BSOD Random (almost) Daily Crashes - Tested RAM, what else?

thephatp · 21 Mar 2012

I've been struggling through BSODs almost daily. Sometimes it can stay up for a couple of days, and sometimes it would crash without even doing much. I have only included 10 from this month.

Unfortunately, I cannot remember what I may have done that messed up my system other than installing new device drivers for my sound card. However, I uninstalled and then reinstalled the older drivers, but I'm still getting crashes.

Less than a week ago, Intel Storage Matrix reported that one of my disks reported a "SMART Event 0" and that my disk could fail. For the next several days, it would say the same thing every time I'd log in. I went into the settings on boot and was going to take it out of the RAID configuration, but it said I would lose all of my data, so I exited without changes. On reboot, it's magically rebuilding my RAID, with no change of hardware. Very strange.

The only other thing abnormal (other than the crashing, of course) is that my computer takes about 10 minutes to shut down, which only started after I set up my RAID 1 configuration. I've tried a number of recommendations from this forum with no help, but I did notice that the light on my DVD Driver flashes slowly (on/off) for most or all of that time. I have no idea if the two events are related.

Where am I now?

I've tested my RAM using MemTest86+. This is what I experienced:

RUN 1:

All 4 modules in motherboard, no changes
Let it run for over 3 hours
Through 1 iteration (1 pass), it reported 197 errors by the time I stopped it.

RUNs 2-5:

Tested each module individually
Ran each for about 15 minutes (yes, I know I probably should have done it longer)
NO Failures in any of the modules

RUNs 6-7

Used the first 2 modules only (in the first two slots), then Ran the last 2 modules only (in the first two slots)
Ran each configuration for about 15 minutes
No failures

RUN 8:

Put the first 2 modules back in the first two slots
Added the 3rd module to the 3rd slot
Reboot wouldn't post--I have no idea why, but I tried about 4 times, no error beeps.

RUN 9:

Left the first 2 modules in the first two slots
Swapped the 3rd module with the 4th module, (so 4th module in slot 3, slot 4 empty)
Ran for about 15 minutes
Failed on test #7

RUN 10:
Unfortunately, I can't remember the configuration for this run, but it failed again on test 7. I think I may have swapped 4th module out with 3rd again, and it posted this time and then showed errors.

RUN 11:

Put all 4 modules back in
Ran for about 1 hour
NO Failures this time

Rebooted and left it running, hoping the problem was maybe a loose module or something??
Uptime was less than a day
Crashed again (this is the newest dump in the zip file attached)

RUN 12:

Same configuration as Run 11
Ran for 3+ hours
NO Failures

UPDATE:
Quick update, I've also run the RightMarkRAMTester for almost 17 hours with no issues.

Hardware is about 2 years old. Upgraded motherboard, video card, CPU, PSU, case all at the same time. Did NOT change video card, sound card, dvd drive.

Running Windows 7 Ultimate x64, full install from MSDN download.

Any help is GREATLY appreciated. I'm lost at this point, and I don't know what to test next.

writhziden · 22 Mar 2012

Problem Devices:

Code:

GIGABYTE GBB36X Controller	PCI\VEN_197B&DEV_2363&SUBSYS_B0001458&REV_02\4&2B25BDF6&0&01E3	This device cannot start.
VMware Bridge Protocol	ROOT\LEGACY_VMNETBRIDGE\0000	This device is not present, is not working properly, or does not have all its drivers installed.
VMware Network Application Interface	ROOT\LEGACY_VMNETUSERIF\0000	This device is not present, is not working properly, or does not have all its drivers installed.
Creative AC3 Software Decoder	ROOT\LEGACY_CTAC32K\0000	This device is not present, is not working properly, or does not have all its drivers installed.

Security Software:

Code:

"C:\Program Files\Alwil Software\Avast5\avastUI.exe"

Code:


Loading Dump File [D:\Kingston\BSODDmpFiles\thephatp\Windows_NT6_BSOD_jcgriff2\032112-61729-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`03254000 PsLoadedModuleList = 0xfffff800`03498650
Debug session time: Wed Mar 21 16:02:11.906 2012 (UTC - 6:00)
System Uptime: 1 days 18:45:50.393
Loading Kernel Symbols
...............................................................
................................................................
................................................................
..
Loading User Symbols
Loading unloaded module list
..................................................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 109, {a3a039d8a1ba8516, 0, 2a6a82914853003e, 101}

Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CRITICAL_STRUCTURE_CORRUPTION (109)
This bugcheck is generated when the kernel detects that critical kernel code or
data have been corrupted. There are generally three causes for a corruption:
1) A driver has inadvertently or deliberately modified critical kernel code
 or data. See http://www.microsoft.com/whdc/driver/kernel/64bitPatching.mspx
2) A developer attempted to set a normal kernel breakpoint using a kernel
 debugger that was not attached when the system was booted. Normal breakpoints,
 "bp", can only be set if the debugger is attached at boot time. Hardware
 breakpoints, "ba", can be set at any time.
3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data.
Arguments:
Arg1: a3a039d8a1ba8516, Reserved
Arg2: 0000000000000000, Reserved
Arg3: 2a6a82914853003e, Failure type dependent information
Arg4: 0000000000000101, Type of corrupted region, can be
	0 : A generic data region
	1 : Modification of a function or .pdata
	2 : A processor IDT
	3 : A processor GDT
	4 : Type 1 process list corruption
	5 : Type 2 process list corruption
	6 : Debug routine modification
	7 : Critical MSR modification

Debugging Details:
------------------


BUGCHECK_STR:  0x109

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff800032d0d40

STACK_TEXT:  
fffff880`035bd598 00000000`00000000 : 00000000`00000109 a3a039d8`a1ba8516 00000000`00000000 2a6a8291`4853003e : nt!KeBugCheckEx


STACK_COMMAND:  kb

SYMBOL_NAME:  ANALYSIS_INCONCLUSIVE

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Unknown_Module

IMAGE_NAME:  Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP:  0

BUCKET_ID:  BAD_STACK

Followup: MachineOwner
---------

Loading Dump File [D:\Kingston\BSODDmpFiles\thephatp\Windows_NT6_BSOD_jcgriff2\031912-28111-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`02609000 PsLoadedModuleList = 0xfffff800`0284d650
Debug session time: Mon Mar 19 19:37:51.889 2012 (UTC - 6:00)
System Uptime: 0 days 0:02:36.779
Loading Kernel Symbols
...............................................................
..............................................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, 646c5, 0, 64705}

Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 00000000000646c5, page frame number
Arg3: 0000000000000000, current page state
Arg4: 0000000000064705, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_99

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  chrome.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff8000270e20c to fffff80002685d40

STACK_TEXT:  
fffff880`05eafa18 fffff800`0270e20c : 00000000`0000004e 00000000`00000099 00000000`000646c5 00000000`00000000 : nt!KeBugCheckEx
fffff880`05eafa20 fffff800`0262dc2e : 00000000`00000000 fffff680`0006b388 00000000`00000000 00000000`00000000 : nt!MiBadShareCount+0x4c
fffff880`05eafa60 fffff800`026b7137 : 00000000`00000000 fffff680`0006bff8 fffffa80`0925d060 0000021b`00000014 : nt! ?? ::FNODOBFM::`string'+0x32644
fffff880`05eafc10 fffff800`026724bf : fffffa80`00000000 00000000`0da7bfff 00000000`00000000 00000000`00000000 : nt!MiDeleteVirtualAddresses+0x41f
fffff880`05eafdd0 fffff800`02684fd3 : ffffffff`ffffffff fffff880`05eb00a0 fffff880`05eb0108 00000000`00008000 : nt!NtFreeVirtualMemory+0x61f
fffff880`05eafed0 fffff800`02681570 : fffff960`001464e0 00000000`00000001 fffff900`c00ca000 fffff900`c3058360 : nt!KiSystemServiceCopyEnd+0x13
fffff880`05eb0068 fffff960`001464e0 : 00000000`00000001 fffff900`c00ca000 fffff900`c3058360 00000000`00000000 : nt!KiServiceLinkage
fffff880`05eb0070 fffff960`0014683c : 00000000`00000000 fffff880`00000000 fffff900`c3058360 00000000`00000000 : win32k!SURFACE::bDeleteSurface+0x3c8
fffff880`05eb01c0 fffff960`00107519 : 00000000`2005054f fffff900`c3058360 00000000`0000054f 00000000`00000000 : win32k!bDeleteSurface+0x34
fffff880`05eb01f0 fffff800`02684fd3 : fffffa80`092ec060 fffff880`05eb02a0 00000000`03f40820 00000000`000301b6 : win32k!NtGdiDeleteObjectApp+0xd5
fffff880`05eb0220 00000000`74752e09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0014d9d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x74752e09


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiBadShareCount+4c
fffff800`0270e20c cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiBadShareCount+4c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4ec79dd2

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

Followup: MachineOwner
---------

Possible causes are Memory problems... Drivers...
Possible causes are Memory problems... Drivers...

I really suspect you have a bad RAM module (or two). I would recommend running Windows with just two modules and see if it is more stable. Then run with the other two modules and see if it is stable with those. Try to narrow down which modules are bad. Avoid Static Damage to Your PC when swapping modules.

You may also find Why RAID is (usually) a Terrible Idea - Puget Custom Computers interesting further reading.

thephatp · 22 Mar 2012

writhziden, thanks for the reply.

I've been running Prime95 for a few hours now with no problems, but I'll let that keep running.

Do you have any ideas as to why I would have seen a ton of failures the first time I ran Memtest86+, then an error here or there, then can't produce any errors anymore? Could it be a problem with my motherboard DIMM slots?

Regardless, I'll try limiting the RAM and see what happens.

#1
How do I update the GBB36X Controller driver? At least, how can I know it it's the right version and from a reputable source?

# 2 & 3
I don't need VMWare anymore, so I'm going to uninstall it.

# 4
Finally, how can I update or remove just the Creative AC3 Software Decoder?

Many thanks for the help!

writhziden · 22 Mar 2012

For your memtest86+ question: RAM failures can be very finicky. I do know that if you get even one error through memtest86+, it is one too many and you likely have bad RAM. It is likely that your RAM itself is bad, but you should proceed with Part 3 of Memtest86+, except I would suggest testing the RAM through Windows itself since you are having frequent enough crashes. If the system is stable with the RAM in one slot, then the module and slot are considered good. It may take more time to test, but it will not take away from your regular routine and the need for your computer.

JMICRON Technology Corp. Software Informer: Latest JMICRON Technology Corp. software updates and reviews: JMicron Fla... JMB36X should be the GGB36X controller driver. I found this from a Gigabyte forum:

Windows 7 and driver updates

You should be able to find the Creative Software Decoder through Start Menu -> Control Panel -> Uninstall a program. If you cannot, let me know and I will look into it further.

thephatp · 22 Mar 2012

writhziden said:

For your memtest86+ question: RAM failures can be very finicky. I do know that if you get even one error through memtest86+, it is one too many and you likely have bad RAM. It is likely that your RAM itself is bad, but you should proceed with Part 3 of Memtest86+, except I would suggest testing the RAM through Windows itself since you are having frequent enough crashes. If the system is stable with the RAM in one slot, then the module and slot are considered good. It may take more time to test, but it will not take away from your regular routine and the need for your computer.

You are definitely right on this--one by one is surest way to go.

writhziden said:

JMICRON Technology Corp. Software Informer: Latest JMICRON Technology Corp. software updates and reviews: JMicron Fla... JMB36X should be the GGB36X controller driver. I found this from a Gigabyte forum:

Windows 7 and driver updates

I saw that as well, but didn't know for sure if it was the right one. Not sure how bad it is if I screw it up.

writhziden said:

You should be able to find the Creative Software Decoder through Start Menu -> Control Panel -> Uninstall a program. If you cannot, let me know and I will look into it further.

The only items listed in control panel are:
- Creative ALchemy (X-Fi Edition)
- Creative Audio Control Panel
- Creative Entertainment Center
- Creative Smart Recorder
- Creative Software AutoUpdate
- Creative Sound Blaster Properties x64 Edition
- Creative System Information
- Creative WaveStudio 7

I could try launch each of them and see if I find an option for the decoder. I'll keep searching online, too.

I think the driver is "ctac32k.sys". Could it just remove it from c:\windows\system32\drivers?

Lastly, thanks for the article about RAID. I'll definitely read it. I have not been happy with my experience so far, and I've read elsewhere that it's not really a backup option because of how data can be corrupted easily on both disks, and more.

writhziden · 22 Mar 2012

thephatp said:

writhziden said:

JMICRON Technology Corp. Software Informer: Latest JMICRON Technology Corp. software updates and reviews: JMicron Fla... JMB36X should be the GGB36X controller driver. I found this from a Gigabyte forum:

Windows 7 and driver updates

I saw that as well, but didn't know for sure if it was the right one. Not sure how bad it is if I screw it up.

It is always a good idea to create a system restore point before making changes to drivers.

I would not recommend removing ctac32k.sys, but you could rename it to ctac32k.sys.bak; that way if it causes issues, you can still name it back through a command prompt in Safe Mode, or worst case: through a command prompt in the Recovery Environment.

Again, create a system restore point before changing the driver name, too. That way you have multiple methods to revert back if necessary.

thephatp · 31 Mar 2012

Quick update. I've run two different 2GB sticks alone for 2 days, then 2 sticks together for 3 days. No crashes at all. I just got a new SSD drive with a new install (and removed my sound card, because the driver installs on Win7x64 never went smoothly--just to narrow it down more), so I'm running all 4 sticks again to see if I can get a crash again. If not, I'm wondering if it is a combination of a bad stick plus other problems. I'll keep testing and report back again.

writhziden · 31 Mar 2012

Those are all good troubleshooting steps; I actually recommended similar steps for two people today. Thank you for keeping us updated as you go. :)