntfs!NtfsFsdFileSystemControl+0x13d
fffff880`033a38e0 fffff880`0109591e : fffffa80`046088e0 fffffa80`0652f490 fffffa80`04608800 fffffa80`04d93190 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24 f
fffff880`033a3970 fffff800`03195467 : fffffa80`0652f490 fffff880`033a3c60 fffffa80`04d93578 fffffa80`04d93190 : fltmgr!FltpFsControl+0xee
fffff880`033a39d0 fffff800`0315e69a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x607
fffff880`033a3b00 fffff800`02e7a953 : fffffa80`054b4340 00000000`00000001 fffffa80`0690c740 fffff800`03190164 : nt!NtFsControlFile+0x56
fffff880`033a3b70 00000000`76f3fa4a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0389e5f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76f3fa4a


SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: Ntfs!NtfsLookupAllocation+eb

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME: Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4d79996d

STACK_COMMAND: .cxr 0xfffff880033a2ab0 ; kb

FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsLookupAllocation+eb

BUCKET_ID: X64_0x24_Ntfs!NtfsLookupAllocation+eb

Followup: MachineOwner

Spoiler:

********************************************************** *********************
* *
* Bugcheck Analysis *
* *
********************************************************** *********************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41284, fffff68000080001, 8e, fffff70001080000}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4a13 )

Followup: MachineOwner
---------

3: kd> !analyze -v
********************************************************** *********************
* *
* Bugcheck Analysis *
* *
********************************************************** *********************

MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041284, A PTE or the working set list is corrupt.
Arg2: fffff68000080001
Arg3: 000000000000008e
Arg4: fffff70001080000

Debugging Details:
------------------


BUGCHECK_STR: 0x1a_41284

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: Xfire.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from fffff80002ee2493 to fffff80002e8d700

STACK_TEXT:
fffff880`08e565d8 fffff800`02ee2493 : 00000000`0000001a 00000000`00041284 fffff680`00080001 00000000`0000008e : nt!KeBugCheckEx
fffff880`08e565e0 fffff800`02ec03f9 : fffffa80`0549f3f8 00000000`00000000 00000000`00000000 00000000`00000002 : nt! ?? ::FNODOBFM::`string'+0x4a13
fffff880`08e56620 fffff800`02ec068a : fffffa80`006eeb90 fffffa80`0549f060 00000000`00000000 fffff680`00080158 : nt!MiTerminateWsle+0x29
fffff880`08e56660 fffff800`02ebe965 : fffffa80`0549f060 00000000`1002b000 00000000`00000000 00000000`02831000 : nt!MiDeletePageTableHierarchy+0xca
fffff880`08e56770 fffff800`02ec0e79 : fffffa80`00000000 00000000`1002bfff 00000000`00000000 fffffa80`0614eb60 : nt!MiDeleteVirtualAddresses+0x96c
fffff880`08e56930 fffff800`02e607cc : ffffffff`ffffffff 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0xd9
fffff880`08e56a50 fffff800`0317194b : fffff8a0`0a33c5d0 00000000`00000001 00000000`00000000 fffffa80`0396c060 : nt!MmCleanProcessAddressSpace+0x228
fffff880`08e56aa0 fffff800`0314a7cb : 00000000`c000004b 00000000`00000001 00000000`7efa1000 00000000`00000000 : nt!PspExitThread+0x92f
fffff880`08e56b60 fffff800`02e8c953 : fffffa80`0549f060 00000000`c000004b 00000000`7efa1001 fffffa80`0396c060 : nt!NtTerminateProcess+0x25b
fffff880`08e56be0 00000000`77b1f97a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`04e6e808 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77b1f97a


STACK_COMMAND: kb

FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+4a13
fffff800`02ee2493 cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+4a13

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4d9fdd34

FAILURE_BUCKET_ID: X64_0x1a_41284_nt!_??_::FNODOBFM::_string_+4a13

BUCKET_ID: X64_0x1a_41284_nt!_??_::FNODOBFM::_string_+4a13

Followup: MachineOwner
---------