BSOD - ntoskrnl.exe after changing RAM. Bad RAM?

Hello,

My friend is experiencing BSOD many times since his laptop changed RAM. upgraded from 2GB to 4GB
Chances are the RAM is faulty, but I want to look deeper into the cause...

I attached the dump files. and also the output from WhoCrashed if it helps...

--------------------------------------------------------------------------------
Crash Dump Analysis
--------------------------------------------------------------------------------

Crash dump directory: C:\Windows\Minidump

Crash dumps are enabled on your computer.

On Mon 4/29/2013 4:01:36 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\042913-20092-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x80640)
Bugcheck code: 0x7F (0x8, 0x80050031, 0x6F8, 0xFFFFF80002C7F769)
Error: UNEXPECTED_KERNEL_MODE_TRAP
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This bug check indicates that the Intel CPU generated a trap and the kernel failed to catch this trap.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Mon 4/29/2013 3:18:52 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\042913-16036-01.dmp
This was probably caused by the following module: atikmdag.sys (0xFFFFF88004BB4092)
Bugcheck code: 0x50 (0xFFFFF88009001420, 0x0, 0xFFFFF88004BB4092, 0x0)
Error: PAGE_FAULT_IN_NONPAGED_AREA
Bug check description: This indicates that invalid system memory has been referenced.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: atikmdag.sys .
Google query: atikmdag.sys PAGE_FAULT_IN_NONPAGED_AREA



On Sun 4/28/2013 11:25:57 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\042913-16504-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x80640)
Bugcheck code: 0xA (0x3, 0x2, 0x1, 0xFFFFF80002C7F82F)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Sun 4/28/2013 5:38:46 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\042913-19593-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x80640)
Bugcheck code: 0x3B (0xC000001D, 0xFFFFF80002F1F21B, 0xFFFFF88002BD3090, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Sun 4/28/2013 2:38:49 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\042813-20607-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x80640)
Bugcheck code: 0xA (0xF60000, 0x2, 0x1, 0xFFFFF80002AD8B12)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Sun 4/28/2013 1:36:59 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\042813-21886-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x80640)
Bugcheck code: 0x50 (0xFFFFF80012ABAF38, 0x8, 0xFFFFF80012ABAF38, 0x2)
Error: PAGE_FAULT_IN_NONPAGED_AREA
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that invalid system memory has been referenced.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Sun 4/28/2013 12:49:32 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\042813-22261-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x80640)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF80002D5CDA3, 0xFFFFF88008572080, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.




--------------------------------------------------------------------------------
Conclusion
--------------------------------------------------------------------------------

7 crash dumps have been found and analyzed. A third party driver has been identified to be causing system crashes on your computer. It is strongly suggested that you check for updates for these drivers on their company websites. Click on the links below to search with Google for updates for these drivers:

atikmdag.sys

If no updates for these drivers are available, try searching with Google on the names of these drivers in combination the errors that have been reported for these drivers and include the brand and model name of your computer as well in the query. This often yields interesting results from discussions from users who have been experiencing similar problems.

any help will be appreciated :)

Arc said:

The crashes are either not showing anything precisely, or indicating to ATI display driver.

As you are saying that those BSODs took place after ram upgradation, test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

Also update your ATI/AMD display driver.
You can get it from the link in our forum, Latest AMD Catalyst Video Driver for Windows 7, or you may go to AMD Graphics Driver and Software and opt for Automatically Detect and Install the appropriate driver for your card.


During installation, you may opt for advanced installation, and install the display driver only, not the Catalyst Control Center.

Let us know the results.
__________________________________________________________________
BSOD ANALYSIS:

Code:

BugCheck A, {f60000, 2, 1, fffff80002ad8b12}

Probably caused by : win32k.sys ( win32k!xxxRealSleepThread+267 )

Followup: MachineOwner
--------------------------------------------------------------------------------
BugCheck 50, {fffff80012abaf38, 8, fffff80012abaf38, 2}


Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+448c6 )

Followup: MachineOwner
---------------------------------------------------------------------------------
BugCheck 3B, {c0000005, fffff80002d5cda3, fffff88008572080, 0}

Probably caused by : ntkrnlmp.exe ( nt!PspDereferenceQuotaBlock+17 )

Followup: MachineOwner
---------------------------------------------------------------------------------
BugCheck 50, {fffff88009001420, 0, fffff88004bb4092, 0}

*** WARNING: Unable to verify timestamp for atikmdag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmdag.sys

Could not read faulting driver name
Probably caused by : atikmdag.sys ( atikmdag+3a6092 )

Followup: MachineOwner
---------

I figured that I had to use memtest86+, but is it also applicable to 64 bit machine?
the "86" number makes me think that it can only run on x86 ones

If so, I had to do it myself on his lappies, so might take time to update the result here.
However, I did mdsched.exe. If I read correctly, it's Windows' default memory checking utility. Will it be sufficient?

As for the driver update, I can do it remotely I guess

ok...this happened again.
I attached the most recent dumpfile.

meanwhile, I'm about to do the memtest...will update later.

Arc said:

Please let us know when memtest is done.

Edit: It indicates to ESET Amon driver.

Code:

fffff880`02b489b0  fffff880`03caf100Unable to load image \SystemRoot\system32\DRIVERS\eamonm.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for eamonm.sys
*** ERROR: Module load completed but symbols could not be loaded for eamonm.sys
 eamonm+0x2c100

Description here: Driver Reference Table - eamonm.sys

Uninstall ESET from the uninstaller listed in Uninstallers (removal tools) for common antivirus software - ESET Knowledgebase

Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.
Download, install and update those, and then run full system scans with both of them, one by one.

does that mean ESET was the culprit?
I installed ESET on his because I use it also on my system...and I trust it

I'll download them then. appreciate the prompt reply :)

Arc said:

Yes, it indicates ESET as the failing element. But the memtest is necessary.

I also trust ESET. Used it earlier over a long time (3 years) before being a member of SevenForums. But it is the fact that sometimes ESTE causes bluescreens.

ok, here's something from the memtest...I don't know how to get the result as file, so I literally get a picture of it



So, I think the RAM is also the culprit?