RAM-Related BSODs, Several Times / Day

boldspud · 11 Aug 2010

As if the karma gods saw me make that last post - the computer blue-screened hours after I thought it was okay. I've had three crashes since then. Here's the attachment.

Also, I've been running MemTest86 on the various sticks in various slots, and I think one of my issues is a bad dimm slot. A stick which ran for 8+ hours just fine in the first slot gave an error within 10 minutes in the second.

Either way, these crashes happened after I removed the stick from this offending slot.

CarlTR6 · 11 Aug 2010

Error code 3B - Usual causes: System service, Device driver, graphics driver, ?memory

Error code 19 - Usual causes: Device driver

Error code A - Usual causes: Kernel mode driver, System Service, BIOS, Windows, Virus scanner, Backup tool, compatibility

The first dump indicates a memory problem (c0000005). The second indicates memory corruption and points to avgcsrva.exe as the cause. avgcsrva.exe is AVG antivirus. The third dump does not tell us much.

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp1_New BSODs.zip\081010-29000-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02c0e000 PsLoadedModuleList = 0xfffff800`02e4be50
Debug session time: Tue Aug 10 20:28:20.170 2010 (GMT-4)
System Uptime: 0 days 20:59:39.386
Loading Kernel Symbols
...............................................................
................................................................
..............................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff960000d95ee, fffff880077d8030, 0}

Probably caused by : win32k.sys ( win32k!xxxRealInternalGetMessage+17e )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff960000d95ee, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff880077d8030, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
win32k!xxxRealInternalGetMessage+17e
fffff960`000d95ee ff15fc6a1d00    call    qword ptr [win32k!_imp_PsGetCurrentProcessWin32Process (fffff960`002b00f0)]

CONTEXT:  fffff880077d8030 -- (.cxr 0xfffff880077d8030)
rax=0000000000000001 rbx=fffff900c3f41250 rcx=0000000000000000
rdx=8000000000040000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff960000d95ee rsp=fffff880077d8a00 rbp=fffff880077d8ca0
 r8=0000000004813ff3  r9=00000000ffffffff r10=0000000000002407
r11=0000000000000000 r12=0000000000000001 r13=fffff880077d8b68
r14=00000000000025ff r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
win32k!xxxRealInternalGetMessage+0x17e:
fffff960`000d95ee ff15fc6a1d00    call    qword ptr [win32k!_imp_PsGetCurrentProcessWin32Process (fffff960`002b00f0)] ds:002b:fffff960`002b00f0=00000000002fc562
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  chrome.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff960000d9d51 to fffff960000d95ee

STACK_TEXT:  
fffff880`077d8a00 fffff960`000d9d51 : 00000000`00000000 fffff800`000025ff 00000000`00000000 fffffa80`ffffffff : win32k!xxxRealInternalGetMessage+0x17e
fffff880`077d8ae0 fffff960`000d27f7 : 00000000`0013fd20 00000000`00000000 fffff800`02df8e80 00000000`7efdb000 : win32k!xxxInternalGetMessage+0x35
fffff880`077d8b20 fffff800`02c7d853 : fffffa80`0470b820 00000000`0013e248 fffff880`077d8bc8 00000000`73f42450 : win32k!NtUserPeekMessage+0x77
fffff880`077d8bb0 00000000`73f8fbda : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0013e228 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x73f8fbda


FOLLOWUP_IP: 
win32k!xxxRealInternalGetMessage+17e
fffff960`000d95ee ff15fc6a1d00    call    qword ptr [win32k!_imp_PsGetCurrentProcessWin32Process (fffff960`002b00f0)]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  win32k!xxxRealInternalGetMessage+17e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4bdc4376

STACK_COMMAND:  .cxr 0xfffff880077d8030 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_win32k!xxxRealInternalGetMessage+17e

BUCKET_ID:  X64_0x3B_win32k!xxxRealInternalGetMessage+17e

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp1_New BSODs.zip\081110-30669-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02c4d000 PsLoadedModuleList = 0xfffff800`02e8ae50
Debug session time: Wed Aug 11 16:56:16.694 2010 (GMT-4)
System Uptime: 0 days 0:08:50.817
Loading Kernel Symbols
...............................................................
................................................................
...............................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {20, fffffa800461d680, fffffa800461d710, 4090008}

GetPointerFromAddress: unable to read from fffff80002ef50e0
Probably caused by : memory_corruption ( nt!MiUnmapViewOfSection+294 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000020, a pool block header size is corrupt.
Arg2: fffffa800461d680, The pool entry we were looking for within the page.
Arg3: fffffa800461d710, The next pool entry.
Arg4: 0000000004090008, (reserved)

Debugging Details:
------------------


BUGCHECK_STR:  0x19_20

POOL_ADDRESS:  fffffa800461d680 

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  avgcsrva.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002df06d3 to fffff80002cbd600

STACK_TEXT:  
fffff880`07625a58 fffff800`02df06d3 : 00000000`00000019 00000000`00000020 fffffa80`0461d680 fffffa80`0461d710 : nt!KeBugCheckEx
fffff880`07625a60 fffff800`02fd7254 : 00000000`00002000 00000000`00000000 fffffa80`20646156 fffffa80`00000000 : nt!ExFreePool+0xda4
fffff880`07625b10 fffff800`02fd757b : 00000000`00000000 00000000`08d80000 fffffa80`00000001 00000000`00000001 : nt!MiUnmapViewOfSection+0x294
fffff880`07625bd0 fffff800`02cbc853 : 00000000`00000000 00000000`00000001 fffffa80`03b1d060 fffffa80`04c5fda0 : nt!NtUnmapViewOfSection+0x5f
fffff880`07625c20 00000000`7708fffa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`07b7f178 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7708fffa


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiUnmapViewOfSection+294
fffff800`02fd7254 33ed            xor     ebp,ebp

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!MiUnmapViewOfSection+294

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x19_20_nt!MiUnmapViewOfSection+294

BUCKET_ID:  X64_0x19_20_nt!MiUnmapViewOfSection+294

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp1_New BSODs.zip\081110-30778-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02c00000 PsLoadedModuleList = 0xfffff800`02e3de50
Debug session time: Wed Aug 11 18:45:35.677 2010 (GMT-4)
System Uptime: 0 days 1:48:25.425
Loading Kernel Symbols
...............................................................
................................................................
...............................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {3000330049, 2, 1, fffff80002c746b1}

Probably caused by : ntkrnlmp.exe ( nt!KeSetEvent+121 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000003000330049, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002c746b1, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ea80e0
 0000003000330049 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KeSetEvent+121
fffff800`02c746b1 488908          mov     qword ptr [rax],rcx

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  chrome.exe

TRAP_FRAME:  fffff880090bf9c0 -- (.trap 0xfffff880090bf9c0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000003000330049 rbx=0000000000000000 rcx=0024000804a00000
rdx=fffffa800b3d0168 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002c746b1 rsp=fffff880090bfb50 rbp=0000000000000000
 r8=0000000000000000  r9=0000000000000000 r10=fffffa8003a44200
r11=00000000001f0003 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
nt!KeSetEvent+0x121:
fffff800`02c746b1 488908          mov     qword ptr [rax],rcx ds:0194:00000030`00330049=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002c6fb69 to fffff80002c70600

STACK_TEXT:  
fffff880`090bf878 fffff800`02c6fb69 : 00000000`0000000a 00000030`00330049 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`090bf880 fffff800`02c6e7e0 : 00000000`00000000 fffffa80`09e784c0 00000000`00000000 00000000`ee657645 : nt!KiBugCheckDispatch+0x69
fffff880`090bf9c0 fffff800`02c746b1 : 00000000`00000000 00000000`00000001 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x260
fffff880`090bfb50 fffff800`02f8e100 : 00000000`00000000 fffff800`00000001 fffffa80`03a44200 00240008`04a00000 : nt!KeSetEvent+0x121
fffff880`090bfbc0 fffff800`02c6f853 : fffffa80`0b1ad660 fffffa80`0ac51dd0 00000000`00000000 fffffa80`09e784c0 : nt!NtSetEvent+0x90
fffff880`090bfc20 00000000`740a2dd9 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`03b9edb8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x740a2dd9


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KeSetEvent+121
fffff800`02c746b1 488908          mov     qword ptr [rax],rcx

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!KeSetEvent+121

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

FAILURE_BUCKET_ID:  X64_0xA_nt!KeSetEvent+121

BUCKET_ID:  X64_0xA_nt!KeSetEvent+121

Followup: MachineOwner
---------

You have already determined that RAM is at least part of the problem. I recommend that you uninstall AVG using this tool >Info > Tool (32bit) - Tool (64 bit) and install Microsoft Security Essentials in its place.

Since you are not going to use the bad slot, uninstall AVG, turn Driver Verifier off, let your system run and let's see what happens. You will probably need to turn it back on later.

Though your driver situation has improved, you still have some obsolete drivers that need updating or eliminating. I can almost guarantee these obsolete drivers will continue to cause instability. I recommend you completely uninstall the TV tuner, uGuru, and the Silicon Image software. This software is obsolete. That will clean you drivers up with the exception of the Wacom mouse driver which you also need to eliminate.

athrx.sys Tue Feb 17 23:02:57 2009
havabus.sys Fri May 23 07:31:15 2008
HAVATV.sys Fri Oct 03 07:20:29 2008
HavaTV_10.sys Fri Oct 03 07:20:29 2008
nvstor.sys Wed May 20 02:45:37 2009
SCDEmu.SYS Tue Aug 07 11:19:48 2007
SI3132.sys Wed Oct 03 14:39:29 2007
SiRemFil.sys Wed Jun 20 15:42:10 2007
SiWinAcc.sys Thu Jun 14 20:02:02 2007
uGuru.sys Wed Sep 20 04:06:44 2006
wacommousefilter.sys Fri Feb 16 13:12:17 2007

boldspud · 27 Aug 2010

Okay, so after a week of seemingly no problems whatsoever, this issue has returned with a vengeance. Last night, my computer blue screened and will not even boot now. I formatted the hard drive even, and re-installed Windows 7, and it will not boot even to the password screen of Windows.

I decided to run MemTest again, and received errors in the first few seconds. These are the same two sticks that I tested two weeks ago for a full 48 hour period and received no errors whatsoever.

Could this be a motherboard issue? The Abit IN9 32X Max has already presented me with many issues in dealing with Windows 7, even before all this BSOD stuff started (Ethernet / Wifi issues, RAM issues). Should I just get a new mobo to see if this solves all my problems? If so, which model would someone recommend which would be compatible with all the other gear I already have? I'd like this to be not so much an upgrade as a quick fix.

I'm thinking either the GIGABYTE GA-G41M-Combo or the ASUS P5N-D at this point. Any suggestions?

CarlTR6 · 27 Aug 2010

Yes, it could be a motherboard issue. It could also be a CPU issue. If you are simply ready to upgrade your motherboard, that is fine. You could also take your computer to a shop and have it bench tested.

I will get some of the hardware guys to give you some advice on replacing the motherboard. I am sure they will want to know how you use your computer, if you are a gamer, if you do heavy graphics work, etc.

boldspud · 27 Aug 2010

Thank you very much, Carl.

And, as a reference for anyone who may have the time to help me out, I do all of those things with my computer. My desktop is basically a home workstation where I edit film using Adobe Premiere / AE, do 3d modeling with Maya / Zbrush, and I also like to do some light video game playing (sadly, I bought Starcraft 2 literally hours before this all went down).

The computer seemed to have plenty of power for my purposes before it started dying earlier this month. If, however, something seems too archaic, I would be willing to replace it along with the motherboard if need be.

karlsnooks · 27 Aug 2010

Install, run SpeedFan. Don't adjust your fan speed, simply use SpeedFan as a way of monitoring and viewing your temps.

Be sure to keep the temps down.

Keep the cover off the computer for a couple of days so that you can visually monitor the fans. This will also help to keep the unit cool. Remember-you're not a geek if the cover is on your computer.

SpeedFan - Access temperature sensor in your computer

CarlTR6 · 27 Aug 2010

There are three or four hardware guys that no their stuff. They will answer my call for help. This may be the time to upgrade your system. I plan to do that in the next two months. I am running on an antique.

boldspud · 27 Aug 2010

Thanks Karl - I'll remember to install SpeedFan, for sure. Problem is my system's so dead right now I can't get far enough into the system to do anything like that

karlsnooks · 27 Aug 2010

Since it is that dead, try following:

Remove all Ram, remove all cards, remove all connections other than power.

Turn the computer on and listen for the bios beep code.

Previously, you need to, from a working computer, go to the Abit site and get the bios beep code info for your motherboard. This is usually inside the manual for the motherboard. lf you have the manual, then you are ahead of the game.

You should get the beep code for no memory.

Plug in one and only memory module and run the beep code test again.

Do this for each memory module, only one stick at a time.

Now start stuffing another memory module in and repeat the test.

Keep doing this until you've stuffed them all in or found the problem.

During this time, if a memory module is good, you should be getting the beep code for VGA missing.

If you passed, the memory tests, reconnect VGA card and test again.
Reconnect monitor and test again.

You get the general idea. You want to determine what is failing by starting with a bare minimum.

Dave76 · 27 Aug 2010

Karl's suggestion is the best way to narrow down the probable hardware cause.

Assuming you make some progress, have you been overclocking?
If yes, return everything to defaults until you find the problem, this should give you a little more breathing room.

Memtest86+ failures usually result from RAM or slot issues but can be caused by CPU or NB problems.
Have you done anything with the CPU? New heat sink, taken it out for any reason?
Have you updated all your motherboard drivers (sorry if you went through this already) and BIOS?

Are your RAM cards 4X2GB?
Have you ever adjusted the NB voltage?