Win7 Pro 64Bit - memdump

BMXer · 10 Apr 2011

How do you read these things. I found a utility, but its not completely compatible with Win7 64bit. Computer was running great then I started getting blue screen memory dumps. I can find the dump file, but not the xml file ...

dump file attached. Link to a utility and/or a how to would be greatly appreciated.

usasma · 10 Apr 2011

Link to a how-to: WinDbg Analysis Report

Unfortunately, the Windows Debugging Tools aren't able to access symbols for your operating system files (in particular Win32k.sys) from the Microsoft Symbol Server - so that makes debugging them difficult if not impossible.

Please do the following (this will not affect the analysis of the current files - but it may help later files that are acquired):
- activate/validate the Windows installation at Genuine Microsoft Software
- run sfc.exe /scannow to replace any problem files
- open a support incident with Microsoft to see if they can fix the missing symbols issue ( Support for Windows 7 technical problems and troubleshooting )
- If that doesn't fix it, then wipe the hard drive and reinstall Windows
- don't use "leaked"/torrent builds (if this is the case we may never find a fix)

So, let's try some old-fashioned detective work.....

First, please provide this info: https://www.sevenforums.com/crashes-d...tructions.html

Please update your ASACPI.sys file immediately. The 2005 version (which you have) is a known cause of BSOD's.
Go to this page: ASUSTeK Computer Inc.-Support- download_item_mkt
Enter your OS in the dropdown box
Scroll down to the Utilities section and download/install the "ATK0110 driver for WindowsXP/Vista/Win7 32&64-bit " - it's the 15th item down in the Utilities section

Here's more info on the specific error that you're getting: BSOD Index

So, let's start with this set of free tests:

H/W Diagnostics:
Please start by running these bootable hardware diagnostics:
Memory Diagnostics (read the details at the link)
HD Diagnostic (read the details at the link)

Also, please run one of these free, independent online malware scans to ensure that your current protection hasn't been compromised: Free Online AntiMalware Scanners (read the details at the link)

OLDER DRIVERS PRESENT IN THE DUMP FILES
- Please update these drivers from the device manufacturer's website - or uninstall/remove them from your system. Reference links are included below.
- DO NOT use Windows Update or the Update Drivers function of Device Manager.
- Please feel free to post back about any drivers that you are having difficulty locating.
- Windows Update exceptions may be noted below for Windows drivers:

Code:


vmbus.sys       Sat Nov 20 04:57:29 2010 (4CE79B89)
winhv.sys       Sat Nov 20 04:20:02 2010 (4CE792C2)
amdxata.sys     Fri Mar 19 12:18:18 2010 (4BA3A3CA)
mfehidk.sys     Wed Oct 06 15:55:49 2010 (4CACD445)
mfewfpk.sys     Wed Oct 06 15:56:04 2010 (4CACD454)
athurx.sys      Mon Jan 04 22:23:16 2010 (4B42B0A4) - Atheros AR9271 Wireless Network Adapter 
mfenlfk.sys     Wed Oct 06 15:56:13 2010 (4CACD45D)
mfeavfk.sys     Wed Oct 06 15:56:49 2010 (4CACD481)
ASACPI.sys      Sun Mar 27 22:30:36 2005 (42476C4C)
GEARAspiWDM.sys Mon May 18 08:17:04 2009 (4A1151C0)
mfefirek.sys    Wed Oct 06 15:59:47 2010 (4CACD533)
cfwids.sys      Wed Oct 06 16:00:36 2010 (4CACD564)
mfeapfk.sys     Wed Oct 06 15:56:26 2010 (4CACD46A)

BSOD BUGCHECK SUMMARY

Code:


Built by: 7601.17514.amd64fre.win7sp1_rtm.101119-1850
Debug session time: Sat Apr  9 04:08:45.595 2011 (UTC - 4:00)
System Uptime: 1 days 5:50:00.000
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption
BUGCHECK_STR:  0x109
DEFAULT_BUCKET_ID:  CODE_CORRUPTION
PROCESS_NAME:  System
FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT
Bugcheck code 00000109
Arguments a3a039d8`9d63b4f9 b3b7465e`efe0844f fffff800`03450720 00000000`00000001
BiosVersion = 0503   
BiosReleaseDate = 09/28/2009
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``

BMXer · 10 Apr 2011

Wow, you guys are good. This is a new install. I had a drive failure, or so I thought, and redid everything. Its a validated and activated OS. Updating driver files now and will do the SFC scan when done.

Thanks again, I'll update when done.

BMXer · 11 Apr 2011

Drivers updated and it looks like all is good now.

Here is the NT6_BSOD Zip file.

Question ... I had the driver verify running for a day. Why does it dog the system so bad? The resources weren't that high, but it brought my system to its knees. And I have a fairy strong setup.

usasma · 12 Apr 2011

It depends on what settings you used for Driver Verifier. All settings will impact performance in one way or another - but using all of them (particularly Low Resource Simulation) will bring any system to it's knees. It's all the extra work that the system has to do to stress the drivers.

It appears that the NT6_BSOD Zip file doesn't have all the files needed. Don't worry about it for now, but if the BSOD's come back we'll have to work on getting it to work.

BMXer · 12 Apr 2011

Thanks for the help.

BMXer · 17 Apr 2011

I'm backkkk ... unfortunately

Woke up this morning with a BSOD. Ran the BSOD tool, and I think it got everything this time. While getting the file I noticed that my mouse has been a little sketchy. Its a USB wireless/infrared mouse. One part is plugged into a USB port. I was moving the mouse, it froze, like it does a lot, then the screens went crazy and blue screen came up ...

Anyway, zip attached ... is there a howto on how to read the files, or what to look for?

Thanks for any and all help ...

usasma · 17 Apr 2011

Everyone has a different way to analyze the BSOD's - here's a link to my instructions: WinDbg Analysis Report It's long and complicated - but just follow the steps and you'll get the same answers that we do.

We'll need the perfmon.html report (it wasn't included in the upload) in order to try and figure out what the Unknown USB Device is on your system:

Unknown Device USB\VID_0000&PID_0000\5&1DDA42A3&0&3 43

You've also got the infamous 2005 version of ASACPI.sys Also, it's the driver blamed by your Driver Verifier enabled memory dump from 10 Apr 2011.

Please visit the Asus website here: ASUSTeK Computer Inc.-Support- download_item_mkt
Select your OS and then expand the Utilities category.
Select "ATK0110 driver for WindowsXP/Vista/Win7 32&64-bit" (the 15th one down the list) and download/install it.

Then do this:
OLDER DRIVERS PRESENT IN THE DUMP FILES
- Create a System Restore Point prior to doing any of this. DO NOT mess with the drivers themselves - leave the Windows\System32\drivers directory alone unless we specifically direct you to it!
- Please update these drivers from the device manufacturer's website - or uninstall them from your system. Reference links are included below.
- DO NOT use Windows Update or the Update Drivers function of Device Manager.
- Please feel free to post back about any drivers that you are having difficulty locating.
- Windows Update exceptions may be noted below for Windows drivers:

Code:


amdxata.sys     Fri Mar 19 12:18:18 2010 (4BA3A3CA)
vmbus.sys       Sat Nov 20 04:57:29 2010 (4CE79B89)
winhv.sys       Sat Nov 20 04:20:02 2010 (4CE792C2)
mfehidk.sys     Wed Oct 06 15:55:49 2010 (4CACD445)
mfenlfk.sys     Wed Oct 06 15:56:13 2010 (4CACD45D)
mfewfpk.sys     Wed Oct 06 15:56:04 2010 (4CACD454)
athurx.sys      Mon Jan 04 22:23:16 2010 (4B42B0A4)
AsUpIO.sys      Sun Jul 05 22:21:38 2009 (4A515FB2)
AsIO.sys        Mon Aug 03 03:03:16 2009 (4A768BB4)
mfeavfk.sys     Wed Oct 06 15:56:49 2010 (4CACD481)
GEARAspiWDM.sys Mon May 18 08:17:04 2009 (4A1151C0)
ASACPI.sys      Wed May 13 21:25:17 2009 (4A0B72FD)
mfefirek.sys    Wed Oct 06 15:59:47 2010 (4CACD533)
mfeapfk.sys     Wed Oct 06 15:56:26 2010 (4CACD46A)
cfwids.sys      Wed Oct 06 16:00:36 2010 (4CACD564)
atikmpag.sys    Wed Jan 26 17:13:33 2011 (4D409C8D)
atikmdag.sys    Wed Jan 26 17:48:28 2011 (4D40A4BC)
ASACPI.sys      Sun Mar 27 22:30:36 2005 (42476C4C)

BSOD BUGCHECK SUMMARY

Built by: 7601.17514.amd64fre.win7sp1_rtm.101119-1850
Debug session time: Sun Apr 17 11:50:46.168 2011 (UTC - 4:00)
System Uptime: 0 days 0:29:22.991
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption
BUGCHECK_STR: 0x109
DEFAULT_BUCKET_ID: CODE_CORRUPTION
PROCESS_NAME: System
FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT
Bugcheck code 00000109
Arguments a3a039d8`9c36d568 b3b7465e`eeb3a4be fffff800`03451480 00000000`00000001
BiosVersion = 1006
BiosReleaseDate = 08/18/2010
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7601.17514.amd64fre.win7sp1_rtm.101119-1850
Debug session time: Sun Apr 17 03:32:41.623 2011 (UTC - 4:00)
System Uptime: 2 days 21:12:00.012
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption
BUGCHECK_STR: 0x109
DEFAULT_BUCKET_ID: CODE_CORRUPTION
PROCESS_NAME: System
FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_STRIDE
Bugcheck code 00000109
Arguments a3a039d8`9fd03abe b3b7465e`f24d0a14 fffff800`03450800 00000000`00000001
BiosVersion = 1006
BiosReleaseDate = 08/18/2010
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7601.17514.amd64fre.win7sp1_rtm.101119-1850
Debug session time: Sun Apr 10 14:04:49.374 2011 (UTC - 4:00)
System Uptime: 0 days 0:11:15.795
*** WARNING: Unable to verify timestamp for ASACPI.sys
*** ERROR: Module load completed but symbols could not be loaded for ASACPI.sys
Probably caused by : ASACPI.sys ( ASACPI+19a0 )
BUGCHECK_STR: 0xc9_22f
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME: System
FAILURE_BUCKET_ID: X64_0xc9_22f_VRFK_ASACPI+19a0
Bugcheck code 000000C9
Arguments 00000000`0000022f fffff880`048689a0 fffff980`738bcc60 00000000`00000000
BiosVersion = 0503
BiosReleaseDate = 09/28/2009

BMXer · 17 Apr 2011

OK ... had to do a system restore ... Looks like a video driver. Doing this fast before it crashes again/

BMXer · 18 Apr 2011

This is getting frustrating ... I added 4 gig ram several week ago ... touched one while looking for a loose usb reader connector. They were almost to hot to touch. 2x Super Talent 2 gig sticks. The other two were warm, but not to hot to touch.

Attached newest BSOD files and the perform file