Random BSOD's even after fresh install

Joortje · 27 Jan 2012

Hi there,

I have build my own system in June 2011 and since the start I am experiencing random BSOD's. I usually get a lot playing World of Warcraft. But also just browsing, watching a video or even when the PC is idle.
I did a fresh install of W7 about 2 weeks ago, unfortunately this didn't solve the problem.

Included are the requested files.

Thanks in advance!

writhziden · 27 Jan 2012

Code:


Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [K:\BSODDmpFiles\Joortje\Windows_NT6_BSOD_jcgriff2\012512-10951-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03209000 PsLoadedModuleList = 0xfffff800`0344e670
Debug session time: Wed Jan 25 06:42:00.038 2012 (GMT-7)
System Uptime: 0 days 0:20:42.787
Loading Kernel Symbols
...............................................................
................................................................
............................................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {61940, 22fd3000, 84b000010991b886, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+20de3 )

Followup: MachineOwner
---------

6: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000061940, A PDE has been unexpectedly invalidated.
Arg2: 0000000022fd3000
Arg3: 84b000010991b886
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_61940

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  CurseClient.ex

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80003234d88 to fffff80003285c40

STACK_TEXT:  
fffff880`0aa12678 fffff800`03234d88 : 00000000`0000001a 00000000`00061940 00000000`22fd3000 84b00001`0991b886 : nt!KeBugCheckEx
fffff880`0aa12680 fffff800`03298dc2 : 00000000`00000046 00000000`77546001 fffff700`01080000 fffffa80`00000000 : nt! ?? ::FNODOBFM::`string'+0x20de3
fffff880`0aa126e0 fffff800`032a4e4d : 00000000`00000411 000007fe`fdf8c080 fffff700`01080000 fffff700`01080000 : nt!MiUpdateWsle+0xd2
fffff880`0aa12750 fffff800`032a453f : 41100002`0a1c2025 00000002`0a1c2121 fffffa80`035727f0 00000000`00000000 : nt!MiCompleteProtoPteFault+0x2cd
fffff880`0aa127e0 fffff800`032a3053 : 00000000`001ced0b 00000000`77546d90 fffff680`003baa30 fffffa80`0c8ceec8 : nt!MiResolveProtoPteFault+0x1cf
fffff880`0aa12870 fffff800`03292f19 : fffff880`0aa12a00 00000000`77546d90 fffff6fb`7da00000 00000000`00000000 : nt!MiDispatchFault+0x1c3
fffff880`0aa12980 fffff800`03283d6e : 00000000`00000008 00000000`77546d90 00000000`00000001 00000000`02239300 : nt!MmAccessFault+0x359
fffff880`0aa12ae0 00000000`77546d90 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`1ed8f918 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77546d90


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+20de3
fffff800`03234d88 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+20de3

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0x1a_61940_nt!_??_::FNODOBFM::_string_+20de3

BUCKET_ID:  X64_0x1a_61940_nt!_??_::FNODOBFM::_string_+20de3

Followup: MachineOwner
---------

Loading Dump File [K:\BSODDmpFiles\Joortje\Windows_NT6_BSOD_jcgriff2\012312-11856-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03268000 PsLoadedModuleList = 0xfffff800`034ad670
Debug session time: Mon Jan 23 07:41:08.693 2012 (GMT-7)
System Uptime: 0 days 0:03:59.000
Loading Kernel Symbols
...............................................................
................................................................
..............................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, 7a1cd, 0, 7a24d}

Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 000000000007a1cd, page frame number
Arg3: 0000000000000000, current page state
Arg4: 000000000007a24d, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_99

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff8000336dd7c to fffff800032e4c40

STACK_TEXT:  
fffff880`0354d5b8 fffff800`0336dd7c : 00000000`0000004e 00000000`00000099 00000000`0007a1cd 00000000`00000000 : nt!KeBugCheckEx
fffff880`0354d5c0 fffff800`0329a728 : 00000000`0007a14d fffffa80`01701e10 00000000`00000000 fffff880`03165180 : nt!MiBadShareCount+0x4c
fffff880`0354d600 fffff800`035f5c39 : fffff980`11cc0000 fffff8a0`0a3b9260 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x2ca47
fffff880`0354d8e0 fffff800`0330842b : 00000000`00080000 fffffa80`06fe4200 00000000`00000000 00000000`000c0000 : nt!CcUnmapVacb+0x5d
fffff880`0354d920 fffff800`03329a08 : 00000000`00000001 fffffa80`0c1329d0 fffffa80`08ecb900 fffffa80`0c132900 : nt!CcUnmapVacbArray+0x1bb
fffff880`0354d9b0 fffff800`0332a2fe : fffffa80`08ecb960 fffffa80`08ecb960 fffff880`03165180 fffffa80`0c132900 : nt!CcDeleteSharedCacheMap+0x154
fffff880`0354da10 fffff800`0332a938 : 00000000`00000000 fffff880`0354db18 fffffa80`0c49dc10 fffffa80`0b3998d0 : nt!CcWriteBehind+0x54e
fffff880`0354dac0 fffff800`032ef001 : fffffa80`070221b0 fffff800`035db901 fffff800`034e68c0 fffff800`00000003 : nt!CcWorkerThread+0x1c8
fffff880`0354db70 fffff800`0357ffee : b993b4e0`7699cc32 fffffa80`07094040 00000000`00000080 fffffa80`06ff61f0 : nt!ExpWorkerThread+0x111
fffff880`0354dc00 fffff800`032d65e6 : fffff880`03389180 fffffa80`07094040 fffff880`033940c0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`0354dc40 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiBadShareCount+4c
fffff800`0336dd7c cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiBadShareCount+4c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

Followup: MachineOwner
---------

Loading Dump File [K:\BSODDmpFiles\Joortje\Windows_NT6_BSOD_jcgriff2\011912-12870-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0320c000 PsLoadedModuleList = 0xfffff800`03451670
Debug session time: Thu Jan 19 15:57:00.903 2012 (GMT-7)
System Uptime: 0 days 12:59:42.974
Loading Kernel Symbols
...............................................................
................................................................
..............................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffa858cbb4dd8, 0, fffff88003e1de2f, 5}

Unable to load image \SystemRoot\system32\DRIVERS\atikmpag.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for atikmpag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmpag.sys

Could not read faulting driver name
Probably caused by : atikmpag.sys ( atikmpag+8e2f )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa858cbb4dd8, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff88003e1de2f, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000005, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800034bb100
 fffffa858cbb4dd8 

FAULTING_IP: 
atikmpag+8e2f
fffff880`03e1de2f 488b44ce28      mov     rax,qword ptr [rsi+rcx*8+28h]

MM_INTERNAL_CODE:  5

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  Wow.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88013fedfc0 -- (.trap 0xfffff88013fedfc0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=00000000afc8edae
rdx=fffffa8008e2cf40 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88003e1de2f rsp=fffff88013fee150 rbp=00000000c0000001
 r8=fffffa8007d24940  r9=0000000000000000 r10=fffff88003165ca0
r11=fffffa800eed1d00 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
atikmpag+0x8e2f:
fffff880`03e1de2f 488b44ce28      mov     rax,qword ptr [rsi+rcx*8+28h] ds:a720:00000005`7e476d98=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800032333bf to fffff80003288c40

STACK_TEXT:  
fffff880`13fede58 fffff800`032333bf : 00000000`00000050 fffffa85`8cbb4dd8 00000000`00000000 fffff880`13fedfc0 : nt!KeBugCheckEx
fffff880`13fede60 fffff800`03286d6e : 00000000`00000000 fffffa85`8cbb4dd8 fffffa80`0d0aed00 fffffa80`0eed1d00 : nt! ?? ::FNODOBFM::`string'+0x44791
fffff880`13fedfc0 fffff880`03e1de2f : fffff8a0`136ad980 fffffa80`0b021000 fffffa80`0d433390 00000000`000007ff : nt!KiPageFault+0x16e
fffff880`13fee150 fffff8a0`136ad980 : fffffa80`0b021000 fffffa80`0d433390 00000000`000007ff fffff880`00000001 : atikmpag+0x8e2f
fffff880`13fee158 fffffa80`0b021000 : fffffa80`0d433390 00000000`000007ff fffff880`00000001 fffff8a0`2e210c00 : 0xfffff8a0`136ad980
fffff880`13fee160 fffffa80`0d433390 : 00000000`000007ff fffff880`00000001 fffff8a0`2e210c00 00000000`00000000 : 0xfffffa80`0b021000
fffff880`13fee168 00000000`000007ff : fffff880`00000001 fffff8a0`2e210c00 00000000`00000000 fffff8a0`136ad980 : 0xfffffa80`0d433390
fffff880`13fee170 fffff880`00000001 : fffff8a0`2e210c00 00000000`00000000 fffff8a0`136ad980 00000000`00000000 : 0x7ff
fffff880`13fee178 fffff8a0`2e210c00 : 00000000`00000000 fffff8a0`136ad980 00000000`00000000 fffff880`06355ee3 : 0xfffff880`00000001
fffff880`13fee180 00000000`00000000 : fffff8a0`136ad980 00000000`00000000 fffff880`06355ee3 fffff8a0`0e16a720 : 0xfffff8a0`2e210c00


STACK_COMMAND:  kb

FOLLOWUP_IP: 
atikmpag+8e2f
fffff880`03e1de2f 488b44ce28      mov     rax,qword ptr [rsi+rcx*8+28h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  atikmpag+8e2f

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: atikmpag

IMAGE_NAME:  atikmpag.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ee123da

FAILURE_BUCKET_ID:  X64_0x50_atikmpag+8e2f

BUCKET_ID:  X64_0x50_atikmpag+8e2f

Followup: MachineOwner
---------

Possible causes are Memory problems... Drivers...
Possible causes are Memory problems... Drivers...
Possible causes are Memory problems... Graphics card memory problems... CMOS... Corrupted hard disk system files... Corrupted System Files... Missing Windows Updates... Drivers...

Thanks to Dave76 for help understanding possible causes.

We will start with the common problems first (see bold possible causes). Do the following steps and test after each to see if stability increases (the memory tests you can run concurrently as they will not increase stability unless you are forced to move modules around). Post back your results after each step, and if you get a blue screen crash, upload the files again and await further instructions after we are able to analyze the crash.

If you are overclocking anything, please stop.
Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).
Re-install/update your graphics card drivers using the following method.
1. Download the latest drivers for your display card(s)
2. Click Start Menu
3. Right Click My Computer/Computer
4. Click Manage
5. Click Device Manager from the list on the left
6. Expand Display adapters
7. Do the following for each adapter (in case you have multiple display cards)
  - Right click the adapter
  - Click Uninstall (do not click OK in the dialog box that pops up after hitting Uninstall)
  - Put a tick in Delete driver software for this device (if this option is available, otherwise just hit OK) and hit OK
8. Restart your computer after uninstalling drivers for all display cards
9. Install the latest driver for the display cards once Windows starts
Alternatively:
1. Login as an adminstrative user
2. Download the latest drivers for your display card(s)
3. Click Start Menu
4. Click Control Panel
5. Click Hardware and Sound
6. Click Device Manager (the last link under Devices and Printers)
7. Expand Display adapters
8. Do the following for each adapter (in case you have multiple display cards)
  - Right click the adapter
  - Click Uninstall (do not click OK in the dialog box that pops up after hitting Uninstall)
  - Put a tick in Delete driver software for this device (if this option is available, otherwise just hit OK) and hit OK
9. Restart your computer after uninstalling drivers for all display cards
10. Install the latest driver for the display cards once Windows starts
Use FurMark: VGA Stress Test, Graphics Card and GPU Stability Test, Burn-in Test, OpenGL Benchmark and GPU Temperature | oZone3D.Net to test the graphics card GPU. Then use the |MG| Video Memory Stress Test 1.7.116 Download to test your graphics card memory.
An underlying driver may be incompatible\conflicting with your system. Run Driver Verifier to find any issues. To run Driver Verifier, do the following:

a. Backup your system and user files
b. Create a system restore point
c. If you do not have a Windows 7 DVD, Create a system repair disc
d. Run Driver Verifier

If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using System Restore OPTION TWO.

Thanks to zigzag3143 for contributing to the Verifier steps.
If you are unable to start Windows with all drivers being verified or if the blue screen crashes fail to create .dmp files, run them in groups of 5 or 10 until you find a group that causes blue screen crashes and stores the blue screen .dmp files.

Joortje · 29 Jan 2012

Memtest86+ gave a lot of errors with my 2 memory banks both installed. I tested the 2 memory banks separately and one gave 0 errors and the other one hundreds (also tested in different slots).
I removed the ' bad' one now to see if this resolves the BSOD from happening.
Looking good so far..

writhziden · 29 Jan 2012

Glad you were able to narrow down a possible cause of the crashes. Best wishes for stability. :)