BSOD - when 2 modules of mem. inserted

Beren · 13 Nov 2010

Hello,

Please Help.

I experience BSOD's when I insert my second module of my 4 gb Kingston ram. I have run a memtest86 for 17 cycles with both modules inserted - all tests pass. I have tried both modules individually and both pass. I have checked the asus's memory list and my memory is listed as compatible when 2 modules are inserted.

Initially when I insert the second module, the system will boot fine and will be stable. The issues seems to occur on the next restart. Sometimes the system won't boot (no bios screen, no I/O respoonse), others - as soon as the loading screen appears for Windows - BSOD.

I have upgraded my bios to the latest version, and installed the latest drivers, but still the same problems occur. Again the system is completely stable with only ONE module installed (I have used both individually without any issues).

I have switched to a 400w psu, and the same problem occurs. I don't believe it is a temperature issue, as it occurs on start-up after the system has been turned off overnight.

Thanks!

wish · 13 Nov 2010

Hi,
Most your dump files indicate memory corruption (0xA), (0x1a), (0x50), (0x7e) --> usual caused by drivers or RAM.

It seems your Asus driver (ASACPI.sys ) is obsolete and need to be update ASAP because old driver is well known as BSOD maker.

While troubleshooting , it's better removing Avast and replace it with MSE.
You may go back to Avast after your Windows have stabled.
http://www.microsoft.com/security_essentials/

Uuninstall Alcohol/Daemon software and remove its driver (sptd.sys) with this tools --> DuplexSecure - Downloads
Because sptd.sys have some issue with Windows 7 and for alternative software you may use MagicISO.

Then uninstall your Acronis Software because it's also use old driver.

These drivers need to be updated:

Code:

ASACPI.sys   Mon Oct 30 18:09:12 2006 --> Asus ATK0110 ACPI Utility 
Rt64win7.sys Sat Dec 19 01:11:30 2009 --> Realtek NIC driver
snapman.sys  Fri Oct 06 06:43:53 2006 --> Acronis True Image Snapshot Manager driver
sptd.sys     Sun Oct 11 13:54:02 2009 --> Remove with SPTDinst

Log

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffa00c2fde168, 0, fffff9600018ae41, 7}


Could not read faulting driver name
Probably caused by : win32k.sys ( win32k!ValidateHwnd+f1 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa00c2fde168, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff9600018ae41, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000007, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff8000310b0e0
 fffffa00c2fde168 

FAULTING_IP: 
win32k!ValidateHwnd+f1
fffff960`0018ae41 498b9058010000  mov     rdx,qword ptr [r8+158h]

MM_INTERNAL_CODE:  7

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  explorer.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88006aa89f0 -- (.trap 0xfffff88006aa89f0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff900c2fde010 rbx=0000000000000000 rcx=0000000000010072
rdx=fffffa800576bdc0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff9600018ae41 rsp=fffff88006aa8b80 rbp=0000000000000001
 r8=fffffa00c2fde010  r9=0000000000000000 r10=fffff960001a07e0
r11=fffff900c2fde010 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
win32k!ValidateHwnd+0xf1:
fffff960`0018ae41 498b9058010000  mov     rdx,qword ptr [r8+158h] ds:6010:fffffa00`c2fde168=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002f52849 to fffff80002ed3740

STACK_TEXT:  
fffff880`06aa8888 fffff800`02f52849 : 00000000`00000050 fffffa00`c2fde168 00000000`00000000 fffff880`06aa89f0 : nt!KeBugCheckEx
fffff880`06aa8890 fffff800`02ed182e : 00000000`00000000 fffff900`c0400ab0 fffff900`c073ea00 fffff960`00184451 : nt! ?? ::FNODOBFM::`string'+0x40e0b
fffff880`06aa89f0 fffff960`0018ae41 : 00000000`0001007c fffffa80`03c88690 00000000`00000001 00000000`00000000 : nt!KiPageFault+0x16e
fffff880`06aa8b80 fffff960`001a081f : 00000000`00010072 00000000`0000a915 00000002`00000063 0000001e`000000a9 : win32k!ValidateHwnd+0xf1
fffff880`06aa8bb0 fffff800`02ed2993 : fffffa80`03c88690 fffff880`06aa8c60 00000000`00000000 00000000`00000020 : win32k!NtUserSetProp+0x3f
fffff880`06aa8be0 00000000`76c7b58a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0346f408 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76c7b58a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!ValidateHwnd+f1
fffff960`0018ae41 498b9058010000  mov     rdx,qword ptr [r8+158h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  win32k!ValidateHwnd+f1

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4c7dc13c

FAILURE_BUCKET_ID:  X64_0x50_win32k!ValidateHwnd+f1

BUCKET_ID:  X64_0x50_win32k!ValidateHwnd+f1

Followup: MachineOwner

Beren · 14 Nov 2010

Thanks for the quick response and a details solution. So far my system has been stable ( I have yet to install avast again).

wish · 14 Nov 2010

You're welcome and hope your problem have fixed completely

Beren · 15 Nov 2010

Hi,

I am still getting the bsod, but only on the next restart of the system. I have attached the new analysis. Thanks.

wish · 15 Nov 2010

Hello,
I see that you have update most of the drivers, but your outdated Acronis driver still load in memory.
If you have uninstalled that software but the driver still remain. Then you must manually delete that driver or rename it into .bak.
C:\Windows\system32\drivers\snapman.sys

Another dump point to NDProxy.SYS as the caused so you must perform system file checker:
Right click Command Prompt -> run as admin -> sfc /scannow

Then uninstall RAMdisk and Speedfan to see if the problem persist.

Log:

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff80002ec9b89, 0, ffffffffffffffff}

Probably caused by : ntkrnlmp.exe ( nt!IoGetAttachedDevice+9 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002ec9b89, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP: 
nt!IoGetAttachedDevice+9
fffff800`02ec9b89 488b4018        mov     rax,qword ptr [rax+18h]

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030bd0e0
 ffffffffffffffff 

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x1E

PROCESS_NAME:  explorer.exe

CURRENT_IRQL:  0

EXCEPTION_RECORD:  fffff880029cfea8 -- (.exr 0xfffff880029cfea8)
ExceptionAddress: fffff80002ec9b89 (nt!IoGetAttachedDevice+0x0000000000000009)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

TRAP_FRAME:  fffff880029cff50 -- (.trap 0xfffff880029cff50)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffff0080046089f0 rbx=0000000000000000 rcx=ffff0080046089f0
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ec9b89 rsp=fffff880029d00e8 rbp=fffff80003188260
 r8=fffffa8004609bd0  r9=0000000000000000 r10=fffffa8004609bd0
r11=fffff8a00394fd7e r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
nt!IoGetAttachedDevice+0x9:
fffff800`02ec9b89 488b4018        mov     rax,qword ptr [rax+18h] ds:2a10:ffff0080`04608a08=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002ebfa39 to fffff80002e85740

STACK_TEXT:  
fffff880`029cf6d8 fffff800`02ebfa39 : 00000000`0000001e ffffffff`c0000005 fffff800`02ec9b89 00000000`00000000 : nt!KeBugCheckEx
fffff880`029cf6e0 fffff800`02e84d82 : fffff880`029cfea8 00000000`0000000c fffff880`029cff50 fffffa80`039f3010 : nt!KiDispatchException+0x1b9
fffff880`029cfd70 fffff800`02e8368a : fffff8a0`003a5e01 fffff800`02ea1306 fffff8a0`01ec3950 fffff8a0`01ec3958 : nt!KiExceptionDispatch+0xc2
fffff880`029cff50 fffff800`02ec9b89 : fffff800`03188ac0 00000000`00000000 fffff880`01079af5 fffffa80`03717080 : nt!KiGeneralProtectionFault+0x10a
fffff880`029d00e8 fffff800`03188ac0 : 00000000`00000000 fffff880`01079af5 fffffa80`03717080 fffffa80`03947b10 : nt!IoGetAttachedDevice+0x9
fffff880`029d00f0 fffff800`0317ee84 : fffffa80`04609bd0 00000000`00000000 fffffa80`03947b10 00000000`00000000 : nt!IopParseDevice+0x860
fffff880`029d0280 fffff800`03183e4d : fffffa80`03947b10 fffff880`029d03e0 00000000`00000240 fffffa80`03717080 : nt!ObpLookupObjectName+0x585
fffff880`029d0380 fffff800`0318a917 : 00000000`00000000 00000000`00000001 00000000`00000000 00000000`00000000 : nt!ObOpenObjectByName+0x1cd
fffff880`029d0430 fffff800`03194520 : fffff880`029d0630 00000000`00100080 fffff880`00000009 fffff880`029d05d0 : nt!IopCreateFile+0x2b7
fffff880`029d04d0 fffff800`032e0148 : 00000000`00005478 fffff8a0`0039e000 00000000`4d506300 00000000`00000801 : nt!NtCreateFile+0x78
fffff880`029d0560 fffff800`032e0286 : 00000000`00000000 00000000`00000000 fffff6fb`7ea000f0 00000000`000007ff : nt!PfSnIsVolumeMounted+0xa8
fffff880`029d0620 fffff800`032e1e52 : 00000000`00000000 00000000`00000005 00000000`00000000 fffff800`42506343 : nt!PfSnOpenVolumesForPrefetch+0xc6
fffff880`029d06d0 fffff800`032e22bf : 00000084`09086e28 fffffa80`03bd6280 fffff8a0`02614000 00000000`00000000 : nt!PfSnPrefetchScenario+0x142
fffff880`029d0940 fffff800`030da6df : 00000000`00000000 00000000`7a3328da fffffa80`05640dd0 00000000`00000000 : nt!PfSnBeginAppLaunch+0x35f
fffff880`029d0a10 fffff800`031532fc : fffffa80`03bc2a10 fffffa80`05640dd0 00000000`14050800 00000000`00000000 : nt! ?? ::NNGAKEGL::`string'+0x50100
fffff880`029d0a40 fffff800`02e63d55 : fffff800`02fffe80 00000000`00000000 fffff800`03153200 fffffa80`03bc2a10 : nt!PspUserThreadStartup+0xfc
fffff880`029d0aa0 fffff800`02e63cd7 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartUserThread+0x16
fffff880`029d0be0 00000000`76d63000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartUserThreadReturn
00000000`000efca8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76d63000


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!IoGetAttachedDevice+9
fffff800`02ec9b89 488b4018        mov     rax,qword ptr [rax+18h]

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  nt!IoGetAttachedDevice+9

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

FAILURE_BUCKET_ID:  X64_0x1E_nt!IoGetAttachedDevice+9

BUCKET_ID:  X64_0x1E_nt!IoGetAttachedDevice+9

Followup: MachineOwner

Beren · 16 Nov 2010

Ok, I was able to rename the snapman.sys driver, but when I uninstalled RAMdisk I got this error in the perfmon report performed after a restart:

The device, RAMDiskVE, is reporting "tv_ConfigMgrErr31". This device will not be available until the issue is resolved. The Plug and Play ID for this device is ROOT\DATARAM_RAMDISK_DEVICES\0000.

I found this registry in the ControlSet1 directory, but I was unable to remove the keys from the registry.

I then turned off the machine and unplugged it. Came back 30 min later in started it back up. I went to log in and the system just restarted - NO BSOD though.

I checked for any minidumps and there were none for today. There were 22 error logs (for the past hour) in the event log however. Here is one:

Log Name: System
Source: Service Control Manager
Date: 11/16/2010 8:08:07 AM
Event ID: 7026
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Beren-PC
Description:
The following boot-start or system-start driver(s) failed to load:
snapman
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
<EventID Qualifiers="49152">7026</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2010-11-16T07:08:07.050793800Z" />
<EventRecordID>470492</EventRecordID>
<Correlation />
<Execution ProcessID="552" ThreadID="556" />
<Channel>System</Channel>
<Computer>Beren-PC</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">
snapman</Data>
</EventData>
</Event>

I looked at the services and noticed that "Acronis OS Selector Reinstall Service" is still listed but it is set to disabled.

Any suggestions?

Thanks.

wish · 16 Nov 2010

Use ccleaner to remove RAMDISK and Acronis registry.

And have you tried system file checker as suggested before? And what is the result?

Beren · 17 Nov 2010

Yes, I have run ccleaner and it still did not remove the registry for RAMDISK and Acronis registry.

here was the result of the sfc /scannow

Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.

zigzag3143 · 17 Nov 2010

Beren said:

Yes, I have run ccleaner and it still did not remove the registry for RAMDISK and Acronis registry.

here was the result of the sfc /scannow

Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.

Well thats some good news for a change.

Memtest may not be spotting the problem if it is caused by a driver that is loaded in win 7, because it is run outside of the environment. IN order to spot the errant driver it may be necessary to run driver verifier.

Beyond that, please run Verifier with these settings:

Using Driver Verifier is an iffy proposition. Most times it'll crash and it'll tell you what the driver is. But sometimes it'll crash and won't tell you the driver. Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.

So, I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Win7 Startup Repair feature).

Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
NOTE: You can use Low Resource Simulation if you'd like. From my limited experimentation it makes the BSOD's come faster.
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out. If it doesn't crash for you, then let it run for at least 36 hours of continuous operation (an estimate on my part).

Reboot into Windows (after the crash) and turn off Driver Verifier by going back in and selecting "Delete existing settings" on the first page, then locate and zip up the memory dump file and upload it with your next post.

If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.

If that doesn't work, post back and we'll have to see about fixing the registry entry off-line:

Code:

Delete these registry keys (works in XP, Vista, Win7):
        HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\VerifyDrivers
        HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\VerifyDriverLevel

Using Driver Verifier to identify issues with Windows drivers for advanced users

Let us know how it goes.

Ken J

BSOD - when 2 modules of mem. inserted

BSOD - when 2 modules of mem. inserted

Thanks! System seems to be stable

Still getting BSOD