Windows 7: BSOD Regularly

1117248 · 28 Aug 2010

Hello Community Members,

I have just reinstalled Windows 7 hoping to correct the issues I place below. Unfortunately this does not seem to have corrected the error. Please note I have updated all drivers, it is a genuine copy of windows, and it is a new computer.

8/29/2010 12:54:33 PM MEMORY_MANAGEMENT 0x0000001a 00000000`00041790 fffffa80`0121b1e0 00000000`0000ffff 00000000`00000000 ntoskrnl.exe ntoskrnl.exe+70740 NT Kernel & System Microsoft® Windows® Operating System

8/29/2010 12:52:29 PM SYSTEM_SERVICE_EXCEPTION 0x0000003b 00000000`c0000005 fffff800`02ce82b7 fffff880`08ba4a40 00000000`00000000 ntoskrnl.exe ntoskrnl.exe+70740 NT Kernel & System Microsoft® Windows® Operating System

8/29/2010 12:47:44 PM MEMORY_MANAGEMENT 0x0000001a 00000000`00041790 fffffa80`00c87090 00000000`0000ffff 00000000`00000000 ntoskrnl.exe ntoskrnl.exe+70740 NT Kernel & System Microsoft® Windows® Operating System

8/29/2010 12:45:49 PM MEMORY_MANAGEMENT 0x0000001a 00000000`00041284 00000000`038bd001 00000000`00001192 fffff700`01080000 ntoskrnl.exe ntoskrnl.exe+70740 NT Kernel & System Microsoft® Windows® Operating System

Any assistance or suggestions would be greatly appreciated.

Cheers, Simon

CarlTR6 · 28 Aug 2010

Please read these threads and post back. We will be glad to help you.

[1 - Novice] How to ask for help with a BSOD problem

http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html

1117248 · 28 Aug 2010

Quote: Originally Posted by CarlTR6

Please read these threads and post back. We will be glad to help you.

[1 - Novice] How to ask for help with a BSOD problem

http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html

My apologies I was unaware of how to post correctly. See the attached file.

CarlTR6 · 28 Aug 2010

That is no problem. I will take a look and be right back.

1117248 · 28 Aug 2010

Quote: Originally Posted by CarlTR6

That is no problem. I will take a look and be right back. Refresh your screen in about 10 minutes. I will edit this post

Please note I am fail with computers and don't understand alot of the technical terms. If you could provide some explanation so that I can learn I would appreciate that also.

CarlTR6 · 28 Aug 2010

No dump files were included. Try this:

http://www.sevenforums.com/tutorials...en-forums.html

Quote:

Please note I am fail with computers and don't understand alot of the technical terms. If you could provide some explanation so that I can learn I would appreciate that also.

I will definitely try to do that.

1117248 · 28 Aug 2010

Quote: Originally Posted by CarlTR6

No dump files were included. Try this:

http://www.sevenforums.com/tutorials...en-forums.html

Quote:

Please note I am fail with computers and don't understand alot of the technical terms. If you could provide some explanation so that I can learn I would appreciate that also.

I will definitely try to do that.

See attached.

Thanks for your speedy replies!

CarlTR6 · 28 Aug 2010

You are welcome. I will take a look now. Your latest dump shows error code 3B; the remaining three all show error code 1A.

3B, SYSTEM_SERVICE_EXCEPTION - usually caused by System service, Device driver, graphics driver, ?memory

Error code 1A, MEMORY_MANAGEMENT - usually caused by Device driver, memory, kernel

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\Downloads\dumps\082910-26504-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c49000 PsLoadedModuleList = 0xfffff800`02e86e50
Debug session time: Sat Aug 28 22:48:14.980 2010 (GMT-4)
System Uptime: 0 days 0:00:53.057
Loading Kernel Symbols
...............................................................
................................................................
..............
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80002ce82b7, fffff88008ba4a40, 0}

Probably caused by : memory_corruption ( nt!MmCopyToCachedPage+227 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002ce82b7, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff88008ba4a40, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!MmCopyToCachedPage+227
fffff800`02ce82b7 8b7838          mov     edi,dword ptr [rax+38h]

CONTEXT:  fffff88008ba4a40 -- (.cxr 0xfffff88008ba4a40)
rax=0000000000122a39 rbx=0000000000000000 rcx=0000000fffffffff
rdx=fffff80002c49000 rsi=ffffffffffffffff rdi=fffffa800751df50
rip=fffff80002ce82b7 rsp=fffff88008ba5410 rbp=fffff88008ba5480
 r8=0000098000000000  r9=00000000016f3040 r10=0000058000000000
r11=0000000000000002 r12=fffff6fcc0042298 r13=0000000000000000
r14=0000000000001000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
nt!MmCopyToCachedPage+0x227:
fffff800`02ce82b7 8b7838          mov     edi,dword ptr [rax+38h] ds:002b:00000000`00122a71=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  WerFault.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff80002ce82b7

STACK_TEXT:  
fffff880`08ba5410 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmCopyToCachedPage+0x227


FOLLOWUP_IP: 
nt!MmCopyToCachedPage+227
fffff800`02ce82b7 8b7838          mov     edi,dword ptr [rax+38h]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!MmCopyToCachedPage+227

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

STACK_COMMAND:  .cxr 0xfffff88008ba4a40 ; kb

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x3B_nt!MmCopyToCachedPage+227

BUCKET_ID:  X64_0x3B_nt!MmCopyToCachedPage+227

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\Downloads\dumps\082910-21512-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c0d000 PsLoadedModuleList = 0xfffff800`02e4ae50
Debug session time: Sat Aug 28 22:46:34.488 2010 (GMT-4)
System Uptime: 0 days 0:01:07.454
Loading Kernel Symbols
...............................................................
................................................................
..............
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa8000c87090, ffff, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33906 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, The subtype of the bugcheck.
Arg2: fffffa8000c87090
Arg3: 000000000000ffff
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41790

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  MsMpEng.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002cf0f9e to fffff80002c7d740

STACK_TEXT:  
fffff880`08074968 fffff800`02cf0f9e : 00000000`0000001a 00000000`00041790 fffffa80`00c87090 00000000`0000ffff : nt!KeBugCheckEx
fffff880`08074970 fffff800`02cbf0da : 00000000`00000000 00000000`12680fff fffffa80`00000000 fffffa80`06b84320 : nt! ?? ::FNODOBFM::`string'+0x33906
fffff880`08074b30 fffff800`02c7c993 : ffffffff`ffffffff 00000000`0994e8c0 00000000`0994e888 fffffa80`00008000 : nt!NtFreeVirtualMemory+0x5ca
fffff880`08074c20 00000000`777dff3a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0994e7f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x777dff3a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+33906
fffff800`02cf0f9e cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+33906

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

FAILURE_BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+33906

BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+33906

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\Downloads\dumps\082910-21309-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c63000 PsLoadedModuleList = 0xfffff800`02ea0e50
Debug session time: Sat Aug 28 22:44:20.285 2010 (GMT-4)
System Uptime: 0 days 0:00:29.251
Loading Kernel Symbols
...............................................................
................................................................
..........
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41284, 38bd001, 1192, fffff70001080000}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4a83 )

Followup: MachineOwner
---------

6: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041284, A PTE or the working set list is corrupt.
Arg2: 00000000038bd001
Arg3: 0000000000001192
Arg4: fffff70001080000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41284

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  hamachi-2.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002d283b3 to fffff80002cd3740

STACK_TEXT:  
fffff880`0471a218 fffff800`02d283b3 : 00000000`0000001a 00000000`00041284 00000000`038bd001 00000000`00001192 : nt!KeBugCheckEx
fffff880`0471a220 fffff800`02d06379 : fffffa80`063473f8 ffffffff`ffffffff fffffa80`070dd060 ffffffff`ffffffff : nt! ?? ::FNODOBFM::`string'+0x4a83
fffff880`0471a260 fffff800`02d19b2b : 99200001`1be3d867 fffff680`0001c5e8 ffffffff`ffffffff 000fffff`ffffffff : nt!MiTerminateWsle+0x29
fffff880`0471a2a0 fffff800`02d14dee : 00000000`00000002 fffff880`00000000 fffffa80`06347060 fffffa80`063473f8 : nt!MiDecommitPages+0x20b
fffff880`0471ab30 fffff800`02cd2993 : ffffffff`ffffffff 00000000`02a5b5f8 00000000`02a5b5f0 00000000`00000001 : nt!NtFreeVirtualMemory+0x2de
fffff880`0471ac20 00000000`7743ff3a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`02a5b578 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7743ff3a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+4a83
fffff800`02d283b3 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+4a83

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

FAILURE_BUCKET_ID:  X64_0x1a_41284_nt!_??_::FNODOBFM::_string_+4a83

BUCKET_ID:  X64_0x1a_41284_nt!_??_::FNODOBFM::_string_+4a83

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\Downloads\dumps\082910-21231-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c18000 PsLoadedModuleList = 0xfffff800`02e55e50
Debug session time: Sat Aug 28 22:52:37.305 2010 (GMT-4)
System Uptime: 0 days 0:00:35.271
Loading Kernel Symbols
...............................................................
................................................................
.....
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa800121b1e0, ffff, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33906 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, The subtype of the bugcheck.
Arg2: fffffa800121b1e0
Arg3: 000000000000ffff
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41790

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  MsMpEng.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002cfbf9e to fffff80002c88740

STACK_TEXT:  
fffff880`03837968 fffff800`02cfbf9e : 00000000`0000001a 00000000`00041790 fffffa80`0121b1e0 00000000`0000ffff : nt!KeBugCheckEx
fffff880`03837970 fffff800`02cca0da : 00000000`00000000 00000000`0a8cffff fffffa80`00000000 fffffa80`06c8bb30 : nt! ?? ::FNODOBFM::`string'+0x33906
fffff880`03837b30 fffff800`02c87993 : ffffffff`ffffffff 00000000`0984ef78 00000000`0984ef70 fffffa80`00008000 : nt!NtFreeVirtualMemory+0x5ca
fffff880`03837c20 00000000`7748ff3a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0984ef38 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7748ff3a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+33906
fffff800`02cfbf9e cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+33906

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

FAILURE_BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+33906

BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+33906

Followup: MachineOwner
---------

These dumps did not give us a specific cause. One of the dumps did show 0xc0000005 which indicated corrupt memory. The dumps blamed various drivers/programs such as ntoskrnl.exe. This is a Microsoft core system program and is very unlikely to be the cause. When WinDebug cannot pinpot the cause, it often blames a Windows core system file.

Something is corrupting your memory and we will try to find out what. It could be bad RAM, faulty drivers, incompatible software or hardware, etc.

Let's start with testing your RAM with Memtest 86+.

RAM - Test with Memtest86+

Any errors will show up on your screen in red. Post back with the results.

Out of date drivers can cause problems with Win 7. The can and do corrupt memory and cause crashes. One of your drivers is slightly out of date and was blamed in one of the dumps as as the cause of the crash:

hamachi.sys Thu Feb 19 05:36:41 2009 - Hamachi Virtual Network Interface Driver is a driver file from company LogMeIn, Inc. belonging to product Hamachi Virtual Network Interface Driver. Update this driver or update the software (or both).

After you have updated this driver, reboot and run your system. Let's see how it does. Upload any new BSOD dump files to us and we will go from there.

1117248 · 28 Aug 2010

Okay, can I do the memtest86+ from a usb? nvm - don't answer this.

1117248 · 28 Aug 2010

Quote: Originally Posted by 1117248

Okay, can I do the memtest86+ from a usb? nvm - don't answer this.

How long does this process take? Should I start it now? Or wait and try other things first?

Windows 7: BSOD Regularly

BSOD Regularly problems?