BSOD after changing from 4GB to 8GB SODIMM RAM

I did notice the other dump files, but this particular file was the most interesting:

Code:

BugCheck D6, {fffff98008933000, 0, fffff8800643feb9, 0}

*** WARNING: Unable to verify timestamp for uxpatch.sys
*** ERROR: Module load completed but symbols could not be loaded for uxpatch.sys

Could not read faulting driver name
Probably caused by : uxpatch.sys ( uxpatch+1eb9 )

Code:

Usual causes:  Device driver

The driver has referenced memory beyond it's current pool allocation, and then created a illegal page fault by referencing invalid memory addresses. This is buffer overrun situation.

Code:

kd> lmvm uxpatch
start             end                 module name
fffff880`0643e000 fffff880`06448000   uxpatch  T (no symbols)           
    Loaded symbol image file: uxpatch.sys
    Image path: \??\C:\Windows\system32\drivers\uxpatch.sys
    Image name: uxpatch.sys
    Timestamp:        Mon Jul 13 06:09:18 2009 (4A5AC17E)
    CheckSum:         00013F48
    ImageSize:        0000A000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

The driver seems to belong to a program called Within Network, please update the driver from here - UxStyle - no more patching.

Code:

kd> k
Child-SP          RetAddr           Call Site
fffff880`02f892f8 fffff800`02f43be0 nt!KeBugCheckEx
fffff880`02f89300 fffff800`02ec3d2e nt! ?? ::FNODOBFM::`string'+0x4518f
fffff880`02f89460 fffff880`0643feb9 nt!KiPageFault+0x16e
fffff880`02f895f0 00000000`c0000023 uxpatch+0x1eb9
fffff880`02f895f8 ffffffff`80000318 0xc0000023
fffff880`02f89600 fffff880`064423e0 0xffffffff`80000318
fffff880`02f89608 fffff800`02ec144f uxpatch+0x43e0
fffff880`02f89610 00000000`00000010 nt!KiIdleLoop+0x15f
fffff880`02f89618 fffff880`02f89648 0x10
fffff880`02f89620 fffff880`001c001a 0xfffff880`02f89648
fffff880`02f89628 fffff880`06440c30 0xfffff880`001c001a
fffff880`02f89630 00000000`00000086 uxpatch+0x2c30
fffff880`02f89638 fffff880`06440081 0x86
fffff880`02f89640 fffff880`064423e0 uxpatch+0x2081
fffff880`02f89648 fffff880`00000010 uxpatch+0x43e0
fffff880`02f89650 fffff880`064423e8 0xfffff880`00000010
fffff880`02f89658 00000000`00000000 uxpatch+0x43e8

You can disable Driver Verifier now if you haven't done so.

I have disabled driver verifier and deleted uxpatch.sys already,
but BSOD still persists and I am unsure why.

I have attached the latest dump.

Code:

BugCheck BE, {fffff8a00cf6e5b8, af300001a8a4b822, fffff88009427660, e}

Probably caused by : fileinfo.sys ( fileinfo!FIStreamLogForNL+7b )

Code:

Usual causes:  Device driver, Memory

Code:

kd> !pte af300001a8a4b822
                                           VA af300001a8a4b822
PXE at FFFFF6FB7DBED000    PPE at FFFFF6FB7DA00030    PDE at FFFFF6FB40006A28    PTE at FFFFF68000D45258
Unable to get PXE FFFFF6FB7DBED000
WARNING: noncanonical VA, accesses will fault !

It seems that a device driver has referenced, and then attempted to write to a read only section of memory. We can see from the PTE, that the virtual address was non-canonical, being that the address was invalid.

Code:

kd> lmvm atikmdag
start             end                 module name
fffff880`04844000 fffff880`05000000   atikmdag T (no symbols)           
    Loaded symbol image file: atikmdag.sys
    Image path: \SystemRoot\system32\DRIVERS\atikmdag.sys
    Image name: atikmdag.sys
    Timestamp:        Mon Sep 20 02:47:42 2010 (4C96BD3E)
    CheckSum:         0076D892
    ImageSize:        007BC000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Your AMD graphics card driver seems to be causing problems, please update the driver from here - AMD Graphics Drivers & Software

WHQL
Release Date: April 24th 2013
Version: 13.4
In Device Manager: 12.104

Code:

BugCheck 1000007E, {ffffffffc0000005, fffff88005d8f446, fffff88002d5f7e8, fffff88002d5f040}

Probably caused by : AtihdW76.sys ( AtihdW76+4446 )

Code:

kd> lmvm AtihdW76
start             end                 module name
fffff880`05d8b000 fffff880`05da7000   AtihdW76 T (no symbols)           
    Loaded symbol image file: AtihdW76.sys
    Image path: \SystemRoot\system32\drivers\AtihdW76.sys
    Image name: AtihdW76.sys
    Timestamp:        Thu Feb 14 22:11:09 2013 (511D60FD)
    CheckSum:         00019F88
    ImageSize:        0001C000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Your ATI Function Driver for HD Audio Service seems to be causing problems, please update the driver from here - Support & Drivers

---------------------------------------------------------------------------

Code:

BugCheck 24, {1904fb, fffff8800297ad38, fffff8800297a590, fffff880012f9c11}

Probably caused by : Ntfs.sys ( Ntfs!NtfsFindPrefix+121 )

Code:

Usual causes:  Disk corruption, insufficient physical memory, Device driver, Indexing, Resident antivirus, backup, defrag programs, Disk/Drive failing/failure

Code:

EXCEPTION_RECORD:  fffff8800297ad38 -- (.exr 0xfffff8800297ad38)
ExceptionAddress: fffff880012f9c11 (Ntfs!NtfsFindPrefix+0x0000000000000121)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

If we compare the two dump files, the type of exception which occurred, is exactly the same, a driver has referenced and accessed a invalid memory address. The function call which caused the exception in this case is the Ntfs!NtfsFindPrefix, which is used to find the file path for a particular file or directory. The file may have already been in memory, but the memory address was inaccessible.

I would update or remove the driver from the other dump, and then run Driver Verifier again.

My uncle has had the same problem after he upgraded he's ram,
so has my dad and here is my uncles dump:

Code:

BugCheck 1000007E, {ffffffffc0000005, fffff880046a8eba, fffff880009e19e8, fffff880009e1240}

Probably caused by : hardware ( usbhub!UsbhFdoPower_PowerSequence+26 )

Code:

EXCEPTION_RECORD:  fffff880009e19e8 -- (.exr 0xfffff880009e19e8)
ExceptionAddress: fffff880046a8eba (usbhub!UsbhFdoPower_PowerSequence+0x0000000000000026)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000001
   Parameter[1]: 000000000038b841
Attempt to write to address 000000000038b841

The address is non-paged pool, and is a similar issue to your dump files.

I would recommend running Driver Verifier on your Uncle's laptop too, since there appears to quite few power related IRP calls within the call stack.

I would recommend checking for any BIOS updates, which will usually resolve hardware compatibility problems, which also raises the question of have you checked the RAM is compatible and supported by the motherboard?

Code:

TOSHIBA 1.60, 2/03/2010

What are the results from my suggestion for your computer?

Code:

BugCheck A, {fffff80003372958, 2, 0, fffff8000309f242}

Probably caused by : ntkrnlmp.exe ( nt!RtlDispatchException+122 )

Code:

Usual causes:  Kernel mode driver, System Service, BIOS, Windows, Virus scanner, Backup tool, compatibility

Code:

2: kd> !thread
GetPointerFromAddress: unable to read from fffff800032ad000
THREAD fffffa800a1d2b50  Cid 0288.029c  Teb: 000007fffffdc000 Win32Thread: fffff900c0adac20 RUNNING on processor 2
IRP List:
    Unable to read nt!_IRP @ fffff98002df6b80
Not impersonating
GetUlongFromAddress: unable to read from fffff800031ecba4
Owning Process            fffffa800a1b4960       Image:         winlogon.exe
Attached Process          N/A            Image:         N/A
fffff78000000000: Unable to get shared data
Wait Start TickCount      3625         
Context Switch Count      719            IdealProcessor: 0                 LargeStack
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime                  00:00:00.000
KernelTime                00:00:00.000
Win32 Start Address 0x000000007758fbc0
Stack Init fffff88002a99d10 Current fffff88002a98ea0
Base fffff88002a9b000 Limit fffff88002a92000 Call fffff88002a99d60
Priority 14 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5

Code:

2: kd> lmvm WRkrn
start             end                 module name
fffff880`0103d000 fffff880`0105b000   WRkrn    T (no symbols)           
    Loaded symbol image file: WRkrn.sys
    Image path: \SystemRoot\System32\drivers\WRkrn.sys
    Image name: WRkrn.sys
    Timestamp:        Wed Jul 31 19:34:53 2013 (51F958CD)
    CheckSum:         0002A79F
    ImageSize:        0001E000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

The Webroot SecureAnywhere Essentials driver/Webroot SecureAnywhere Anti-virus driver seems to be causing problems, please remove the program completely with Revo Uninstaller Pro - Uninstall Software, Remove Programs easily, Forced Uninstall, Leftovers Uninstaller (couldn't find a removal tool), and then install and run full scans with these free and proven alternatives which work best with the operating system due to compatibility and lightweight nature on system resources.

Install and perform full scans with:

• Malwarebytes : Free anti-malware download
• Microsoft Security Essentials | Protect against viruses, spyware, and other malware

   Information

Remember to install the free version of Malwarebytes not the free trail; untick the free trial box during installation. MSE is the most lightweight and compatible with the Windows 7 operating system

You can also view this thread for a complete free and lightweight security protection combination:

• Good and Free system security combination.