Windows 7: BSOD, likely related to memory corruption; SF Diag dump file attached

anyri · 13 Nov 2012

Hi all,

Thanks in advance for reading; any help is appreciated.

Experienced several BSODs during the past few weeks. A few separate "explanations" for the crash shown on the blue screens may suggest a memory problem:

"SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION"
"BAD_POOL_HEADER"
"IRQL_NOT_LESS_OR_EQUAL"

A dump file created using the SF Diagnostic Tool is attached.

Some additional information:

The computer contains two sticks of RAM, each DDRIII 1333 4GB SODIMM. If it helps, the text on the label of each stick includes "BEFMHGO-[other characters]).

Memtest86 was run with both sticks in the PC (i.e., neither was removed before running), and a single error was found, with the following characteristics:

Tst: 1
Pass: 0
Failing address: 000bc646698 - 3014.2MB
Good: bc646698
Bad: bc01ff00
Err-Bits: 00659998
Count: 1
Chan: (blank)

System Restore was attempted, but could not restore the computer to a previous instance. Windows Defender Offline was also run and also failed, providing the following error: "The program's service has stopped. You can start the service manually or restart your computer, which will start the service. / Error code: 0x800106ba". Also ran BlueScreenView, which identified ntoskrnl.exe as a potential issue, although we weren't able to follow this up.

I hope that at least some of the above is relevant. Any help is sincerely appreciated.

**koolkat77** · 14 Nov 2012

Welcome to SevenForums.

Recommendations:

Code:

MSC	"c:\program files\microsoft security client\msseces.exe" -hide -runkey	Public	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Start Menu\Programs\Norton Internet Security	Public:Start Menu\Programs\Norton Internet Security	Public

Note that you have Microsoft security essentials installed but keeping two antiviruses such as NIS (which is often a cause of BSOD-s itself) would cause conflicts. Please uninstall Norton and keep MSE while troubleshooting. You may however, install Norton back if we know it was not contributing in the crashes. (you’ll have to remove MSE though).

Drivers that need to be updated: / or reinstalled.

Method: Click on the Start

► Control Panel ► Programs ► Uninstall a program ► Uninstall everything related to; the particular programs mentioned below. Restart the system, delete remnants of its drivers/older drivers using Driver Fusion/Sweeper. Restart again if required.

Wacom HID Router Driver Source: Driver Reference Table

Code:

0: kd> lmvm wachidrouter
start             end                 module name
fffff880`049ab000 fffff880`049c0000   wachidrouter T (no symbols)           
    Loaded symbol image file: wachidrouter.sys
    Image path: \SystemRoot\system32\DRIVERS\wachidrouter.sys
    Image name: wachidrouter.sys
    Timestamp:        Tue Mar 20 01:27:08 2012 (4F67888C)
    CheckSum:         0001CEAC
    ImageSize:        00015000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 Source: Driver Reference Table

Code:

0: kd> lmvm NETwNs64
start             end                 module name
fffff880`058aa000 fffff880`06116000   NETwNs64 T (no symbols)           
    Loaded symbol image file: NETwNs64.sys
    Image path: \SystemRoot\system32\DRIVERS\NETwNs64.sys
    Image name: NETwNs64.sys
    Timestamp:        Wed Jan 05 01:29:41 2011 (4D237525)
    CheckSum:         00823E68
    ImageSize:        0086C000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Intel Storage drivers Source: Driver Reference Table

Code:

0: kd> lmvm iaStor
start             end                 module name
fffff880`01271000 fffff880`013c5000   iaStor   T (no symbols)           
    Loaded symbol image file: iaStor.sys
    Image path: \SystemRoot\system32\DRIVERS\iaStor.sys
    Image name: iaStor.sys
    Timestamp:        Thu Jan 13 07:50:12 2011 (4D2E5A54)
    CheckSum:         0007188C
    ImageSize:        00154000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Graphics card drivers also need to be updated:

Code:

0: kd> lmvm atikmdag
start             end                 module name
fffff880`04a05000 fffff880`05302000   atikmdag T (no symbols)           
    Loaded symbol image file: atikmdag.sys
    Image path: \SystemRoot\system32\DRIVERS\atikmdag.sys
    Image name: atikmdag.sys
    Timestamp:        Mon Feb 07 00:31:45 2011 (4D4EE911)
    CheckSum:         008B4A84
    ImageSize:        008FD000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Source: Download AMD Catalyst Drivers 12.10 Vista 64 - FileHippo.com
(Avoice CCC - Catalyst Control Center during installation.)

Run the System File Checker that scans the of all protected Windows 7 system files and replaces incorrect corrupted, changed/modified, or damaged versions with the correct versions if possible:

SFC /SCANNOW Command - System File Checker

Run Disk Check on your hard disk for file system errors and bad sectors on it:

Disk Check

Free up the start-up, nothing except the antivirus is usually needed.

Check for a newer BIOS version:

Code:

BIOS Version/Date	Hewlett-Packard 68SCF Ver. F.08, 26/08/2011

Let us know how it went.

anyri · 14 Nov 2012

Hi,

Sincere thanks for the quick reply and detailed recommendations.

Before we apply these, however, just a few clarifying questions:

1. The recommendations suggest that we should (1) run driver-updating software EasyDriverPro,and then (2) completely delete a selection of drivers, including drivers from Wacom and Intel. Out of both curiosity and a concern that this is indeed the right course of action, could you please explain briefly why these particular drivers should be deleted? The Intel drivers, in particular, have datestamps in 2011; why not attempt to update these instead?

2. As noted in the original post, during the crashes and subsequent tests we witnessed a few indications that the BSODs might be memory related (e.g., the error "SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION"). This was not addressed in the reply to our post; the recommendations are mainly driver-related. Is this to say that memory appears not to be the issue causing the BSODs?

Again, the help is appreciated. Thank you.

**koolkat77** · 14 Nov 2012

By deleting them it would be installed "afresh" from the source links provided. I would not recommend driver updating software but search in google or the driver reference links that are posted here.

Quote:

STOP 0x000000C1: SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION
Usual causes: Device driver, ?Memory

Yes, you can test the RAM later if you have time of course.
Take memtest. Run for 8 passes and test each stick in a know good slot for an additional 6 passes.

Quote:

The goal is to test all the RAM sticks and all the motherboard slots.

Check your motherboard manual to ensure the RAM sticks are in the recommended motherboard slots. Some motherboards have very specific slots required for the number of RAM sticks installed.

If you get errors, stop the test and continue with the next step.

1. Remove all but one stick of RAM from your computer (this will be RAM stick #1), and run Memtest86 again, for 7 passes.
Be sure to note the RAM stick, use a piece of tape with a number, and note the motherboard slot.
If this stick passes the test then go to step #3.

2. If RAM stick #1 has errors, repeat the test with RAM stick #2 in the same motherboard slot.
If RAM stick #2 passes, this indicates that RAM stick #1 may be bad. If you want to be absolutely sure, re-test RAM stick #1 in another known good slot.
If RAM stick #2 has errors, this indicates another possible bad RAM stick, a possible motherboard slot failure or inadequate settings.
3. Test the next stick of RAM (stick #2) in the next motherboard slot.
If this RAM stick has errors repeat step #2 using a known good stick if possible, or another stick.
If this RAM stick has no errors and both sticks failed in slot#1, test RAM stick #1 in this slot.
4. If you find a stick that passes the test, test it in all the other motherboard slots.

If Part 2 testing shows errors, and all tests in Part 3 show errors, you will need to test the RAM sticks in another computer and/or test other RAM in your computer to identify the problem.

In this way, you can identify whether it is a bad stick of RAM, a bad motherboard, or incompatibility between the sticks.

anyri · 18 Nov 2012

Hi,

We've completed all steps in the first set of recommendations (driver-related), but have not tested the memory yet. Yesterday, after completing the steps, we experienced another BSOD. Several files are attached that might help to diagnose the problem, including an archive containing the SF Diagnostic Tool files.

If someone could take a quick look and point out anything of interest, this would be sincerely appreciated. Thanks again for all help provided to this point.

**koolkat77** · 18 Nov 2012

Was the Norton antivirus uninstalled?

The latest dumps bugcheck came with MEMORY_MANAGEMENT (1a), so at this point I'd suggest taking memory test as posted above.

anyri · 03 Dec 2012

Want to thank you for all of your help. We recently installed new memory, and the problem seems to have been solved. Thanks again!!

**koolkat77** · 03 Dec 2012

Great

Mark this thread as solved after few days of observing.

Good luck~

**koolkat77** · 12 Dec 2012

Hi..So any BSOD-s? If not

:

Quote:

If your problem is solved please use the Mark this thread as solved link at the top of your thread or down on the left corner

Windows 7: BSOD, likely related to memory corruption; SF Diag dump file attached

BSOD, likely related to memory corruption; SF Diag dump file attached problems?