Crashes possibly bad memory? Win7Pro X64

Sauronis · 01 Dec 2009

I am back oh wisemen of the Win7 forums, with a new batch of dump files.

My university's MSDN AA adminstrator finally got around to getting us access to those apps provided to us by MSDN AA one of them is a copy of win 7 pro. Since I have 4 gigs of RAM and plan to expand to 8 eventually, I went with the 64-bit. Switching from the 32-bit RC Win7.

Did a clean install on my rig and immediately started running into stability issues, after the fourth crash I finally began taking a look at them. All but one say memory corruption leading me to believe that mayhaps my memory has gone bad. Being a novice at analyzing these dump files I have no definite idea.

However the last point was coming up as cause by ntkrnl if I remember right that kind hints at drivers (unless I am thinking of something else), to my knowledge I am using the latest drivers. Attached are the dumps.

Again thank you for your help on this, as well as previous ventures to these forums.

zigzag3143 · 01 Dec 2009

Sauronis said:

I am back oh wisemen of the Win7 forums, with a new batch of dump files.

My university's MSDN AA adminstrator finally got around to getting us access to those apps provided to us by MSDN AA one of them is a copy of win 7 pro. Since I have 4 gigs of RAM and plan to expand to 8 eventually, I went with the 64-bit. Switching from the 32-bit RC Win7.

Did a clean install on my rig and immediately started running into stability issues, after the fourth crash I finally began taking a look at them. All but one say memory corruption leading me to believe that mayhaps my memory has gone bad. Being a novice at analyzing these dump files I have no definite idea.

However the last point was coming up as cause by ntkrnl if I remember right that kind hints at drivers (unless I am thinking of something else), to my knowledge I am using the latest drivers. Attached are the dumps.

Again thank you for your help on this, as well as previous ventures to these forums.

Sauronis

Hi and welcome. Great sense of humor.

Well I took a look at your DMP files. The problem is self evident. usually we have to dig around a bunch to find the offending problem, but 3 of your 4 pointed to the same thing. Memory Corruption. The other thing I noticed is you didnt do a clean install so you have drivers from way back to 2005.

WE HAVE BEEN SEEING AN INCREASE IN 64BIT CRASHES, DUE TO MEMORY AND HARDWARE

I would update all the essential drivers, BIOS, video, rtcore64, and the rest

download memtestx86 and run it overnight so it has a chance to tax your memory.

Run a system file check to verify and fix your system file
type cmd in search>right click and run as admin>sfc /scannow

If you are overclocking stop
If your have a raid driver update it

RTCore64.sys fffff880`069f8000 fffff880`069fe000 0x00006000 0x42941d90 5/25/2005 1:39:12 AM
secdrv.SYS fffff880`068ad000 fffff880`068b8000 0x0000b000 0x4508052e 9/13/2006 8:18:38 AM
rdpdispm.sys fffff880`03b35000 fffff880`03b3c000 0x00007000 0x47e3424e 3/21/2008 12:06:22 AM
xcmemVx64.sys fffff880`03b52000 fffff880`03bb2000 0x00060000 0x48ce250e 9/15/2008 4:04:14 AM
xcbdaVx64.sys fffff880`10b9c000 fffff880`10bd0700 0x00034700 0x48ce2510 9/15/2008 4:04:16 AM
xchalVx64.sys fffff880`03e0a000 fffff880`043af000 0x005a5000 0x48ce2536 9/15/2008 4:04:54 AM
xcfeVx64.sys fffff880`04445000 fffff880`044ee000 0x000a9000 0x48ce2537 9/15/2008 4:04:55 AM

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Users\K\Desktop\113009-25552-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*d:\symbols*Symbol information
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02863000 PsLoadedModuleList = 0xfffff800`02aa0e50
Debug session time: Mon Nov 30 17:56:40.364 2009 (GMT-5)
System Uptime: 0 days 0:40:00.003
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 109, {a3a039d895e2154d, b3b7465ee85fe5bb, fffff800028295d8, 1}

*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption

Followup: memory_corruption
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

CRITICAL_STRUCTURE_CORRUPTION (109)
This bugcheck is generated when the kernel detects that critical kernel code or
data have been corrupted. There are generally three causes for a corruption:
1) A driver has inadvertently or deliberately modified critical kernel code
or data. See Patching Policy for x64-Based Systems: Changes in policy that are related to patching the kernel for the x64-based versions of Microsoft Windows Server 2003 and Microsoft Windows XP Professional x64 Edition operating systems
2) A developer attempted to set a normal kernel breakpoint using a kernel
debugger that was not attached when the system was booted. Normal breakpoints,
"bp", can only be set if the debugger is attached at boot time. Hardware
breakpoints, "ba", can be set at any time.
3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data.
Arguments:
Arg1: a3a039d895e2154d, Reserved
Arg2: b3b7465ee85fe5bb, Reserved
Arg3: fffff800028295d8, Failure type dependent information
Arg4: 0000000000000001, Type of corrupted region, can be
0 : A generic data region
1 : Modification of a function or .pdata
2 : A processor IDT
3 : A processor GDT
4 : Type 1 process list corruption
5 : Type 2 process list corruption
6 : Debug routine modification
7 : Critical MSR modification

Debugging Details:
------------------

BUGCHECK_STR: 0x109

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: CODE_CORRUPTION

PROCESS_NAME: System

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff800028d4f00

STACK_TEXT:
fffff880`02ffc598 00000000`00000000 : 00000000`00000109 a3a039d8`95e2154d b3b7465e`e85fe5bb fffff800`028295d8 : nt!KeBugCheckEx

STACK_COMMAND: kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !hal
fffff80002829611 - hal!KeQueryPerformanceCounter+39
[ 9c:dc ]
1 error : !hal (fffff80002829611)

MODULE_NAME: memory_corruption

IMAGE_NAME: memory_corruption

FOLLOWUP_NAME: memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MEMORY_CORRUPTOR: ONE_BIT

FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT

BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT

Followup: memory_corruption
---------

Sauronis · 01 Dec 2009

I have been running the latest nVidia drivers since install, I installed the latest Network, Audio and chipset drivers prior to crash 4.

Bios is not technically the latest, I am using the F8 version there is an F9e on the Gigabyte website but its a beta BIOS. Should I try installing anyway?

I don't overclock, nor use RAID (nor have the intention of using it)

What other drivers need updated that I missed?

I will run memtest all-night but I doubt it is the physical memory, mostly because of the my lack of memory related crashes in the RC (I got blue-screens most likely due to the Video drivers being intended for the RTM not the RC, no clear indicator of memory problems)

Sauronis · 02 Dec 2009

12 hours of memtest came up clean, no errors. Not conclusive, but a hint in the right direction.

usasma · 02 Dec 2009

I'd suggest running Driver Verifier to see if you can force a crash that will identify the culprit. But, as the indicators point to your video card, and you've updated your video drivers - the most likely cause would be an issue with the video card itself. Do you have another card that you can test the system with?

Here's the instructions for Driver Verifier:

Using Driver Verifier is an iffy proposition. Most times it'll crash and it'll tell you what the driver is. But sometimes it'll crash and won't tell you the driver. Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.

So, I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista Startup Repair feature).

Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
- Select "Automatically select unsigned drivers" and click "Next"
If no drivers show up, then select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and waitfor it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out.

Reboot into Windows (after the crash) and turn offDriver Verifier by going back in and selecting "Delete existing settings" on the first page, then locate and zip up the memory dump file and upload it with your next post.

If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.
If that doesn't work, post back and we'll have to see about fixing the registry entry off-line.

More info on this at this link: Using Driver Verifier to identify issues with Windows drivers for advanced users

Sauronis · 03 Dec 2009

Alright, so all day yesterday my computer behaved. Today however, I got a string of four crashes all while attempting to play FarCry2.

Then, I decided to run Driver Verifier, well I ran the proper settings and Win7 wouldn't load at all, it would just sit on the Starting Windows screen (waited half an hour). So I rebooted, and it offered the startup repair, I declined to restore it. I then rebooted, and it made it to the log in screen but then dumped. Restarted a last time and well... here I am.

Attached are the latest dumps.

usasma · 03 Dec 2009

Please update this driver belonging to your network card: RTCore64.sys Wed May 25 02:39:12 2005

The minidumps show 4 different errors - one of which is a Driver Verifier enabled memory dump.
The cause is listed as CI.DLL - the Windows Code Integrity Module.

I suspect that the CI.DLL module was not the cause - but that doesn't leave us with much to go on. Have you scanned the system to see if there's a virus present? Have you performed a memory test? Memory test instructions here: http://www.carrona.org/memdiag.html

Here's a summary of the BSOD's:

Code:

Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Debug session time: Thu Dec  3 12:42:15.908 2009 (GMT-5)
System Uptime: 0 days 0:18:25.422
BugCheck 109, {a3a039d8963e7580, b3b7465ee8bb47ae, fffff80002b45604, 1}
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption
DEFAULT_BUCKET_ID:  CODE_CORRUPTION
PROCESS_NAME:  System
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Debug session time: Thu Dec  3 12:16:07.562 2009 (GMT-5)
System Uptime: 0 days 0:23:46.201
BugCheck 3D, {fffff88007d890d0, 0, 0, fffff80002add60f}
Probably caused by : memory_corruption
DEFAULT_BUCKET_ID:  CODE_CORRUPTION
PROCESS_NAME:  farcry2.exe
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Debug session time: Thu Dec  3 12:22:59.812 2009 (GMT-5)
System Uptime: 0 days 0:01:09.451
BugCheck 1A, {41287, 0, 0, 0}
Probably caused by : hardware ( nt! ?? ::FNODOBFM::`string'+42c75 )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  WmiPrvSE.exe
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Debug session time: Thu Dec  3 13:42:21.605 2009 (GMT-5)
System Uptime: 0 days 0:00:14.150
BugCheck D1, {fffff88000cc0fbb, 2, 8, fffff88000cc0fbb}
Probably caused by : CI.dll ( CI!CiValidateImageHeader+213 )
DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME:  System

Sauronis · 03 Dec 2009

No viruses detected (using Avast free and Malwarebytes) will run a Panda scan just to make sure, but I find it very unlikely this is a fresh install and antivirus software was the first thing to come after drivers.

Ran memtest for 9 passes on Dec 1st. No errors, but if you think I should run it again overnight it wouldn't hurt.

Turned off driver verifier, no crashes just really sluggish system and I updated that network driver. No additional crashes yet. Will post if I get additional minidumps.

usasma · 03 Dec 2009

Please run the Driver Verifier one more time.
This time have it verify all the Microsoft drivers - and none of the 3rd party drivers.
It's not likely to give us anything - but it could point to an OS corruption (which is becoming more likely IMO).

Sauronis · 08 Dec 2009

On the weekends I don't have access to my desktop, so I wasn't able to run driver verifier again till today.

I ran it, this time with only windows drivers, The system won't load. The first time I tried it just restarted, no BSOD, second time I got a BSOD.

I got a handful of BSODS last night. I know one of them was due to the power going out in my dorm last night. The others are all memory corruption. I will post them up shortly. I am currently posting from my laptop as I use Safe Mode to turn off the Driver Verifier.