Windows 7: Need help in diagnosing

wigwam · 02 Mar 2010

got a customer with a

ASUS P5KPL_CM; Bios Version 0608.

Getting ram related bsod's i think but memtest checks out fine

4GB ram 2 x 2GB sticks

attached are the minidumps

any one who can help in narrowing it down will be a legend in my eyes!

Jonathan_King · 02 Mar 2010

It does look like a memory issue to me.

How many passes did you run Memtest86? Be sure to run it for at least 5 passes.

You may also want to do a system files check. Open an elevated command prompt, and run sfc /scannow.

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Jonathan\Desktop\030110-31668-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02a1f000 PsLoadedModuleList = 0xfffff800`02c5ce50
Debug session time: Mon Mar  1 09:26:46.368 2010 (GMT-5)
System Uptime: 0 days 20:21:56.991
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa80011ffee0, ffff, 0}

Probably caused by : win32k.sys ( win32k!SURFACE::bDeleteSurface+3c8 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, The subtype of the bugcheck.
Arg2: fffffa80011ffee0
Arg3: 000000000000ffff
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41790

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  OUTLOOK.EXE

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002b0326e to fffff80002a90f00

STACK_TEXT:  
fffff880`04715618 fffff800`02b0326e : 00000000`0000001a 00000000`00041790 fffffa80`011ffee0 00000000`0000ffff : nt!KeBugCheckEx
fffff880`04715620 fffff800`02ad2c4a : 00000000`00000000 00000000`0ddc4fff fffffa80`00000000 fffffa80`06ca8b30 : nt! ?? ::FNODOBFM::`string'+0x339d6
fffff880`047157e0 fffff800`02a90153 : ffffffff`ffffffff fffff880`04715aa0 fffff880`04715b08 00000000`00008000 : nt!NtFreeVirtualMemory+0x5ca
fffff880`047158d0 fffff800`02a8c6f0 : fffff960`001850f0 00000000`00000001 fffff900`c00bf010 fffff900`c0682010 : nt!KiSystemServiceCopyEnd+0x13
fffff880`04715a68 fffff960`001850f0 : 00000000`00000001 fffff900`c00bf010 fffff900`c0682010 00000000`00000000 : nt!KiServiceLinkage
fffff880`04715a70 fffff960`0018544c : ffffffff`00000000 fffff880`00000000 fffff900`c0682010 fffff900`00000000 : win32k!SURFACE::bDeleteSurface+0x3c8
fffff880`04715bc0 fffff960`0014661d : ffffffff`fe0515e7 fffff900`c0682010 00000000`000015e7 00000000`7efdb000 : win32k!bDeleteSurface+0x34
fffff880`04715bf0 fffff800`02a90153 : fffffa80`05928b60 fffff880`04715ca0 00000000`05db0820 00000000`00008000 : win32k!NtGdiDeleteObjectApp+0xd5
fffff880`04715c20 00000000`73c82dd9 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0009e538 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x73c82dd9


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!SURFACE::bDeleteSurface+3c8
fffff960`001850f0 e9b0010000      jmp     win32k!SURFACE::bDeleteSurface+0x57d (fffff960`001852a5)

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  win32k!SURFACE::bDeleteSurface+3c8

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc5e0

FAILURE_BUCKET_ID:  X64_0x1a_41790_win32k!SURFACE::bDeleteSurface+3c8

BUCKET_ID:  X64_0x1a_41790_win32k!SURFACE::bDeleteSurface+3c8

Followup: MachineOwner
---------

wigwam · 02 Mar 2010

check screen shot

Jonathan_King · 02 Mar 2010

Try testing each stick of RAM individually, and boot up Windows to see if it still crashes with only 1 stick.

zigzag3143 · 02 Mar 2010

My colleague Johnathan_King is correct. It is memory corruption and his sugesstion of using one stick valid. My only thought would be to not run the standard test but the comprehensive one

Ken

ickymay · 02 Mar 2010

I agree with Jking on first impressions it does look like ram and the minidumps don't offer much help .....

I did see this driver is old and needs updating

Quote:

AsIO.sys fffff880`03fb4000 fffff880`03fbb000 0x00007000 0x47663d55 17/12/2007 09:11:49

google search suggests "This file appears to be used by the Asus "PC Probe" for Asus motherboards" , maybe Uninstall the probe which has been known to cause bluescreens ?

regards testing ram ,to quote since windows 95 Microsoft have stated about memory testing programs

Quote:

Defective memory chips may not be detected by memory checking tools. Some memory checking programs are not adequate tests because they do not test RAM in the same way that Windows uses RAM. Most memory checkers use read/write cycles when scanning memory. Since Windows is executing code from memory, it uses execute cycles. Execute cycles are different from read/write cycles and are more vulnerable to parity errors. It is possible for memory checking programs to find parity errors if the memory is extremely faulty.

To test memory I get consistent results by burning to CD (using an ISO burner) & running from boot memtest86+ for at least 5 passes and moving the sticks between slots to verify motherboard ram slots work as well as the ram sticks.

you might also need to run version 4.0 if your testing 4gig and above ?

maybe running driver verifier might be another step to take ?

wigwam · 08 Mar 2010

some new info from the customer:

System crashed again @22:27 07/03/10 – dump attached.
Stop error this time was 0x0000001E.
At this point it had been running for 2 days 16 hours with no problems.
I hadn’t used the machine since earlier in the day but programs were left running – Outlook, Firefox and Excel (can’t remember if anything else was open).
A Windows Backup ran at 19:00.

Checked BIOS when I rebooted and CPU temp 42⁰C MB 33⁰C ; Unfortunately it had been sitting on the BSOD for 1 ½ hours before I spotted it ( as per recommendations I stopped it automatically restarting) and I believe that the fans don’t start effectively until the machine restarts properly (I might be wrong).
It then ran a chkdsk on drive C – AFAICS there were no errors.
A windows unexpected shutdown message appeared after logon but Surprise, Surprise it couldn’t find a solution. (I’ve attached the text in the 2cnd zip file).

I ran a chkdsk on C after boot and there were no errors.
I installed speedfan 4 and obtained the following:-
GPU 43⁰C
System 32⁰C
CPU 24⁰C
Aux -64
HDO 27⁰C
Core 0 – Core 3 temps were fluctuating 46-50⁰C
I then ran a system restore to remove speedfan 4; (I’d set a restore point before install).
I don’t like it and I’m not sure it works correctly with my chipset and 7 64 bit.
At least with ASUS Probe II I know it is produced by my board manufacturer and is compatible with my chipset and win 7 64 bit.
I haven’t reinstalled it at this point.

Rebooted checked BIOS temps again CPU 36.5⁰C MB 31⁰C.
Checked event log and found userpnp messages and Ntfs errors all around 1900; I’ve put the text of these in the 2cnd zip; however this was 3 ½ hours before the shutdown.

Jonathan_King · 08 Mar 2010

Sorry, I guess you forgot to attach the zip folder.

wigwam · 09 Mar 2010

Just sorting the zips attached

im thinking it's motherboard at the moment.

Jonathan_King · 09 Mar 2010

It still looks a whole lot like bad RAM to me.

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Jonathan\Desktop\030910-54943-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02a5d000 PsLoadedModuleList = 0xfffff800`02c9ae50
Debug session time: Mon Mar  8 19:03:39.594 2010 (GMT-5)
System Uptime: 0 days 22:18:44.607
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff88006cb7468, fffff88006cb6cc0, fffff88001233e71}

Probably caused by : Ntfs.sys ( Ntfs!NtfsTeardownFromLcb+f1 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff88006cb7468
Arg3: fffff88006cb6cc0
Arg4: fffff88001233e71

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff88006cb7468 -- (.exr 0xfffff88006cb7468)
ExceptionAddress: fffff88001233e71 (Ntfs!NtfsTeardownFromLcb+0x00000000000000f1)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff88006cb6cc0 -- (.cxr 0xfffff88006cb6cc0)
rax=000000000000fffb rbx=fffff8a00e8cb5c0 rcx=0000000000000000
rdx=fffffa8003fb47f0 rsi=fffff88006cb7701 rdi=fffff8a015b504d0
rip=fffff88001233e71 rsp=fffff88006cb76a0 rbp=fffff88006cb7a80
 r8=0000000000000000  r9=0000000000000000 r10=fffff80002a5d000
r11=fffff88006cb7670 r12=fffff8a00e8cb5c0 r13=fffdf8a00a06e7c0
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
Ntfs!NtfsTeardownFromLcb+0xf1:
fffff880`01233e71 498b4d30        mov     rcx,qword ptr [r13+30h] ds:002b:fffdf8a0`0a06e7f0=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  VSSVC.exe

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002d050e0
 ffffffffffffffff 

FOLLOWUP_IP: 
Ntfs!NtfsTeardownFromLcb+f1
fffff880`01233e71 498b4d30        mov     rcx,qword ptr [r13+30h]

FAULTING_IP: 
Ntfs!NtfsTeardownFromLcb+f1
fffff880`01233e71 498b4d30        mov     rcx,qword ptr [r13+30h]

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from fffff880012be400 to fffff88001233e71

STACK_TEXT:  
fffff880`06cb76a0 fffff880`012be400 : fffffa80`03dbc010 fffffa80`04733180 fffff8a0`0e8cb5c0 fffff8a0`15b504d0 : Ntfs!NtfsTeardownFromLcb+0xf1
fffff880`06cb7730 fffff880`012a5c50 : fffffa80`03dbc010 00000000`00000000 00000000`00000001 fffffa80`03dbc000 : Ntfs!NtfsTeardownStructures+0x200
fffff880`06cb77b0 fffff880`012f6bbd : fffffa80`03dbc010 fffffa80`04733180 00000000`00000001 0000000f`ffffff00 : Ntfs!NtfsFlushVolume+0x530
fffff880`06cb78e0 fffff880`012f75f0 : fffffa80`03dbc010 fffffa80`08b2b010 fffffa80`0482a5d0 00000000`00000000 : Ntfs!NtfsCommonFlushBuffers+0x459
fffff880`06cb79c0 fffff880`0107823f : fffffa80`08b2b3b0 fffffa80`08b2b010 fffffa80`03dbc010 fffff880`06cb79e8 : Ntfs!NtfsFsdFlushBuffers+0x104
fffff880`06cb7a30 fffff880`010766df : fffffa80`047633e0 00000000`00000000 fffffa80`04763300 fffffa80`08b2b010 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`06cb7ac0 fffff800`02de2929 : 00000000`00000002 fffffa80`0482a5d0 00000000`00000000 fffffa80`08b2b010 : fltmgr!FltpDispatch+0xcf
fffff880`06cb7b20 fffff800`02d708ad : fffffa80`08b2b010 fffffa80`03fb47f0 fffffa80`0482a5d0 fffff880`02fd3180 : nt!IopSynchronousServiceTail+0xf9
fffff880`06cb7b90 fffff800`02ace153 : fffffa80`03fb47f0 00000000`ff712270 fffffa80`047633e0 fffffa80`0482a5d0 : nt!NtFlushBuffersFile+0x171
fffff880`06cb7c20 00000000`777c036a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`02e3f778 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x777c036a


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  Ntfs!NtfsTeardownFromLcb+f1

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc14f

STACK_COMMAND:  .cxr 0xfffff88006cb6cc0 ; kb

FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsTeardownFromLcb+f1

BUCKET_ID:  X64_0x24_Ntfs!NtfsTeardownFromLcb+f1

Followup: MachineOwner
---------

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Jonathan\Desktop\030810-46035-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02a0d000 PsLoadedModuleList = 0xfffff800`02c4ae50
Debug session time: Sun Mar  7 17:27:58.002 2010 (GMT-5)
System Uptime: 2 days 15:56:53.015
Loading Kernel Symbols
...............................................................
................................................................
..............................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff80002d63d9c, 0, ffffffffffffffff}

Probably caused by : memory_corruption ( nt!MiApplyCompressedFixups+40 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002d63d9c, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!MiApplyCompressedFixups+40
fffff800`02d63d9c 0fb603          movzx   eax,byte ptr [rbx]

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cb50e0
 ffffffffffffffff 

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x1E

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002abea17 to fffff80002a7ef00

STACK_TEXT:  
fffff880`084e4758 fffff800`02abea17 : 00000000`0000001e ffffffff`c0000005 fffff800`02d63d9c 00000000`00000000 : nt!KeBugCheckEx
fffff880`084e4760 fffff800`02a7e542 : fffff880`084e4f38 ffbff8a0`08fc9260 fffff880`084e4fe0 ffffffff`fec90000 : nt! ?? ::FNODOBFM::`string'+0x460da
fffff880`084e4e00 fffff800`02a7ce4a : 00000000`00000000 fffff8a0`08fc9000 fffffa80`00000000 00001f80`010111d0 : nt!KiExceptionDispatch+0xc2
fffff880`084e4fe0 fffff800`02d63d9c : fffffa80`065307b0 fffff8a0`08f87000 fffff8a0`08f87000 ffffffff`fec90000 : nt!KiGeneralProtectionFault+0x10a
fffff880`084e5170 fffff800`02d63c15 : fffff880`021c4000 ffffffff`fec90000 00000000`00161000 fffffa80`00a855e0 : nt!MiApplyCompressedFixups+0x40
fffff880`084e51c0 fffff800`02d5117c : 00000000`00000000 00000000`00000000 fffff6fc`40070e78 fffff800`00000000 : nt!MiPerformFixups+0x65
fffff880`084e5210 fffff800`02a60eed : 00000000`000381ca 00000000`00000161 fffff8a0`08f87b50 00000000`00000002 : nt!MiRelocateImagePfn+0x114
fffff880`084e5270 fffff800`02d63b71 : fffffa80`03df9490 fffff6fc`40070e78 fffff8a0`00000002 00000000`00000000 : nt!MiValidateImagePages+0x2bd
fffff880`084e5310 fffff800`02d63280 : ffffffff`ffffffff 00000000`00000001 fffff8a0`08fc2000 00000000`0000008f : nt!MiSwitchBaseAddress+0x61
fffff880`084e5340 fffff800`02d770ae : 00000000`00000004 00000000`01000000 00000000`00000000 00000000`00000000 : nt!MiRelocateImageAgain+0x100
fffff880`084e5390 fffff800`02d6c893 : fffff880`084e55f0 00000000`00000000 fffff880`084e5698 fffff880`084e55e8 : nt!MmCreateSection+0x302
fffff880`084e55a0 fffff800`02edb573 : 00000000`00000000 fffff8a0`0caba1e8 00000000`00000000 00000000`00000001 : nt!NtCreateSection+0x162
fffff880`084e5620 fffff800`02edbb01 : 00000000`00000000 fffff8a0`0caba1e8 fffffa80`0715b410 fffff880`00000060 : nt!PfpFileBuildReadSupport+0x163
fffff880`084e5710 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!PfpPrefetchFilesTrickle+0x121


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiApplyCompressedFixups+40
fffff800`02d63d9c 0fb603          movzx   eax,byte ptr [rbx]

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  nt!MiApplyCompressedFixups+40

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x1E_nt!MiApplyCompressedFixups+40

BUCKET_ID:  X64_0x1E_nt!MiApplyCompressedFixups+40

Followup: MachineOwner
---------

Windows 7: Need help in diagnosing

Need help in diagnosing problems?