BSOD Random but Linked to NTOSKRNL Failure

traderyoda · 07 Sep 2014

Arc...

Performed each recommended step and now running MSE w/MBAM. Driver Verifier off and bye-bye to Avast! using Avastclear. The result: 24hrs under several large file transfers with no BSODs! I think you nailed the problem. I should have been suspicious of Avast!. An automatic update a few months ago caused mysterious problems with my Squeezecenter music server setup - it took hours to identify Avast! as the source of the problem. If Avast! turns out to be the problem again it's use as an anti-virus package is questionable.

I will leave the machine running and under various loads for another 24 hours to see where things wind up.

Your assistance is very much appreciated and I've learned a lot - THANKS!

TY

Arc · 07 Sep 2014

You are welcome. Let us know about any further issue.

traderyoda · 09 Sep 2014

Greeting Arc,

Well... all I can say is you rock... I've loaded this computer up running video games, transferring large files back and forth, etc. - zero BSODs. I think you hit the nail on the head regarding Avast! It's problematic software.

I hope this ordeal helps others down the line!

The time you took to help is a pretty cool thing - thanks to you and the Forum for saving my sanity!

Cheers
TY

Arc · 10 Sep 2014

Good news.

Let us know for any further BSOD.

traderyoda · 10 Sep 2014

Arc... I was just about to write that we could mark this case closed. The machine has been very stable for days after being pushed pretty hard. I opened a browser to answer your last message and !bang!... another BDOD - 0x50 again. Dump file is attached.

Nothing has been changed on the computer - no software added other that a few Windows 7 updates. About the only issue I've noticed has been a few crashes of MS Office software, and crashes of a Logitech software player called Squeezeplay that is integrated into my home's Squeezecenter music server.

Cheers,
TY

Arc · 10 Sep 2014

I would suggest you to run Driver Verifier for one more time.

Code:

.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff80022ed61e3, 8, fffff80022ed61e3, 2}


Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+43836 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff80022ed61e3, memory referenced.
Arg2: 0000000000000008, value 0 = read operation, 1 = write operation.
Arg3: fffff80022ed61e3, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000002, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003106100
GetUlongFromAddress: unable to read from fffff800031061c0
 fffff80022ed61e3 Nonpaged pool

FAULTING_IP: 
+1ced260
fffff800`22ed61e3 ??              ???

MM_INTERNAL_CODE:  2

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre

TRAP_FRAME:  fffff8800bd27840 -- (.trap 0xfffff8800bd27840)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa80091f9570 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000003 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80022ed61e3 rsp=fffff8800bd279d0 rbp=0000000000000000
 r8=fffff80002e59000  r9=0000000000000000 r10=fffffffffffffffb
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
fffff800`22ed61e3 ??              ???
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002f4b5e4 to fffff80002ecebc0

FAILED_INSTRUCTION_ADDRESS: 
+1ced260
fffff800`22ed61e3 ??              ???

STACK_TEXT:  
fffff880`0bd276d8 fffff800`02f4b5e4 : 00000000`00000050 fffff800`22ed61e3 00000000`00000008 fffff880`0bd27840 : nt!KeBugCheckEx
fffff880`0bd276e0 fffff800`02ecccee : 00000000`00000008 fffff800`22ed61e3 00000000`00000000 000001fd`f94045d1 : nt! ?? ::FNODOBFM::`string'+0x43836
fffff880`0bd27840 fffff800`22ed61e3 : fffff8a0`032b4060 00000000`00d5f1a8 00000000`00000067 00000000`00000000 : nt!KiPageFault+0x16e
fffff880`0bd279d0 fffff8a0`032b4060 : 00000000`00d5f1a8 00000000`00000067 00000000`00000000 00000000`00000000 : 0xfffff800`22ed61e3
fffff880`0bd279d8 00000000`00d5f1a8 : 00000000`00000067 00000000`00000000 00000000`00000000 00000000`00000000 : 0xfffff8a0`032b4060
fffff880`0bd279e0 00000000`00000067 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xd5f1a8
fffff880`0bd279e8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000067 : 0x67


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+43836
fffff800`02f4b5e4 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+43836

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  531590fb

IMAGE_VERSION:  6.1.7601.18409

FAILURE_BUCKET_ID:  X64_0x50_BAD_IP_nt!_??_::FNODOBFM::_string_+43836

BUCKET_ID:  X64_0x50_BAD_IP_nt!_??_::FNODOBFM::_string_+43836

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_0x50_bad_ip_nt!_??_::fnodobfm::_string_+43836

FAILURE_ID_HASH:  {1238cc2c-f87a-7833-bbe8-ec5c8d1ba968}

Followup: MachineOwner
---------

traderyoda · 10 Sep 2014

Will do - it's back on now. I'll wait for the next BSOD and post. It might take a few days.

Thanks!
TY

traderyoda · 18 Sep 2014

Hi Arc... been a while because the machine has been running smoothly - no BSODs... until a few minutes ago when I got another one (minidump attached). Driver Verifier was running. It seems to be identifying "MsMpEng.exe" as the faulting process - I found it in the MSE folder. But you'll probably see more than I can make out in the dump file.

Cheers,
TY

Arc · 19 Sep 2014

Code:

BugCheck A, {fffffa86058ae5aa, 2, 0, fffff80002ecdd67}

Probably caused by : memory_corruption ( nt!MiPfnShareCountIsZero+77 )

Followup: MachineOwner
---------

If you apply RAMs in two slots only (either the black two or the yellow two) as a test, how does it run?

Sometimes some motherboards cannot do it properly with all the RAM slots occupied.

traderyoda · 19 Sep 2014

Originally the machine had 4GB (two 2GB sticks in two slots). I added another 4GB to occupy all four slots. Maybe this is the problem. When I encountered this problem I saw the memory fault and just decided to replace the RAM with 4 new sticks... this did not cure the problem.

I'll pull two sticks and load the machine up to see if I can generate another BSOD - will report back.

One question: do you think this might have something to do with running auto in BIOS in terms of RAM voltage and speed? These are 80MHz DDR2 RAM sticks. I've read that if you occupy 4 slots you should step back on the speed (to 667MHz) and manually set the voltage to the required voltage (2.1 in this case). I've also heard of people trying higher voltages to get the RAM stable. What do you think?