BSOD after turning on laptop from hibernated state

acif · 11 Sep 2013

Hello everbody on this great place,

i experienced following problem this morning, after turning on my Dell laptop from hibernated state, last nigt i enterd hibernate on my laptop, like always i set, and when OS triedn to load suddenly on screen came BSOD with usually message about checking our hardware, software, etc.

I checked crash dump by Windbg tool, and found there error which is related to this driver - mrxsmb.sys, and this adress - mrxsmb.sys+20012

and some error about memory corruption,

mrxsmb!MRxSmbRecurrentServiceDispatcher+0x0000000000000002

X64_MEMORY_CORRUPTION_LARGE_4096

Sure that i read many threads here before posting, and googled for this type of error, and most of i found was that this driver error cause can be at some copying bigger files on network (this wasn't in my case), or with some oscilating internet speed (about this i'm not sure, cause coudl't check speed, it's happened immediately when OS came back from hibernating).

So, i hope some of gurus for debuging :) can suggest me what can be problem in my case, specially if everything till this morning worked ok, and never happened BSOD on my laptop, which is old 1 year. I'll try in meantime with updating drivers to the latest, even they are updated always at me, but i'll check once more, and i'll try with removing RAM modules, and to check them, i have 2 modules - 1x 4GB, 1x 2GB, will try use laptop with 4gb for some time, to see will bsod happens again when i enter from hibernate.

HDD i checked with HDD Tune Pro and no bad sectors or problems, with hdsentinel is same result, so HDD is in good state.

I'm not sure do i need Virtual memory - paging file if i have 6GB DDR3 RAM memory and i5 cpu, even i set to use only 4gb of hdd for virtual memory.

So i'm not sure what's here problem, paging file or ram memor, or ...

If you need adittional info post me.

Tnx!

Acif

Arc · 11 Sep 2013

Yes, there is huge mrxsmb.sys error present, but mrxsmb.sys is SMB network file ... a system element; which is not supposed to be the real reason behind the BSOD.

Daemon Tools, Alcohol 120% and Power Archiver Pro uses SCSI Pass Through Direct (SPTD), which is a well known BSOD causer. Uninstall Alcohol 120% at first. Then download SPTD standalone installer from Disk-Tools.com, and execute the downloaded file as guided below :

Double click to open it.
Click this button only:
If it is grayed out, as in the picture, there is no more SPTD in your system, and you just close the window.

Free up the startup. Windows does not need any other program to auto start with it, but the auto start programs often conflicts and causes various problems including BSODs.

Click on the Start button
Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window.
Select the “Startup” tab.
Deselect all items other than the antivirus and the touchpad driver, apoint.exe **.
Apply > OK
Accept then restart.

Now come to apoint.exe ** ..... the touchpad driver is failing there.

Code:

fffff880`0bf1bc28  fffff880`06389e84Unable to load image \SystemRoot\system32\DRIVERS\Apfiltr.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for Apfiltr.sys
*** ERROR: Module load completed but symbols could not be loaded for Apfiltr.sys
 Apfiltr+0x36e84

And it is old enough.

Code:

fffff880`06353000 fffff880`063b1000   Apfiltr  T (no symbols)           
    Loaded symbol image file: Apfiltr.sys
    Image path: \SystemRoot\system32\DRIVERS\Apfiltr.sys
    Image name: Apfiltr.sys
    Timestamp:        Thu May 12 20:58:31 2011 (4DCBFC9F)
    CheckSum:         00060344
    ImageSize:        0005E000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Update it from ALPS ELECTRIC CO., LTD .

Network related issues are also present there. Update the Intel Proset Wireless Driver for your Intel® Centrino® Wireless-N 1030...... get it from https://downloadcenter.intel.com/Det...eless&lang=eng

And, you need to remove avast! Firewall NDIS Filter Miniport; at least as a test. Uninstall Avast using Avast Uninstall Utility. Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.
Download, install and update those, and then run full system scans with both of them, one by one.

Let us know the results.
_______________________________________________________________________
BSOD ANALYSIS:

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 27, {baad0073, fffff8800bf1c8f8, fffff8800bf1c150, fffff88004bec012}

*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption

Followup: memory_corruption
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

RDR_FILE_SYSTEM (27)
    If you see RxExceptionFilter on the stack then the 2nd and 3rd parameters are the
    exception record and context record. Do a .cxr on the 3rd parameter and then kb to
    obtain a more informative stack trace.
    The high 16 bits of the first parameter is the RDBSS bugcheck code, which is defined
    as follows:
     RDBSS_BUG_CHECK_CACHESUP  = 0xca550000,
     RDBSS_BUG_CHECK_CLEANUP   = 0xc1ee0000,
     RDBSS_BUG_CHECK_CLOSE     = 0xc10e0000,
     RDBSS_BUG_CHECK_NTEXCEPT  = 0xbaad0000,
Arguments:
Arg1: 00000000baad0073
Arg2: fffff8800bf1c8f8
Arg3: fffff8800bf1c150
Arg4: fffff88004bec012

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff8800bf1c8f8 -- (.exr 0xfffff8800bf1c8f8)
ExceptionAddress: fffff88004bec012 (mrxsmb!MRxSmbRecurrentServiceDispatcher+0x0000000000000002)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000001
   Parameter[1]: 0000000000000000
Attempt to write to address 0000000000000000

CONTEXT:  fffff8800bf1c150 -- (.cxr 0xfffff8800bf1c150)
rax=0000000000000000 rbx=fffff880046fb4a8 rcx=fffff88004be8fe0
rdx=0000000000000000 rsi=fffff880046fa110 rdi=0000000000000001
rip=fffff88004bec012 rsp=fffff8800bf1cb38 rbp=0000000000000080
 r8=fffff880046fb0e0  r9=0000000000000000 r10=000000000000058b
r11=0000000000000000 r12=fffffa800c169620 r13=fffff88004bec010
r14=0000000000000000 r15=fffff80000b96000
iopl=0         nv up ei ng nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00210282
mrxsmb!MRxSmbRecurrentServiceDispatcher+0x2:
fffff880`04bec012 0000            add     byte ptr [rax],al ds:002b:00000000`00000000=??
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000001

EXCEPTION_PARAMETER2:  0000000000000000

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80004cbf100
GetUlongFromAddress: unable to read from fffff80004cbf1c0
 0000000000000000 Nonpaged pool

FOLLOWUP_IP: 
mrxsmb!MRxSmbRecurrentServiceDispatcher+2
fffff880`04bec012 0000            add     byte ptr [rax],al

FAULTING_IP: 
mrxsmb!MRxSmbRecurrentServiceDispatcher+2
fffff880`04bec012 0000            add     byte ptr [rax],al

BUGCHECK_STR:  0x27

LAST_CONTROL_TRANSFER:  from fffff880046e01b1 to fffff88004bec012

STACK_TEXT:  
fffff880`0bf1cb38 fffff880`046e01b1 : fffff880`046fb4a8 fffff880`046fb4a8 00000000`00000001 fffff880`04be8ff0 : mrxsmb!MRxSmbRecurrentServiceDispatcher+0x2
fffff880`0bf1cb40 fffff800`04d25bae : fffff880`046fb4a8 fffff880`046fb8f8 fffffa80`0c1b8b00 fffff800`04f31d00 : rdbss!RxpWorkerThreadDispatcher+0x1a1
fffff880`0bf1cc00 fffff800`04a788c6 : fffff800`04c02e80 fffffa80`05d66880 fffffa80`0644d040 fffffa80`05e51ab0 : nt!PspSystemThreadStartup+0x5a
fffff880`0bf1cc40 00000000`00000000 : fffff880`0bf1d000 fffff880`0bf17000 fffff880`0bf1c3e0 00000000`00000000 : nt!KxStartSystemThread+0x16


CHKIMG_EXTENSION: !chkimg -lo 50 -d !mrxsmb
    fffff88004bec000-fffff88004bec0bf  192 bytes - mrxsmb!__PchSym_ <PERF> (mrxsmb+0x20000)
    [ 90 90 90 90 90 90 90 90:00 00 00 00 00 00 00 00 ]
    fffff88004bec0c1-fffff88004bec0c3  3 bytes - mrxsmb!RxCeSend+11 (+0xc1)
    [ bb 0c 02:00 00 00 ]
    fffff88004bec0c5-fffff88004bec0e9  37 bytes - mrxsmb!RxCeSend+15 (+0x04)
    [ c0 4c 8b 51 20 4d 89 53:00 00 00 00 00 00 00 11 ]
    fffff88004bec0eb-fffff88004bec13b  81 bytes - mrxsmb!RxCeSend+3b (+0x26)
    [ 8b d8 eb 22 48 8b 44 24:ff 6c 68 03 00 80 80 91 ]
    fffff88004bec13d-fffff88004bec143  7 bytes - mrxsmb!RxCeSend+8d (+0x52)
    [ 48 8b 49 18 e8 6a 46:ff ff ff a0 eb 30 00 ]
    fffff88004bec146-fffff88004bec1bb  118 bytes - mrxsmb!RxCeSend+96 (+0x09)
    [ 90 8b c3 48 83 c4 40 5b:ff ff 10 00 00 00 00 00 ]
    fffff88004bec1be-fffff88004bec1c0  3 bytes - mrxsmb!VctSend+5e (+0x78)
    [ ba 17 00:ff ff 10 ]
    fffff88004bec1c3-fffff88004bec1cb  9 bytes - mrxsmb!VctSend+63 (+0x05)
    [ 4c 8b cf c7 44 24 20 0c:00 00 00 00 00 00 00 00 ]
    fffff88004bec1cd-fffff88004bec1d6  10 bytes - mrxsmb!VctSend+6d (+0x0a)
    [ c0 e8 55 4c ff ff 81 fb:00 00 00 03 00 00 00 08 ]
    fffff88004bec1d8-fffff88004bec228  81 bytes - mrxsmb!VctSend+78 (+0x0b)
    [ 00 74 18 48 85 ff 74 0e:30 30 30 30 30 30 30 35 ]
    fffff88004bec22c-fffff88004bec258  45 bytes - mrxsmb!MRxSmbFsdDispatch+20 (+0x54)
    [ 48 8b da 48 8b f1 41 b4:00 00 00 00 08 00 00 00 ]
    fffff88004bec25a-fffff88004bec278  31 bytes - mrxsmb!MRxSmbFsdDispatch+4e (+0x2e)
    [ ba 1a 00 00 00 4c 8b ce:ff ff 76 6b 04 00 04 00 ]
    fffff88004bec27b-fffff88004bec27e  4 bytes - mrxsmb!MRxSmbFsdDispatch+6f (+0x21)
    [ 74 07 bf 10:ff 76 6b 04 ]
    fffff88004bec280-fffff88004bec298  25 bytes - mrxsmb!MRxSmbFsdDispatch+74 (+0x05)
    [ 00 c0 eb 54 80 7d 00 17:12 00 00 00 98 82 91 01 ]
    fffff88004bec29a-fffff88004bec2a0  7 bytes - mrxsmb!MRxSmbFsdDispatch+8e (+0x1a)
    [ 15 e9 9d ff ff 80 7d:ff ff 64 00 69 00 73 ]
    fffff88004bec2a2-fffff88004bec2b1  16 bytes - mrxsmb!MRxSmbFsdDispatch+96 (+0x08)
    [ 1b 75 0d 48 8b cb 45 32:6b 00 2e 00 69 00 6e 00 ]
    fffff88004bec2b3-fffff88004bec2d4  34 bytes - mrxsmb!MRxSmbFsdDispatch+a7 (+0x11)
    [ 15 d8 9d ff ff 85 ff 75:ff 76 6b 0a 00 1a 00 00 ]
    fffff88004bec2d6-fffff88004bec323  78 bytes - mrxsmb!MRxSmbFsdDispatch+ca (+0x23)
    [ 74 13 48 83 63 38 00 33:37 00 e0 ff ff ff 64 00 ]
    fffff88004bec325-fffff88004bec37e  90 bytes - mrxsmb!MRxSmbDeallocateForFobx+15 (+0x4f)
    [ 15 de 9f ff ff 48 83 63:ff ff ff a0 eb 30 00 ff ]
    fffff88004bec380-fffff88004bec3b8  57 bytes - mrxsmb!VctpTearDownEndpoint+10 (+0x5b)
    [ 00 00 8b f8 48 8b 0d 85:a0 eb 30 00 ff ff ff ff ]
    fffff88004bec3bc-fffff88004bec3d1  22 bytes - mrxsmb!VctpTearDownEndpoint+4c (+0x3c)
    [ 00 74 14 48 8b 4b 68 48:01 00 63 00 54 79 70 65 ]
    fffff88004bec3d3-fffff88004bec3de  12 bytes - mrxsmb!VctpTearDownEndpoint+63 (+0x17)
    [ 48 8b 4b 20 48 85 c9 74:00 e8 83 91 01 03 00 00 ]
    fffff88004bec3e0-fffff88004bec3e6  7 bytes - mrxsmb!VctpTearDownEndpoint+70 (+0x0d)
    [ 00 48 8b 8b 48 01 00:44 61 74 61 5c 00 62 ]
    fffff88004bec3e8-fffff88004bec3fa  19 bytes - mrxsmb!VctpTearDownEndpoint+78 (+0x08)
    [ 48 85 c9 74 10 33 d2 ff:e0 ff ff ff 64 00 69 00 ]
    fffff88004bec3fc-fffff88004bec402  7 bytes - mrxsmb!VctpTearDownEndpoint+8c (+0x14)
    [ 00 48 8b 8b 50 01 00:74 00 61 00 6c 00 6c ]
    fffff88004bec404-fffff88004bec408  5 bytes - mrxsmb!VctpTearDownEndpoint+94 (+0x08)
    [ 48 85 c9 74 0e:00 00 61 00 d8 ]
    fffff88004bec40a-fffff88004bec41c  19 bytes - mrxsmb!VctpTearDownEndpoint+9a (+0x06)
    [ 15 c9 9c ff ff 48 83 a3:ff ff 76 6b 0d 00 08 00 ]
    fffff88004bec41e-fffff88004bec453  54 bytes - mrxsmb!VctpTearDownEndpoint+ae (+0x14)
    [ 48 85 c9 74 10 33 d2 ff:5c 00 49 6e 66 53 65 63 ]
    fffff88004bec455-fffff88004bec472  30 bytes - mrxsmb!RxCeTearDownVC+5 (+0x37)
    [ 48 89 4c 24 08 57 48 83:81 91 01 01 00 00 00 00 ]
    fffff88004bec474-fffff88004bec4ab  56 bytes - mrxsmb!RxCeTearDownVC+24 (+0x1f)
    [ 75 32 48 8b 4b 60 48 85:ff ff ff ff 10 00 00 00 ]
    fffff88004bec4ad-fffff88004bec4cf  35 bytes - mrxsmb!RxCeTearDownVC+5d (+0x39)
    [ 74 08 48 8b cb e8 89 1e:80 8c a3 c5 94 c6 01 87 ]
    fffff88004bec4d3-fffff88004bec4f3  33 bytes - mrxsmb!RxCeTearDownVC+83 (+0x26)
    [ 8b c7 48 8b 5c 24 58 48:00 40 84 91 01 00 00 00 ]
    fffff88004bec4f5-fffff88004bec4ff  11 bytes - mrxsmb!SmbMmFreeServerTransport+5 (+0x22)
    [ 90 90 90 90 90 90 90 48:ff ff ff 00 00 00 00 00 ]
    fffff88004bec501-fffff88004bec509  9 bytes - mrxsmb!RxCeInitiateVCDisconnect+5 (+0x0c)
    [ 53 48 83 ec 40 83 64 24:00 00 00 08 00 00 00 00 ]
    fffff88004bec50b-fffff88004bec50c  2 bytes - mrxsmb!RxCeInitiateVCDisconnect+f (+0x0a)
    [ b8 01:00 08 ]
    fffff88004bec510-fffff88004bec52a  27 bytes - mrxsmb!RxCeInitiateVCDisconnect+14 (+0x05)
    [ 87 41 0c 83 f8 01 74 78:30 30 30 30 30 30 30 30 ]
    fffff88004bec52c-fffff88004bec536  11 bytes - mrxsmb!RxCeInitiateVCDisconnect+30 (+0x1c)
    [ ff 8b 5c 24 30 eb 61 48:76 6b 04 00 04 00 00 80 ]
    fffff88004bec538-fffff88004bec544  13 bytes - mrxsmb!RxCeInitiateVCDisconnect+3c (+0x0c)
    [ 74 56 48 83 79 58 ff 74:03 00 00 00 01 00 6f 00 ]
    fffff88004bec546-fffff88004bec568  35 bytes - mrxsmb!RxCeInitiateVCDisconnect+4a (+0x0e)
    [ 00 48 8b d1 48 8b 49 20:5c 00 e0 ff ff ff 76 6b ]
    fffff88004bec56b-fffff88004bec5eb  129 bytes - mrxsmb!RxCeInitiateVCDisconnect+6f (+0x25)
    [ 48 3b c8 74 24 f6 41 2c:ff 2e 00 4e 00 54 00 00 ]
    fffff88004bec5ee-fffff88004bec5f0  3 bytes - mrxsmb!MRxSmbFinalizeNetRoot+3e (+0x83)
    [ ba 0a 00:ff ff 10 ]
    fffff88004bec5f3-fffff88004bec607  21 bytes - mrxsmb!MRxSmbFinalizeNetRoot+43 (+0x05)
    [ 4c 8b cf 48 89 5c 24 20:00 00 00 00 00 00 00 00 ]
    fffff88004bec609-fffff88004bec67e  118 bytes - mrxsmb!MRxSmbFinalizeNetRoot+59 (+0x16)
    [ 00 48 83 67 18 00 48 8b:30 30 30 30 30 30 39 a8 ]
    fffff88004bec680-fffff88004bec699  26 bytes - mrxsmb!SmbCepDereferenceTransport+50 (+0x77)
    [ 89 5c 24 28 45 89 43 a8:04 00 00 80 12 00 00 00 ]
    fffff88004bec69c-fffff88004bec6a0  5 bytes - mrxsmb!SmbCepDereferenceTransport+6c (+0x1c)
    [ 85 db 0f 85 81:76 6b 04 00 14 ]
    fffff88004bec6a4-fffff88004bec6b8  21 bytes - mrxsmb!SmbCepDereferenceTransport+74 (+0x08)
    [ 48 8b cf e8 14 28 ff ff:b8 86 91 01 03 00 00 00 ]
    fffff88004bec6ba-fffff88004bec6d0  23 bytes - mrxsmb!SmbCepDereferenceTransport+8a (+0x16)
    [ 48 3b d8 74 16 e8 dc 0b:ff ff 4d 00 69 00 63 00 ]
    fffff88004bec6d2-fffff88004bec6e0  15 bytes - mrxsmb!SmbCepDereferenceTransport+a2 (+0x18)
    [ 40 b6 01 80 7f 3c 00 75:ff ff 76 6b 0e 00 08 00 ]
    fffff88004bec6e3-fffff88004bec6f8  22 bytes - mrxsmb!SmbCepDereferenceTransport+b3 (+0x11)
    [ 48 8b cf e8 21 5d 00 00:00 01 00 74 00 44 72 69 ]
    fffff88004bec6fb-fffff88004bec708  14 bytes - mrxsmb!SmbCepDereferenceTransport+cb (+0x18)
    [ 48 8b 4f 30 48 85 c9 74:ff 00 80 8c a3 c5 94 c6 ]
WARNING: !chkimg output was truncated to 50 lines. Invoke !chkimg without '-lo [num_lines]' to view  entire output.
3494 errors : !mrxsmb (fffff88004bec000-fffff88004becffe)

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  LARGE_4096

STACK_COMMAND:  .cxr 0xfffff8800bf1c150 ; kb

FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_LARGE_4096

BUCKET_ID:  X64_MEMORY_CORRUPTION_LARGE_4096

Followup: memory_corruption
---------

acif · 11 Sep 2013

Thank you very much for fast response and all your suggestions! To introdouce a little be myself, like you saw from 1st post i'm not totally noob :) at all, i work in IT for 10-12 years, and had some experience, maybe not well in debuging, but not bad with knowing hardware and software and their communication, sure that i know about msconfig and using console else, sure that i did that before posting here, that disabled all unecessary startup services and processses, and by using services.msc i disabled some of uncessary services, and sure that know that some of startup services-processes can conflict one with other, and make problems and BSOD.

This never happened in 1 year using, even Alcohol was installed before 10 months and i used it in past, and SPTD was disabled from startup runing, and using Avast 8 like AV no problems, and Avast FW no problem in using last 3-4 months, so i doubt these two things could make problems, but sure never can say 100% sure...

Before i did things you suggested i tried 1-2x hibernate laptop and then turn on, and no BSOD, so for now was ok without things you suggested.

Then i did things you suggested,

1. Alcohol - unistalled

2. SPTD - unistalled

3. Alps touchpad driver - latest from Dell support page A05, same like i had previously, i just reinstalled them once more, to be sure that reinstalling can repair if some corrupted driver files were in win folder,

Driver Details | Dell US

no drivers on Alps website, and no newer on Dell support website,

ALPS ELECTRIC CO., LTD

5. Intel Proset Wireless Driver - latest installed - 15.1.2013 date of drivers

I did analizing of crash dump with Windbg debuging tool, same like you posted, and saw that error on the end about "memory corruption"

MODULE_NAME: memory_corruption IMAGE_NAME: memory_corruption FOLLOWUP_NAME: memory_corruption DEBUG_FLR_IMAGE_TIMESTAMP: 0 MEMORY_CORRUPTOR: LARGE_4096 STACK_COMMAND: .cxr 0xfffff8800bf1c150 ; kb FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_LARGE_4096 BUCKET_ID: X64_MEMORY_CORRUPTION_LARGE_4096 Followup: memory_corruption ---------

so i'm not sure what can lead this? And about error reported by mrxsmb.sys driver, cause in whole dump there is some errors adresses to mrxsmb.sys and some communication with it... So what can be problem with mrxsmb.sys, and is there something what i need to do to fix problem with "memory corruption" and mrxsmb.sys?

Thanks!

Arc · 11 Sep 2013

acif said:

I did analizing of crash dump with Windbg debuging tool, same like you posted, and saw that error on the end about "memory corruption"

MODULE_NAME: memory_corruption IMAGE_NAME: memory_corruption FOLLOWUP_NAME: memory_corruption DEBUG_FLR_IMAGE_TIMESTAMP: 0 MEMORY_CORRUPTOR: LARGE_4096 STACK_COMMAND: .cxr 0xfffff8800bf1c150 ; kb FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_LARGE_4096 BUCKET_ID: X64_MEMORY_CORRUPTION_LARGE_4096 Followup: memory_corruption ---------

so i'm not sure what can lead this? And about error reported by mrxsmb.sys driver, cause in whole dump there is some errors adresses to mrxsmb.sys and some communication with it... So what can be problem with mrxsmb.sys, and is there something what i need to do to fix problem with "memory corruption" and mrxsmb.sys?

Thanks!

That memory corruption may be a failing RAM ..... but most probably it is a driver passing bar information to the memory. Avast causes it frequently. SPTD causes it more frequently. So at first we need to remove those usual suspects. If still the memory corruptions occur, we will go for testing the physical RAM :)

You are in IT for more than my total computing life :) What can I say to you that you dont know ... just lest you overlook it .... mrxsmb.sys errors are accompanied by tcpip.sys and NETIO.sys errors .... which indicates network malfunctioning. Two possible causes are present there. Intel Procet that is backdated (now updated) and Avast firewall (a regular network blocker; the free version seldom does it).

Based on those two reasons, I suggested you to uninstall Avast.

You also know that none of the startup entries are necessary. Still we keep the antivirus there, just for the protection purpose :)

About the Alps touchpad .... I think Dell usually use Syneptecs. My experience is really not very vast .... Dell with Alps touchpad is not a regular scenario to me. Whatever it may be, touchpad drivers also never fail usually; but if it fails, we need to first update the drivers. As the drivers are up to date, the next attempt should be a clean startup. So removing all bur antivirus from startup is necessary there, at least as a test.

If you want, you may test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

My plan was to suggest you for memtest, if the memory corruptions continue to occur.

All the best :)

acif · 11 Sep 2013

Yes, i thoug same, that maybe begining of failing RAM, even it's not so much used, like i mentione previously 1 year :), but that doesn't mean sure that failing can happen :), cause RAM can become corrupted from another thing, like oscilating electricity, or physically damaging, etc. , aha it can be driver related to memory corruption then.

Yeah, like you told, maybe firstly to remove these 2 doubts-sptd and avast, and then testin RAM, i'll remove avast, even i hate to remove AV :), you know reinstalling and updating to latest AV DB :)...

Hehehe, at all maybe seriously 7-8 years, rest was my begining :), but sure maybe not included like you seriously in analyzing hardware and software :), i work in another IT area, but however, i can understand at all what you want to say and help me :).

Yeah, i know that it can be related to network mrxsmb.sys and tcpip.sys, and problems with network. To be honest, i missed to post info that before 1-2 days i installed 2 keyloggers on my laptop - Elite Keylogger and KGB Keylogger, for some my private needs, i'm not sure could these 2 app cause some problems at network settings... One thing i'm sure it happened when OS wake up from hibernation, even in past often my laptop is hibernated, to make faster loading OS :).

Ok, Interl Pro Wireless drivers now are updated to latest, and AV will unistall, i didn't use free Avast 8, but Avast 8 Pro version.
Yeah, i'm freak for startup processes and speeding up loading OS :), i always remove from startup unecessary processes. Yeah, AV will leave, i'll install Microsoft Essentials for checking about this problem, even i'm not sure how well MS essentials protect my OS :), but with Avast 8 Pro sure i'm not 100% secured, even i don't care much, cause i know to fight with malwares :) and know where and what i do with my OS.

Yeah, bur for this Inspiron N5110 is Alps touchpad

, i used in past Synaptics and good experience... Yeah, i have latest Alps drivers, at all this touchpad works ok, never had problems, like blocking or glitch, it works pretty good.

Yeah i know that testing RAM memory will take hours :), specially cause i have 6GB :), i know about memtest tool, sure i downloaded and if BSOD start to appear, i'll test RAM like last option :), cause hate much waiting, but will start it at night to finidh when i wake up :).

For now i'll remove AVAST 8 PRO, and will leave OS to work like previously, and will test it 4-5 days, if no problems, i'll mark this thread like solved :), otherwise will ask for new suggestion hehe, and will test RAM.

Once big tnx, all the best you too

!

Arc · 11 Sep 2013

OK, let us know how everything went :) And about the memtest, too :)

acif · 18 Sep 2013

Hello Arc,

for now OS is stable, no BSOD anymore, i didn't unistall Avast Pro 8 AV, left it active, just to see will be there any problem at booting from hibernate state, and situation was ok last 5-6 days, so i can confirm it's ok, after reinstalling some of driver to the latest, and after unistallin sptd and alcohol, only Avast Pro 8 AV i didn't unistall.

And i tested RAM memory with memtest86- 2 modules of Samsund DDR3, 1x 2GB, and another 1x 4GB, after 8-9 hours working of memtest86, there wasn't any notification about error in RAM memory, 8 pass test was performed like you suggested, even 9. IS this normal that this take 8-9 hours working on testing 6GB RAM DDR3 memory, cause i think somewhere read 3-4 hours, maybe 3-4 hours for 2-3 GB RAM?

Once tnx for your support!

Greetzz!

Arc · 18 Sep 2013

Memtest took the due time there, nothing to be worried :) With the increment of the RAM volume, the time taken also increases :)

As it is stable for a reasonable time, you may keep avast there :) .... I had no direct proof against avast, I suggested the uninstallation as a test only. Now, I think that test is no more required.

For any further issue, let us know :) And, if you share your knowledge and experience with us on the board of SevenForums, that will be great

acif · 19 Sep 2013

Sure i'll try to be more active, as my obligations allow me :).