Multiple BSODs, daily, usually NTOSkrnl.exe but different errors

punkonjunk · 28 Mar 2012

System:
Windows 7 ultimate x64 retail
most components are brand new, 3 months old, HDDs are a few years old except primary which is SSD from last year. One of my HDDs is old, but not used for system stuff at all, and is being replaced soon. I work from home as a remote repair dude, so needing help is a little embarrassing, I generally use whocrashed for BSODs but I cannot isolate the cause here: Reinstalled windows a month ago, still crashing like crazy. Video drivers up to date as of last week. Attached is dumps and perfmon data.
Perfmon says a disk has the dirty bit set, but that's an image of my pre-reinstall of the OS so I could get data from it readily incase anything decided to be real dumb on the reinstall. I just copied the whole system drive partition to my USB HDD, apparently that copied the dirty bit, too.

WinDBG doesn't seem to provide a lot of data whocrashed doesn't summarize, but I'm still a little dumb on dump analysis. Attached is the last week's worth of BSODs, as I recently cleared the folder because it had a lot of dumps in it. which I realize now is dumb, heh. I'm working through the BSOD analysis guide but I would really like some fast help on this, if at all possible, before I go crazy, or get canned for BSODing while in call.

Let me know if I failed to provide anything!

Jonathan_King · 28 Mar 2012

Hello,

No shame in asking for an assist, none of us are experts in everything! Stick around and you'll see we all ask questions and answer questions.

I'd think this is a hardware problem, quite frankly. Given the frequency dwm.exe and dxgkrnl.sys are mentioned, if I could only make one guess, it would be that your video card is somehow related. Possibly faulty, more likely underpowered. I'll leave it at that, as I'm assuming you can handle things from there as a technician. I'm perfectly willing to go into more detail on request, however.

My #2 guess would be the RAM. While video-related problems could certainly cause those errors, system memory has been known to do the same. I'd recommend you run the Blend Prime95 test, and perhaps run Memtest86 when you can.

Hardware - Stress Test With Prime95

RAM - Test with Memtest86+

...Summary of the dumps:

Code:


Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Debug session time: Wed Mar 28 13:43:02.971 2012 (UTC - 4:00)
System Uptime: 0 days 0:28:38.157
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for win32k.sys - 
Probably caused by : dxgkrnl.sys ( dxgkrnl!HMGRTABLE::AllocHandle+131 )
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
BUGCHECK_STR:  0x50
PROCESS_NAME:  VDeck.exe
FAILURE_BUCKET_ID:  X64_0x50_dxgkrnl!HMGRTABLE::AllocHandle+131
BiosReleaseDate = 08/18/2011
SystemProductName = System Product Name
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Debug session time: Wed Mar 28 13:13:30.873 2012 (UTC - 4:00)
System Uptime: 0 days 20:08:41.449
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for win32k.sys - 
Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+118b )
BUGCHECK_STR:  0x19_3
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
PROCESS_NAME:  dwm.exe
FAILURE_BUCKET_ID:  X64_0x19_3_nt!ExDeferredFreePool+118b
BiosReleaseDate = 08/18/2011
SystemProductName = System Product Name
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Debug session time: Tue Mar 27 17:04:07.374 2012 (UTC - 4:00)
System Uptime: 1 days 15:23:01.560
Probably caused by : memory_corruption ( nt!MiDereferencePerSessionProtos+2e )
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
BUGCHECK_STR:  0x3B
PROCESS_NAME:  dwm.exe
FAILURE_BUCKET_ID:  X64_0x3B_nt!MiDereferencePerSessionProtos+2e
BiosReleaseDate = 08/18/2011
SystemProductName = System Product Name
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Debug session time: Mon Mar 26 01:39:51.439 2012 (UTC - 4:00)
System Uptime: 9 days 18:10:19.632
Probably caused by : dxgmms1.sys ( dxgmms1!VIDMM_PROCESS_HEAP::MapViewOfAllocation+15d )
PROCESS_NAME:  dwm.exe
BUGCHECK_STR:  0x7E
DEFAULT_BUCKET_ID:  NULL_CLASS_PTR_DEREFERENCE
FAILURE_BUCKET_ID:  X64_0x7E_dxgmms1!VIDMM_PROCESS_HEAP::MapViewOfAllocation+15d
BiosReleaseDate = 08/18/2011
SystemProductName = System Product Name
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Debug session time: Fri Mar 16 07:23:31.073 2012 (UTC - 4:00)
System Uptime: 0 days 19:53:27.275
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for win32k.sys - 
Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )
BUGCHECK_STR:  0x4E_99
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
PROCESS_NAME:  dwm.exe
FAILURE_BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c
BiosReleaseDate = 08/18/2011
SystemProductName = System Product Name
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Debug session time: Thu Mar 15 11:29:22.501 2012 (UTC - 4:00)
System Uptime: 0 days 17:57:59.703
Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )
BUGCHECK_STR:  0x4E_99
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
PROCESS_NAME:  coregen.exe
FAILURE_BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c
BiosReleaseDate = 08/18/2011
SystemProductName = System Product Name
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``

punkonjunk · 28 Mar 2012

running prime95 now: this is actually really nice, this is going in my toolkit. Memtest is a bit out of the question right now, but I should be able to do that tomorrow. Originally, prior to reinstall, I suspected ram. And for a few weeks, I was experiencing very few BSODs, but it did start back up again, seems to be following or right around when I installed silverlight, which now fails removal, and fails installation. Removed with Fixit, so if that's the issue, it should be resolved.

How can I test for an underpowered video card? I'm using my apu and a XFX HD-667X-CNF3 Radeon HD 6670 2GB together for 4 monitor support.

Additionally, may be unrelated but SFC /scannow always fails at 74%. It may be unrelated, my guess is minor corruption that I can probably fix with win7 recovery console, caused by repeated BSODs. Attached is the parsed for SR logfile.

System BSOD'd while running prime95, another PAGE_FAULT_IN_NONPAGED_AREA (50) caused by dwm.exe.

EDIT:
May be relevant. Sometimes my screen sort of pukes the desktop on top of open windows for a split second, sort of just a flash, for no reason. No artifacting I can see, nothing too strange, just vanish and reappear.

Jonathan_King · 28 Mar 2012

What power supply are you using, and how old is it?

The SFC errors can probably be fixed by a simple repair install, though I doubt they're of much concern. Repair install can't hurt though.

Repair Install

Keep playing with Prime95, and try the other two tests in addition to the Blend test. Keep an eye out for Rounding Errors, which are signs of hardware malfunction.

punkonjunk · 28 Mar 2012

Small FFT: 2:21, no errors.
in place large FFT: 2 hours, no errors.
Starting the last one now, the blend test, which caused a BSOD last time, but now my system isn't busy with anything. From the description, it sounds like the blend test is the only one that tests ram heavily, which again leads me to RAM issues...

EDIT:
Blend for 4 hours and 30 minutes, no errors. after about 2 hours, I was watching shows on my rig, no issues. I'd imagine the APU and the CPU running up pretty hard on HD video and all the cores maxed to boot means it's probably not a video or CPU/APU issue. Gonna run memtest overnight.

edit again:
shutting down for memtest, got another BSOD:

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8800695b147, The address that the exception occurred at
Arg3: fffff88011fc15c8, Exception Record Address
Arg4: fffff88011fc0e20, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
atikmpag+7147
fffff880`0695b147 49397720        cmp     qword ptr [r15+20h],rsi

EXCEPTION_RECORD:  fffff88011fc15c8 -- (.exr 0xfffff88011fc15c8)
ExceptionAddress: fffff8800695b147 (atikmpag+0x0000000000007147)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff88011fc0e20 -- (.cxr 0xfffff88011fc0e20)
rax=0000000000000002 rbx=fffff8a018ed1c01 rcx=fffffa800e973240
rdx=fffffa800dda6640 rsi=fffffa800dda6640 rdi=fffff88011fc18e0
rip=fffff8800695b147 rsp=fffff88011fc1800 rbp=0000000000000000
 r8=0000000000000001  r9=fffffa800dd68bf8 r10=fffff88006b4ec30
r11=fffff8a018eba8c0 r12=0000000000000003 r13=0000000000000002
r14=0000000000000100 r15=fffa800e554a0000
iopl=0         nv up ei ng nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
atikmpag+0x7147:
fffff880`0695b147 49397720        cmp     qword ptr [r15+20h],rsi ds:002b:fffa800e`554a0020=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003110100
 ffffffffffffffff 

FOLLOWUP_IP: 
atikmpag+7147
fffff880`0695b147 49397720        cmp     qword ptr [r15+20h],rsi

BUGCHECK_STR:  0x7E

LAST_CONTROL_TRANSFER:  from fffffa800e559b60 to fffff8800695b147

STACK_TEXT:  
fffff880`11fc1800 fffffa80`0e559b60 : fffffa80`0e559b60 fffffa80`00000000 00000000`00000002 00000000`00000000 : atikmpag+0x7147
fffff880`11fc1808 fffffa80`0e559b60 : fffffa80`00000000 00000000`00000002 00000000`00000000 00000000`00000000 : 0xfffffa80`0e559b60
fffff880`11fc1810 fffffa80`00000000 : 00000000`00000002 00000000`00000000 00000000`00000000 00000000`00000000 : 0xfffffa80`0e559b60
fffff880`11fc1818 00000000`00000002 : 00000000`00000000 00000000`00000000 00000000`00000000 fffff880`06a4a038 : 0xfffffa80`00000000
fffff880`11fc1820 00000000`00000000 : 00000000`00000000 00000000`00000000 fffff880`06a4a038 fffff880`0cdb6878 : 0x2


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  atikmpag+7147

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: atikmpag

IMAGE_NAME:  atikmpag.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4f3b14b8

STACK_COMMAND:  .cxr 0xfffff88011fc0e20 ; kb

FAILURE_BUCKET_ID:  X64_0x7E_atikmpag+7147

BUCKET_ID:  X64_0x7E_atikmpag+7147

Followup: MachineOwner
---------

2: kd> lmvm atikmpag
start             end                 module name
fffff880`06954000 fffff880`069a9000   atikmpag T (no symbols)           
    Loaded symbol image file: atikmpag.sys
    Image path: \SystemRoot\system32\DRIVERS\atikmpag.sys
    Image name: atikmpag.sys
    Timestamp:        Tue Feb 14 20:13:12 2012 (4F3B14B8)
    CheckSum:         00051BFD
    ImageSize:        00055000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Figured posting the analysis for a single dump would be better than uploading. I'm pretty confused.

EDIT
Hey so, this is cool:

Looks like it's the ram. No overclocking or tweaking, at all, standard settings.

EDIT AGAIN:
2 days stable after snapping out the first stick, an hour of memtest and no errors as I was getting with it in. RMA is on it's way, I'm gonna go ahead and mark 'er solved. Thanks for the help!