Crashes possibly bad memory? Win7Pro X64

Sauronis · Dec 1, 2009

I am back oh wisemen of the Win7 forums, with a new batch of dump files.

My university's MSDN AA adminstrator finally got around to getting us access to those apps provided to us by MSDN AA one of them is a copy of win 7 pro. Since I have 4 gigs of RAM and plan to expand to 8 eventually, I went with the 64-bit. Switching from the 32-bit RC Win7.

Did a clean install on my rig and immediately started running into stability issues, after the fourth crash I finally began taking a look at them. All but one say memory corruption leading me to believe that mayhaps my memory has gone bad. Being a novice at analyzing these dump files I have no definite idea.

However the last point was coming up as cause by ntkrnl if I remember right that kind hints at drivers (unless I am thinking of something else), to my knowledge I am using the latest drivers. Attached are the dumps.

Again thank you for your help on this, as well as previous ventures to these forums.

zigzag3143 · Dec 1, 2009

Sauronis said:
I am back oh wisemen of the Win7 forums, with a new batch of dump files.

My university's MSDN AA adminstrator finally got around to getting us access to those apps provided to us by MSDN AA one of them is a copy of win 7 pro. Since I have 4 gigs of RAM and plan to expand to 8 eventually, I went with the 64-bit. Switching from the 32-bit RC Win7.

Did a clean install on my rig and immediately started running into stability issues, after the fourth crash I finally began taking a look at them. All but one say memory corruption leading me to believe that mayhaps my memory has gone bad. Being a novice at analyzing these dump files I have no definite idea.

However the last point was coming up as cause by ntkrnl if I remember right that kind hints at drivers (unless I am thinking of something else), to my knowledge I am using the latest drivers. Attached are the dumps.

Again thank you for your help on this, as well as previous ventures to these forums.

Sauronis

Hi and welcome. Great sense of humor.

Well I took a look at your DMP files. The problem is self evident. usually we have to dig around a bunch to find the offending problem, but 3 of your 4 pointed to the same thing. Memory Corruption. The other thing I noticed is you didnt do a clean install so you have drivers from way back to 2005.

WE HAVE BEEN SEEING AN INCREASE IN 64BIT CRASHES, DUE TO MEMORY AND HARDWARE

I would update all the essential drivers, BIOS, video, rtcore64, and the rest

download memtestx86 and run it overnight so it has a chance to tax your memory.

Run a system file check to verify and fix your system file
type cmd in search>right click and run as admin>sfc /scannow

If you are overclocking stop
If your have a raid driver update it

RTCore64.sys fffff880`069f8000 fffff880`069fe000 0x00006000 0x42941d90 5/25/2005 1:39:12 AM
secdrv.SYS fffff880`068ad000 fffff880`068b8000 0x0000b000 0x4508052e 9/13/2006 8:18:38 AM
rdpdispm.sys fffff880`03b35000 fffff880`03b3c000 0x00007000 0x47e3424e 3/21/2008 12:06:22 AM
xcmemVx64.sys fffff880`03b52000 fffff880`03bb2000 0x00060000 0x48ce250e 9/15/2008 4:04:14 AM
xcbdaVx64.sys fffff880`10b9c000 fffff880`10bd0700 0x00034700 0x48ce2510 9/15/2008 4:04:16 AM
xchalVx64.sys fffff880`03e0a000 fffff880`043af000 0x005a5000 0x48ce2536 9/15/2008 4:04:54 AM
xcfeVx64.sys fffff880`04445000 fffff880`044ee000 0x000a9000 0x48ce2537 9/15/2008 4:04:55 AM

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Users\K\Desktop\113009-25552-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*d:\symbols*Symbol information
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02863000 PsLoadedModuleList = 0xfffff800`02aa0e50
Debug session time: Mon Nov 30 17:56:40.364 2009 (GMT-5)
System Uptime: 0 days 0:40:00.003
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 109, {a3a039d895e2154d, b3b7465ee85fe5bb, fffff800028295d8, 1}

*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption

Followup: memory_corruption
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

CRITICAL_STRUCTURE_CORRUPTION (109)
This bugcheck is generated when the kernel detects that critical kernel code or
data have been corrupted. There are generally three causes for a corruption:
1) A driver has inadvertently or deliberately modified critical kernel code
or data. See Patching Policy for x64-Based Systems: Changes in policy that are related to patching the kernel for the x64-based versions of Microsoft Windows Server 2003 and Microsoft Windows XP Professional x64 Edition operating systems
2) A developer attempted to set a normal kernel breakpoint using a kernel
debugger that was not attached when the system was booted. Normal breakpoints,
"bp", can only be set if the debugger is attached at boot time. Hardware
breakpoints, "ba", can be set at any time.
3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data.
Arguments:
Arg1: a3a039d895e2154d, Reserved
Arg2: b3b7465ee85fe5bb, Reserved
Arg3: fffff800028295d8, Failure type dependent information
Arg4: 0000000000000001, Type of corrupted region, can be
0 : A generic data region
1 : Modification of a function or .pdata
2 : A processor IDT
3 : A processor GDT
4 : Type 1 process list corruption
5 : Type 2 process list corruption
6 : Debug routine modification
7 : Critical MSR modification

Debugging Details:
------------------

BUGCHECK_STR: 0x109

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: CODE_CORRUPTION

PROCESS_NAME: System

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff800028d4f00

STACK_TEXT:
fffff880`02ffc598 00000000`00000000 : 00000000`00000109 a3a039d8`95e2154d b3b7465e`e85fe5bb fffff800`028295d8 : nt!KeBugCheckEx

STACK_COMMAND: kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !hal
fffff80002829611 - hal!KeQueryPerformanceCounter+39
[ 9c:dc ]
1 error : !hal (fffff80002829611)

MODULE_NAME: memory_corruption

IMAGE_NAME: memory_corruption

FOLLOWUP_NAME: memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MEMORY_CORRUPTOR: ONE_BIT

FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT

BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT

Followup: memory_corruption
---------

Sauronis · Dec 1, 2009

I have been running the latest nVidia drivers since install, I installed the latest Network, Audio and chipset drivers prior to crash 4.

Bios is not technically the latest, I am using the F8 version there is an F9e on the Gigabyte website but its a beta BIOS. Should I try installing anyway?

I don't overclock, nor use RAID (nor have the intention of using it)

What other drivers need updated that I missed?

I will run memtest all-night but I doubt it is the physical memory, mostly because of the my lack of memory related crashes in the RC (I got blue-screens most likely due to the Video drivers being intended for the RTM not the RC, no clear indicator of memory problems)

Sauronis · Dec 2, 2009

12 hours of memtest came up clean, no errors. Not conclusive, but a hint in the right direction.

usasma · Dec 2, 2009

I'd suggest running Driver Verifier to see if you can force a crash that will identify the culprit. But, as the indicators point to your video card, and you've updated your video drivers - the most likely cause would be an issue with the video card itself. Do you have another card that you can test the system with?

Here's the instructions for Driver Verifier:

Using Driver Verifier is an iffy proposition. Most times it'll crash and it'll tell you what the driver is. But sometimes it'll crash and won't tell you the driver. Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.

So, I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista Startup Repair feature).

Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
- Select "Automatically select unsigned drivers" and click "Next"
If no drivers show up, then select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out.

Reboot into Windows (after the crash) and turn off Driver Verifier by going back in and selecting "Delete existing settings" on the first page, then locate and zip up the memory dump file and upload it with your next post.

If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.
If that doesn't work, post back and we'll have to see about fixing the registry entry off-line.

More info on this at this link: Using Driver Verifier to identify issues with Windows drivers for advanced users

Sauronis · Dec 3, 2009

Alright, so all day yesterday my computer behaved. Today however, I got a string of four crashes all while attempting to play FarCry2.

Then, I decided to run Driver Verifier, well I ran the proper settings and Win7 wouldn't load at all, it would just sit on the Starting Windows screen (waited half an hour). So I rebooted, and it offered the startup repair, I declined to restore it. I then rebooted, and it made it to the log in screen but then dumped. Restarted a last time and well... here I am.

Attached are the latest dumps.

usasma · Dec 3, 2009

Please update this driver belonging to your network card: RTCore64.sys Wed May 25 02:39:12 2005

The minidumps show 4 different errors - one of which is a Driver Verifier enabled memory dump.
The cause is listed as CI.DLL - the Windows Code Integrity Module.

I suspect that the CI.DLL module was not the cause - but that doesn't leave us with much to go on. Have you scanned the system to see if there's a virus present? Have you performed a memory test? Memory test instructions here: http://www.carrona.org/memdiag.html

Here's a summary of the BSOD's:

Code:

Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Debug session time: Thu Dec  3 12:42:15.908 2009 (GMT-5)
System Uptime: 0 days 0:18:25.422
BugCheck 109, {a3a039d8963e7580, b3b7465ee8bb47ae, fffff80002b45604, 1}
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption
DEFAULT_BUCKET_ID:  CODE_CORRUPTION
PROCESS_NAME:  System
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Debug session time: Thu Dec  3 12:16:07.562 2009 (GMT-5)
System Uptime: 0 days 0:23:46.201
BugCheck 3D, {fffff88007d890d0, 0, 0, fffff80002add60f}
Probably caused by : memory_corruption
DEFAULT_BUCKET_ID:  CODE_CORRUPTION
PROCESS_NAME:  farcry2.exe
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Debug session time: Thu Dec  3 12:22:59.812 2009 (GMT-5)
System Uptime: 0 days 0:01:09.451
BugCheck 1A, {41287, 0, 0, 0}
Probably caused by : hardware ( nt! ?? ::FNODOBFM::`string'+42c75 )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  WmiPrvSE.exe
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Debug session time: Thu Dec  3 13:42:21.605 2009 (GMT-5)
System Uptime: 0 days 0:00:14.150
BugCheck D1, {fffff88000cc0fbb, 2, 8, fffff88000cc0fbb}
Probably caused by : CI.dll ( CI!CiValidateImageHeader+213 )
DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME:  System

Sauronis · Dec 3, 2009

No viruses detected (using Avast free and Malwarebytes) will run a Panda scan just to make sure, but I find it very unlikely this is a fresh install and antivirus software was the first thing to come after drivers.

Ran memtest for 9 passes on Dec 1st. No errors, but if you think I should run it again overnight it wouldn't hurt.

Turned off driver verifier, no crashes just really sluggish system and I updated that network driver. No additional crashes yet. Will post if I get additional minidumps.

usasma · Dec 3, 2009

Please run the Driver Verifier one more time.
This time have it verify all the Microsoft drivers - and none of the 3rd party drivers.
It's not likely to give us anything - but it could point to an OS corruption (which is becoming more likely IMO).

Sauronis · Dec 8, 2009

On the weekends I don't have access to my desktop, so I wasn't able to run driver verifier again till today.

I ran it, this time with only windows drivers, The system won't load. The first time I tried it just restarted, no BSOD, second time I got a BSOD.

I got a handful of BSODS last night. I know one of them was due to the power going out in my dorm last night. The others are all memory corruption. I will post them up shortly. I am currently posting from my laptop as I use Safe Mode to turn off the Driver Verifier.

Sauronis · Dec 8, 2009

miniDumps are attached

Sauronis · Dec 10, 2009

bump?

usasma · Dec 11, 2009

The last one points to your Avast protection.
Please download a fresh copy of Avast
Then uninstall your Avast from Control Panel...Programs...Uninstall a program
Then use this free tool to remove the remnants: avast! uninstall utility
Then IMMEDIATELY install and update the fresh copy of Avast.

Older drivers that should be updated to rule them out. Pay particular attention to the one from 2005:

Code:

rdpdispm.sys Fri Mar 21 01:06:22 2008
xchalVx64.sys Mon Sep 15 05:04:54 2008
xcfeVx64.sys Mon Sep 15 05:04:55 2008
RTCore64.sys Wed May 25 02:39:12 2005
xcbdaVx64.sys Mon Sep 15 05:04:16 2008
xcmemVx64.sys Mon Sep 15 05:04:14 2008

Summary of debug analysis:

Code:

Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Debug session time: Thu Dec  3 12:42:15.908 2009 (GMT-5)
System Uptime: 0 days 0:18:25.422
BugCheck 109, {a3a039d8963e7580, b3b7465ee8bb47ae, fffff80002b45604, 1}
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption
DEFAULT_BUCKET_ID:  CODE_CORRUPTION
PROCESS_NAME:  System
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Debug session time: Thu Dec  3 12:16:07.562 2009 (GMT-5)
System Uptime: 0 days 0:23:46.201
BugCheck 3D, {fffff88007d890d0, 0, 0, fffff80002add60f}
Probably caused by : memory_corruption
DEFAULT_BUCKET_ID:  CODE_CORRUPTION
PROCESS_NAME:  farcry2.exe
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Debug session time: Thu Dec  3 12:22:59.812 2009 (GMT-5)
System Uptime: 0 days 0:01:09.451
BugCheck 1A, {41287, 0, 0, 0}
Probably caused by : hardware ( nt! ?? ::FNODOBFM::`string'+42c75 )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  WmiPrvSE.exe
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Debug session time: Thu Dec  3 13:42:21.605 2009 (GMT-5)
System Uptime: 0 days 0:00:14.150
BugCheck D1, {fffff88000cc0fbb, 2, 8, fffff88000cc0fbb}
Probably caused by : CI.dll ( CI!CiValidateImageHeader+213 )
DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME:  System
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Debug session time: Tue Dec  8 00:45:13.416 2009 (GMT-5)
System Uptime: 0 days 0:00:13.244
BugCheck 1000007E, {ffffffffc0000005, fffff80001a4d610, fffff88001fd3e68, fffff88001fd36c0}
Probably caused by : memory_corruption
DEFAULT_BUCKET_ID:  CODE_CORRUPTION
PROCESS_NAME:  System
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Debug session time: Mon Dec  7 23:27:14.571 2009 (GMT-5)
System Uptime: 0 days 1:53:43.383
BugCheck 1E, {0, 0, 0, 0}
Probably caused by : ntkrnlmp.exe ( nt!KiKernelCalloutExceptionHandler+e )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  svchost.exe
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Debug session time: Tue Dec  8 02:45:10.777 2009 (GMT-5)
System Uptime: 0 days 0:31:19.416
BugCheck 109, {a3a039d89633d6f1, b3b7465ee8b1a75f, fffff80002c295d8, 1}
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption
DEFAULT_BUCKET_ID:  CODE_CORRUPTION
PROCESS_NAME:  System
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Debug session time: Tue Dec  8 14:24:20.270 2009 (GMT-5)
System Uptime: 0 days 0:01:15.940
BugCheck CD, {fffff9800034b000, 0, fffff80002cc4bbc, 0}
*** WARNING: Unable to verify timestamp for aswSP.SYS
*** ERROR: Module load completed but symbols could not be loaded for aswSP.SYS
Probably caused by : aswSP.SYS ( aswSP+63f3 )
DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME:  System

Sauronis · Dec 12, 2009

What is this driver for, If I knew what device it was for I would have replaced it already XD
RTCore64.sys Wed May 25 02:39:12 2005

chev65 · Dec 12, 2009

You might want to look here. GIGABYTE - Support&Download - Motherboard - Driver - GA-EP43-DS3L (rev. 1.0)

The dates of your drivers currently are all older than ones posted for your board in the link above.

Sauronis · Dec 13, 2009

I already downloaded everything their site had to offer

twice.

ccatlett1984 · Dec 13, 2009

downloading it does not install it

Sauronis · Dec 16, 2009

Thats what I meant to say. >_>
I have dl'd and installed them twice. That RTCore64.sys is not on their site unless there is some other driver page

usasma · Dec 18, 2009

RTCore64.sys is most likely related to a utility that you installed with your eVGA video card.
It's called Precision and appears related to RivaTuner.
RTCore64.sys digitally signed - working! - RightMark Forums

Sauronis · Dec 19, 2009

Ah so THATS what its from.

I use EVGA Precision to change the fan speed, I don't use it to overclock, just as an easy tool to change fan speed to keep temps low while gaming.

Should I switch over to something like SpeedFan and uninstall EVGA precision?

Crashes possibly bad memory? Win7Pro X64

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

Mr. Cranky Pants

My Computer

New member

My Computer

Mr. Cranky Pants

My Computer

New member

My Computer

Mr. Cranky Pants

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

Mr. Cranky Pants

My Computer

New member

My Computer

Closed

My Computer

New member

My Computer

Technophile

My Computer

New member

My Computer

Mr. Cranky Pants

My Computer

New member

My Computer

Similar threads