Code:

 Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
 
Loading Dump File [C:\Users\richc46\AppData\Local\Temp\Temp1_Dump%20File![1].zip\Mini121910-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows Server 2008/Windows Vista Kernel Version 6002 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6002.18267.x86fre.vistasp2_gdr.100608-0458
Machine Name:
Kernel base = 0x84e13000 PsLoadedModuleList = 0x84f2ac70
Debug session time: Sun Dec 19 13:43:05.172 2010 (GMT-5)
System Uptime: 0 days 11:49:59.021
Loading Kernel Symbols
...............................................................
................................................................
................................................................
.......
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000000A, {1f817481, 2, 1, 84ebce64}
Probably caused by : ntkrpamp.exe ( nt!KiTimerExpiration+1c3 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 1f817481, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
 bit 0 : value 0 = read operation, 1 = write operation
 bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 84ebce64, address which referenced memory
Debugging Details:
------------------
 
WRITE_ADDRESS: GetPointerFromAddress: unable to read from 84f4a868
Unable to read MiSystemVaType memory at 84f2a420
 1f817481 
CURRENT_IRQL:  2
FAULTING_IP: 
nt!KiTimerExpiration+1c3
84ebce64 890a            mov     dword ptr [edx],ecx
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0xA
PROCESS_NAME:  svchost.exe
LAST_CONTROL_TRANSFER:  from 84ebd635 to 84ebce64
STACK_TEXT:  
8059df88 84ebd635 00000000 00000000 0029aac1 nt!KiTimerExpiration+0x1c3
8059dff4 84ebb2f5 bf85ad10 00000000 00000000 nt!KiRetireDpcList+0xba
8059dff8 bf85ad10 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x45
WARNING: Frame IP not in any known module. Following frames may be wrong.
84ebb2f5 00000000 0000001b 00c7850f bb830000 0xbf85ad10
 
STACK_COMMAND:  kb
FOLLOWUP_IP: 
nt!KiTimerExpiration+1c3
84ebce64 890a            mov     dword ptr [edx],ecx
SYMBOL_STACK_INDEX:  0
SYMBOL_NAME:  nt!KiTimerExpiration+1c3
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: nt
IMAGE_NAME:  ntkrpamp.exe
DEBUG_FLR_IMAGE_TIMESTAMP:  4c0e557c
FAILURE_BUCKET_ID:  0xA_nt!KiTimerExpiration+1c3
BUCKET_ID:  0xA_nt!KiTimerExpiration+1c3
Followup: MachineOwner
---------

The reports that I analyze give clues not answers to the BSOD problem. You have had only one and there are not many clues. It appears to be a driver, but that is suspect. The driver given as the cause, is not the true cause but the one that is named in lieu of the actual culprit. Follow my instructions. When if you get other BSODs after that just post

These drivers must be updated

Code:

Aspi32.SYS   Fri Sep 10 19:46:10 1999
AFS.sys      Mon Feb 25 18:04:47 2002
windrvNT.sys Mon May 10 04:42:04 2004
lirsgt.sys   Sun Jan 29 06:06:18 2006
secdrv.SYS   Wed Sep 13 09:18:32 2006
peauth.sys   Mon Oct 23 04:55:32 2006
msahci.sys   Thu Nov 02 04:51:36 2006
crcdisk.sys  Thu Nov 02 04:52:27 2006
pcouffin.sys Tue Dec 05 09:39:53 2006
rimsptsk.sys Tue Jan 23 02:40:19 2007
rimmptsk.sys Sat Feb 24 00:42:21 2007
rixdptsk.sys Wed Mar 21 09:02:02 2007
lmimirr.sys  Tue Apr 10 18:32:11 2007
pstrip.sys   Tue May 08 05:51:01 2007
spldr.sys    Thu Jun 21 20:29:17 2007
btwavdt.sys  Thu Jul 12 19:04:57 2007
btwrchid.sys Thu Jul 12 19:06:31 2007
btwaudio.sys Tue Sep 04 15:38:00 2007
atksgt.sys   Fri Sep 14 08:13:09 2007
npf.sys      Tue Nov 06 15:09:15 2007
RaInfo.sys   Fri Jan 04 13:57:12 2008
RTKVHDA.sys  Tue Jan 15 06:18:36 2008

The reports that you have submitted reveal clues to the cause of your problem. They do not give a definitive answer. The more reports that we receive the more clues are made available improving our chances of finding a solution to your problem. You may have to experience several more BSODs until the final answer is discovered.

If overclocking restore normal settings

SFC /scannow
System Files - SFC Command

How to Find Drivers
search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- visit the web site of the manufacturer of the hardware/program to get the latest drivers (DON'T use Windows Update or the Update driver function of Device Manager).
- if there are difficulties in locating them, post back with questions and someone - will help you search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- - if there are difficulties in locating them, post back with questions and someone will try and help you locate the appropriate program.
- The most common drivers are listed on this page: http://www.carrona.org/dvrref.html
- - Driver manufacturer links are on this page: http://www.carrona.org/drvrdown.html
and here
http://www.edbott.com/weblog/the-vista-master-driver-list/
To remove any left over driver remnants, especially from graphics cards, use driver sweeper
www.guru3d.com/category/driversweeper/
You can also locate information about your driver using this information
http://www.sevenforums.com/tutorials/96442-device-manager-finding-unknown-devices.html

The normal procedure at this point would be to give a driver verifier test, I am trying to avoid that if possible.
YOu can take a memory test, just to be sure that its not memory. Bad memory can show up as driver problems.
http://www.geekstogo.com/forum/topic...ing-memtest86/

Try with a clean boot
How to troubleshoot a problem by performing a clean boot in Windows Vista or in Windows 7

Does this prevent the shut downs
Does this stop the high cpu usage.

If so follow the clean boot instructions
If not report back.

It came up driver again.
Take the driver verifier test

How to Find Drivers
search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- visit the web site of the manufacturer of the hardware/program to get the latest drivers (DON'T use Windows Update or the Update driver function of Device Manager).
- if there are difficulties in locating them, post back with questions and someone - will help you search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- - if there are difficulties in locating them, post back with questions and someone will try and help you locate the appropriate program.
- The most common drivers are listed on this page: http://www.carrona.org/dvrref.html
- - Driver manufacturer links are on this page: http://www.carrona.org/drvrdown.html
and here
http://www.edbott.com/weblog/the-vista-master-driver-list/
To remove any left over driver remnants, especially from graphics cards, use driver sweeper
www.guru3d.com/category/driversweeper/
You can also locate information about your driver using this information
http://www.sevenforums.com/tutorials/96442-device-manager-finding-unknown-devices.html

Driver Verifier Inst
Since the driver that crashed you has not been listed you should run driver verifier
Please run Verifier with these settings:
[quote]
Using Driver Verifier is an iffy proposition. Most times it'll crash and it'll tell you what the driver is. But sometimes it'll crash and won't tell you the driver. Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.
So, I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Windows 7 Startup Repair feature).
Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
NOTE: You can use Low Resource Simulation if you'd like. From my limited experimentation it makes the BSOD's come faster.
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.
Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out. If it doesn't crash for you, then let it run for at least 36 hours of continuous operation (an estimate on my part).
Reboot into Windows (after the crash) and turn off Driver Verifier by going back in and selecting "Delete existing settings" on the first page, then locate and zip up the memory dump file and upload it with your next post.
If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.
Enable the driver verifier
www.sevenforums.com/crash-lockup-debug-how/65331-using-driver-verifier-identify-issues-drivers.html

Happy New Year.
STOP 0x000000C5: DRIVER_CORRUPTED_EXPOOL Usual causes: Device driver, ?Memory




Not really much of a help. It appears to be drivers, but its not telling which one. The verifier is suppose to make the bad drivers cause BSODs then we can tell.

C5 indicates can also be memory, Take the memory test first, its easier
Download memtest86 and test RAM
www.sevenforums.com/tutorials/105647-ram-test-memtest86.html
Run for 8 passes
If passes try a good stick in each slot for 3 passes
If fails do the same for 8 passes.

Code:

 Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
 
Loading Dump File [C:\Users\richc46\AppData\Local\Temp\Temp1_Dump%20FIles[1].zip\Mini010311-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows Server 2008/Windows Vista Kernel Version 6002 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6002.18267.x86fre.vistasp2_gdr.100608-0458
Machine Name:
Kernel base = 0x84e01000 PsLoadedModuleList = 0x84f18c70
Debug session time: Mon Jan  3 12:39:20.645 2011 (GMT-5)
System Uptime: 0 days 2:34:29.550
Loading Kernel Symbols
...............................................................
................................................................
................................................................
......
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000007E, {c0000005, 84eee443, 8f357bb0, 8f3578ac}
Probably caused by : ntkrpamp.exe ( nt!ExFreePoolWithTag+43d )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 84eee443, The address that the exception occurred at
Arg3: 8f357bb0, Exception Record Address
Arg4: 8f3578ac, Context Record Address
Debugging Details:
------------------
 
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP: 
nt!ExFreePoolWithTag+43d
84eee443 0fb74ffa        movzx   ecx,word ptr [edi-6]
EXCEPTION_RECORD:  8f357bb0 -- (.exr 0xffffffff8f357bb0)
ExceptionAddress: 84eee443 (nt!ExFreePoolWithTag+0x0000043d)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 0000258a
Attempt to read from address 0000258a
CONTEXT:  8f3578ac -- (.cxr 0xffffffff8f3578ac)
eax=00000000 ebx=8c6c5a00 ecx=00000001 edx=00000000 esi=00002590 edi=00002590
eip=84eee443 esp=8f357c78 ebp=8f357cd0 iopl=0         nv up ei pl nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010206
nt!ExFreePoolWithTag+0x43d:
84eee443 0fb74ffa        movzx   ecx,word ptr [edi-6]     ds:0023:0000258a=????
Resetting default scope
CUSTOMER_CRASH_COUNT:  3
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  System
CURRENT_IRQL:  0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1:  00000000
EXCEPTION_PARAMETER2:  0000258a
READ_ADDRESS: GetPointerFromAddress: unable to read from 84f38868
Unable to read MiSystemVaType memory at 84f18420
 0000258a 
FOLLOWUP_IP: 
nt!ExFreePoolWithTag+43d
84eee443 0fb74ffa        movzx   ecx,word ptr [edi-6]
BUGCHECK_STR:  0x7E
LAST_CONTROL_TRANSFER:  from 8503319d to 84eee443
STACK_TEXT:  
8f357cd0 8503319d 00002590 00000000 00000000 nt!ExFreePoolWithTag+0x43d
8f357d00 84e5ec2b 00000000 00000000 00000000 nt!MiSegmentDelete+0xd3
8f357d50 84e5edae 87f9c508 00000000 ffffffff nt!MiProcessDereferenceList+0x33
8f357d7c 84fd6c42 00000000 d4183b42 00000000 nt!MiDereferenceSegmentThread+0xc1
8f357dc0 84e3ff4e 84e5eceb 00000000 00000000 nt!PspSystemThreadStartup+0x9d
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
 
SYMBOL_STACK_INDEX:  0
SYMBOL_NAME:  nt!ExFreePoolWithTag+43d
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: nt
IMAGE_NAME:  ntkrpamp.exe
DEBUG_FLR_IMAGE_TIMESTAMP:  4c0e557c
STACK_COMMAND:  .cxr 0xffffffff8f3578ac ; kb
FAILURE_BUCKET_ID:  0x7E_nt!ExFreePoolWithTag+43d
BUCKET_ID:  0x7E_nt!ExFreePoolWithTag+43d
Followup: MachineOwner
---------

It gives a lead Microsoft Driver as the cause. The cause is actually a subordinate driver. Still a driver problem