Crash dump

EasyPC · Jan 20, 2010

Hi,

I installed Windows 7 about 3-4 weeks ago and it's been crashing almost every day ever since. I analyzed memory dumps with WHOCRASHED and checked all symptoms through google and did everything that was suggested to other users with the same or similar symptoms, but nothing helped. I updated bios, changed to default settings, updated all drivers, checked memory with Windows Memory Diagnostic (it ran for over 24 hours), changed the power supply and even formatted the drive and installed a fresh copy of windows yesterday and still no change.

I'm guessing it has to be hardware (Motherboard, RAM (diagnostic test has passed ok?) or CPU). Everything except CPU is new, I got used CPU at very cool price, but now I'm thinking it might have been overclocked.

All minidumps are inside the attachment. I think that since nearly everthing has been tried, the short versions wouldn't help much so if anyone knows how to interpret those minidumps, please check them and let me know any possible suspicion.

Quick system specs:

Motherboard: Gigabyte G41M-ES2l (integrated VGA, LAN, SOUND)
CPU: Intel Core 2 Duo E6320
RAM: PatriotDDR2, 2GB PC2-6400 800MHZ
HDD: WD5000AACS (500 GB, 16 MB Cache, SATA)
DVD-RW: NEC, some old model
PSU: Lc Power 500 W
OS: Windows 7 Ultimate 6.1 (Build 7600) + all windows updates

Thanks

Pauly · Jan 20, 2010

Having a look at the text now but you should post the actual dump file incase we need to dig a bit deeper

They are quite varied but the obvious is ram i would recommend downloading memtest86 to perform thorough testing of the ram, download>burn to disk>boot from it
Recommend letting run for at least 5 passes or overnight

You can also run a system files scan to check for corruption
Start>cmd.exe>right click run as admin>sfc /scannow

EasyPC · Jan 20, 2010

Here they are...

And here is the result of the system scan:

C:\Windows\system32>sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.

C:\Windows\system32>

I'll leave the memory test running over night and post the results tomorrow.

Thx

Pauly · Jan 20, 2010

If you get any ram errors try one stick at a time or any sfc errors that dont get repaired automatically post back the log

zigzag3143 · Jan 20, 2010

EasyPC said:
Here they are...

And here is the result of the system scan:

C:\Windows\system32>sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.

C:\Windows\system32>

I'll leave the memory test running over night and post the results tomorrow.

Thx

hi and welcome

most recent dmp from installation 2. Cause Memory corruption

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\012010-20514-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*d:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02804000 PsLoadedModuleList = 0xfffff800`02a41e50
Debug session time: Wed Jan 20 16:44:06.475 2010 (GMT-5)
System Uptime: 1 days 5:01:28.400
Loading Kernel Symbols
...............................................................
................................................................
................
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, 724b, 2, 716be}

Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 000000000000724b, page frame number
Arg3: 0000000000000002, current page state
Arg4: 00000000000716be, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_99

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  firefox.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff8000290432c to fffff80002875f00

STACK_TEXT:  
fffff880`031166f8 fffff800`0290432c : 00000000`0000004e 00000000`00000099 00000000`0000724b 00000000`00000002 : nt!KeBugCheckEx
fffff880`03116700 fffff800`028244fd : ffffffff`ffffffff 00000000`00000001 ffffffff`ffffffff fffff800`73576d4d : nt!MiBadShareCount+0x4c
fffff880`03116740 fffff800`02889d9e : fffffa80`025d6938 fffff880`03116990 00000000`00000000 00000000`00000012 : nt! ?? ::FNODOBFM::`string'+0x20483
fffff880`03116930 fffff800`028f6a0e : fffffa80`025d6938 fffff880`00000001 00000000`00000001 fffff880`03116bb0 : nt!MiAgeWorkingSet+0x47e
fffff880`03116ae0 fffff800`0288a6e2 : 00000000`00009829 00000000`00000000 fffffa80`00000000 00000000`00000002 : nt! ?? ::FNODOBFM::`string'+0x49926
fffff880`03116b80 fffff800`0288a96f : 00000000`00000008 fffff880`03116c10 00000000`00000001 fffffa80`00000000 : nt!MmWorkingSetManager+0x6e
fffff880`03116bd0 fffff800`02b19166 : fffffa80`01863550 00000000`00000080 fffffa80`01840890 00000000`00000001 : nt!KeBalanceSetManager+0x1c3
fffff880`03116d40 fffff800`02854486 : fffff800`029eee80 fffffa80`01863550 fffff800`029fcc40 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`03116d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiBadShareCount+4c
fffff800`0290432c cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiBadShareCount+4c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

Followup: MachineOwner
---------

EasyPC · Jan 21, 2010

Here are the results of memory test (no errors found):

EasyPC · Jan 22, 2010

Also, just before the last crash, while browsing with firefox, I remember that "no network" icon appeared in the taskbar and firefox stopped responding. I don't exactly know on what basis does this icon appear, but the computer was certainly not unplugged from the LAN (Netgear switch) and when I checked later, modem/router had been online for several days with no disconnection from ISP.

EasyPC · Jan 22, 2010

I launched Driver Verifier today and got this bsod immediately after the reboot:

Lebon14 · Jan 22, 2010

About the 0xC4 BSOD, check this thread out :
Solved: BSOD 0xC4 - Tech Support Guy Forums

Pauly · Jan 23, 2010

Have you found the driver causing the problem, if not post the verifier dump and we can have a look

EasyPC · Jan 23, 2010

This time I selected ALL BUT "LOW RESOURCES SIMULATION" and one of the drivers .sys (NOT ICSAK.SYS). The system rebooted successfully but soon after the reboot, I got BSOD about icsak.sys and even with another driver enabled it's the same, appears to be the cause, but I'm not sure if it's the only one. Icsak.sys points to Zone Alarm, which I have installed, but I didn't have it in my previous installation and I still got the same crash codes.

Problem is that verifier-induced crash haven't left any crash dump file behind.

ickymay · Jan 23, 2010

EasyPC said:
This time I selected ALL BUT "LOW RESOURCES SIMULATION" and one of the drivers .sys (NOT ICSAK.SYS). The system rebooted successfully but soon after the reboot, I got BSOD about icsak.sys and even with another driver enabled it's the same, appears to be the cause, but I'm not sure if it's the only one. Icsak.sys points to Zone Alarm, which I have installed, but I didn't have it in my previous installation and I still got the same crash codes.

Problem is that verifier-induced crash haven't left any crash dump file behind.

unninstall zone alarm and see if you still get the crash ?

best to try changing one thing at a time if possible

EasyPC · Jan 23, 2010

I uninstalled Zone Alarm and launched verifier on all drivers without a crash. However, with "LOW RESOURCES SIMULATION" I can't even log in, because I get the msg that there is not enough resources, so I went to safe mode and disabled verifier.

I'd also like to remind, that there wasn't zone alarm in the first installation and the crash dump codes were more or less the same as with the current installation.

Might not be the drivers after all... if that's the case, does it leave me any other option than to try changing CPU, RAM, RAM or MB and see what happens?

ickymay · Jan 23, 2010

EasyPC said:
I uninstalled Zone Alarm and launched verifier on all drivers without a crash. However, with "LOW RESOURCES SIMULATION" I can't even log in, because I get the msg that there is not enough resources, so I went to safe mode and disabled verifier.

I'd also like to remind, that there wasn't zone alarm in the first installation and the crash dump codes were more or less the same as with the current installation.

Might not be the drivers after all... if that's the case, does it leave me any other option than to try changing CPU, RAM, RAM or MB and see what happens?

it might be useful to see another minidump without zone alarm installed

Pauly · Jan 23, 2010

ickymay said:
EasyPC said:

I uninstalled Zone Alarm and launched verifier on all drivers without a crash. However, with "LOW RESOURCES SIMULATION" I can't even log in, because I get the msg that there is not enough resources, so I went to safe mode and disabled verifier.

I'd also like to remind, that there wasn't zone alarm in the first installation and the crash dump codes were more or less the same as with the current installation.

Might not be the drivers after all... if that's the case, does it leave me any other option than to try changing CPU, RAM, RAM or MB and see what happens?

Click to expand...

it might be useful to see another minidump without zone alarm installed

Agreed ^^^ post the dumps let us have a look

EasyPC · Jan 28, 2010

A new dump from recent crash:

ickymay · Jan 29, 2010

EasyPC said:
A new dump from recent crash:

this ones memory corruption and firefox.exe is involved but this can mean everything or nothing

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, 4b5f2, 2, 4bab1}

Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 000000000004b5f2, page frame number
Arg3: 0000000000000002, current page state
Arg4: 000000000004bab1, 0

Debugging Details:
------------------

BUGCHECK_STR: 0x4E_99

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: firefox.exe

CURRENT_IRQL: 2

LAST_CONTROL_TRANSFER: from fffff8000295632c to fffff800028c7f00

STACK_TEXT:
fffff880`0648ff88 fffff800`0295632c : 00000000`0000004e 00000000`00000099 00000000`0004b5f2 00000000`00000002 : nt!KeBugCheckEx
fffff880`0648ff90 fffff800`0287d545 : 00000000`00000000 fffff680`0039c818 00000000`00000002 00000000`00000001 : nt!MiBadShareCount+0x4c
fffff880`0648ffd0 fffff800`0289c493 : fffffa80`01f5a590 fffff700`000091d7 0000007f`fffffff8 fffff8a0`023a20e0 : nt! ?? ::FNODOBFM::`string'+0x322ac
fffff880`06490060 fffff800`0289aeee : fffffa80`01f5a590 fffffa80`00000008 fffff880`000078fc fffff800`00000005 : nt!MiDeleteAddressesInWorkingSet+0x307
fffff880`06490910 fffff800`02baa7af : fffff8a0`018f2060 fffff880`06490c20 00000000`00000000 fffffa80`0312c330 : nt!MmCleanProcessAddressSpace+0x96
fffff880`06490960 fffff800`02b84b3d : 00000000`000000ff 00000000`00000001 00000000`7efaa000 fffffa80`01987b60 : nt!PspExitThread+0x47f
fffff880`06490a30 fffff800`028a4a43 : 00000000`00000100 fffffa80`0312c3f0 00000000`00000001 fffff800`028cf25d : nt!PsExitSpecialApc+0x1d
fffff880`06490a60 fffff800`028a4e80 : 00000000`00000000 fffff880`06490ae0 fffff800`02b85710 00000000`00000001 : nt!KiDeliverApc+0x2eb
fffff880`06490ae0 fffff800`028c71f7 : fffffa80`0312c330 00000000`000001dc 00000000`00000000 fffffa80`019c9880 : nt!KiInitiateUserApc+0x70
fffff880`06490c20 00000000`74a62dd9 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`02feeca8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x74a62dd9

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiBadShareCount+4c
fffff800`0295632c cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MiBadShareCount+4c

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc600

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c

BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c

Followup: MachineOwner
---------

maybe someone can spot something here I've missed but I am not convinced your last memtest used the right version so could you humor me and burn to CD and run from boot memtest86+ for at least 3 passes , I trust this version of memtest to give a true result

Pauly · Jan 29, 2010

^^^ Agreed think you used wrong memtest, my bad i should have posted you a link, i would try running it again from the link above & see how you go

EasyPC · Jan 31, 2010

26 passes completed with no errors (memtest86+)

New crash dump included from January 31th. The computer crashed while I was listening to flash radio stream (using firefox).

ickymay · Jan 31, 2010

EasyPC said:
26 passes completed with no errors (memtest86+)

New crash dump included from January 31th. The computer crashed while I was listening to flash radio stream (using firefox).

a different error this time

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff88004239624, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff8800205f820, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
dxgkrnl+d624
fffff880`04239624 48895808 mov qword ptr [rax+8],rbx

CONTEXT: fffff8800205f820 -- (.cxr 0xfffff8800205f820)
rax=0000000000000000 rbx=fffff8a0021b53b0 rcx=fffff8a0000c28c0
rdx=fffff880009e8180 rsi=fffff880042453f8 rdi=fffff8a0021b53a0
rip=fffff88004239624 rsp=fffff88002060200 rbp=fffff880042453f8
r8=0000000000000004 r9=0000000000000080 r10=fffff8000284b000
r11=000000000000079c r12=0000000000000005 r13=0000000000000001
r14=0000000000000050 r15=fffff88002060658
iopl=0 nv up ei ng nz ac po cy
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010297
dxgkrnl+0xd624:
fffff880`04239624 48895808 mov qword ptr [rax+8],rbx ds:002b:00000000`00000008=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x3B

PROCESS_NAME: csrss.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 00000000000007ff to fffff88004239624

STACK_TEXT:
fffff880`02060200 00000000`000007ff : 00000000`000000b0 fffff8a0`01be40b0 00000000`00000018 fffff8a0`021b5380 : dxgkrnl+0xd624
fffff880`02060208 00000000`000000b0 : fffff8a0`01be40b0 00000000`00000018 fffff8a0`021b5380 fffff880`042397c7 : 0x7ff
fffff880`02060210 fffff8a0`01be40b0 : 00000000`00000018 fffff8a0`021b5380 fffff880`042397c7 00000000`000007ff : 0xb0
fffff880`02060218 00000000`00000018 : fffff8a0`021b5380 fffff880`042397c7 00000000`000007ff fffff8a0`021b5380 : 0xfffff8a0`01be40b0
fffff880`02060220 fffff8a0`021b5380 : fffff880`042397c7 00000000`000007ff fffff8a0`021b5380 fffff8a0`021d3810 : 0x18
fffff880`02060228 fffff880`042397c7 : 00000000`000007ff fffff8a0`021b5380 fffff8a0`021d3810 00000000`00000000 : 0xfffff8a0`021b5380
fffff880`02060230 00000000`000007ff : fffff8a0`021b5380 fffff8a0`021d3810 00000000`00000000 00000000`00000001 : dxgkrnl+0xd7c7
fffff880`02060238 fffff8a0`021b5380 : fffff8a0`021d3810 00000000`00000000 00000000`00000001 fffff880`042396dc : 0x7ff
fffff880`02060240 fffff8a0`021d3810 : 00000000`00000000 00000000`00000001 fffff880`042396dc 00000000`00000001 : 0xfffff8a0`021b5380
fffff880`02060248 00000000`00000000 : 00000000`00000001 fffff880`042396dc 00000000`00000001 fffff8a0`021d37e0 : 0xfffff8a0`021d3810

FOLLOWUP_IP:
dxgkrnl+d624
fffff880`04239624 48895808 mov qword ptr [rax+8],rbx

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: dxgkrnl+d624

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: dxgkrnl

IMAGE_NAME: dxgkrnl.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4ac5509e

STACK_COMMAND: .cxr 0xfffff8800205f820 ; kb

FAILURE_BUCKET_ID: X64_0x3B_dxgkrnl+d624

BUCKET_ID: X64_0x3B_dxgkrnl+d624

Followup: MachineOwner
---------

can you run cpuz and check your timings are correct for all your ram ?

are you confident all your temperatures are within tolerances ?

you seem to have tried everything else and all your drivers are up to date my only idea at this moment is your suspicions may be correct and if it's possible you could try and get hold of another CPU just to try for a short time ?

Crash dump

New member

My Computer

An error has occured

My Computer

New member

My Computer

An error has occured

My Computer

Account closed by request

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

Gomen ne Jenna-chan

My Computer

An error has occured

My Computer

New member

My Computer

I like it GOO-ee

My Computer

New member

My Computer

I like it GOO-ee

My Computer

An error has occured

My Computer

New member

My Computer

I like it GOO-ee

My Computer

An error has occured

My Computer

New member

My Computer

I like it GOO-ee

My Computer