BSOD Please help me to read my dump files

ttran · 07 Aug 2010

Hi QuangAnh, How are you doing buddy

?

The new DMP file point to memory corruption with stop code 50, which usually hardware come into play. I really don't want that thing to show up but unfortunately it did. Please Download a copy of Memtest86 and burn the ISO to a CD using Iso Recorder or another ISO burning program. Boot from the CD, and leave it running for at least 5 or 6 passes.

Also keep in mind that Just remember, any time Memtest reports errors, it can be either bad RAM or a bad motherboard slot. Test the sticks individually, and if you find a good one, test it in all slots.

Also, I haven't seen you update this driver buddy

Code:

b44amd64 b44amd64.sys Tue Nov 21 19:23:06 2006 (4562EFAA)

And actually I really doubt that because the process running at the time of crash was IDMan.exe, which I believe is Internet Download Manager (Which I'm using too very fast). Please please please update that driver, Window 7 can't run stable on such a system with that old driver date 2006, especially something important like Broadcom Corporation NDIS 5.1 ethernet driver.

BUGCHECK SUMMARY:

Code:

BugCheck 50, {fffffb8571fffaf0, 0, fffff800028a42ca, 7}


Could not read faulting driver name
Probably caused by : memory_corruption ( nt!MiDeleteVirtualAddresses+481 )

Followup: MachineOwner
---------
PROCESS_NAME:  IDMan.exe

Good Luck QuangAnh, wish you all the best

Tuan

vietnam · 16 Aug 2010

Hello Tuan,

Many thanks to you.

1. Broadcom Corporation NDIS 5.1 ethernet driver Problem.

I checked my Network adapters on Device Manager, i got always "the best driver is installed".
I've visited this page
Broadcom.com - Ethernet NIC 4401 Driver Downloads
to download a new version to install, and the result is the same.
So i need "Broadcom Corporation NDIS 5.1 ethernet driver" for win 7, 64 bits, dell vostro 1500. You can help me to find it ?

2. Memory Problem. Yeaaaah ^^ i knew my pb.

Yesterday, after getting 2 BSOD succesive, i decide to use Memtest86 to test the sticks individually.

I've 2 sticks DDR 2 Gb, bus 800 from different manufacturer : APACER and Hynix.
The result i've got as following :

Slot 1 : Hynix OK (5 pass)
APACER (error - 1 pass/1error - i stop this test when i get the error).

Slot 2 : Hynix OK (5 pass)
APACER (error - 1 pass/1error - i stop this test when i get the error).

Error text is as follow :
Tst : 6
Pass : 2
Failing Address : 00003c18954 - 60M
Good : 02000000
Bad : 02010000
Err-Bits : 00010000
Count : 1

So, by this way, i know the Ram APACER is not good. I've changed it by a new Hynix this morning (to night i'll test all 2 sticks).
I hope this is the cause of my BSOD.

Quang Anh

vietnam · 16 Aug 2010

i attached 2 images for my RAM. To night i'll test all and post the result tomorrow.

Hy vong khong bi loi nay nua, stress vi no khung khiep.

ttran · 16 Aug 2010

Based on the website you provided me, it looks like probably 2008 is the newest date of the driver. Even though we all want it to be 2009 until now, but yes, that's how it is.
RAM is more serious and you found one of them to be bad. That's great. Hopefully we have found the solution. Make sure to test the 2 slots again to make sure that the 2 slots are ok

Regard,

Tuan

vietnam · 16 Aug 2010

I've tested 2 sticks without errors in 7 passed. i Hope don't get any BSOD in future. Thanks Tuan so much.

Quang Anh

ttran · 17 Aug 2010

Chúc may mắn Quang Anh. Cái driver cho broadcom enthernet mình sẽ phải theo dõi đó quang anh à, vì đá số driver mà 2,3 năm tuổi như 2008 quay về trước dễ gây ra BSODs lắm. Nên mình ko chắc là nó sẽ ko gây ra vấn đề gì, hy vọng là thay ram là đủ

Tuấn

vietnam · 19 Aug 2010

tuấn ơi, buồn quá, vừa nhận được BSOD xong, mình đoan chắc 100% ko phải do Ram, mình test Ram 3 lần, đều passed hết, ko biết là lỗi driver j, buồn ko chịu nổi.

vietnam · 19 Aug 2010

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Users\NVQuangAnh\Desktop\082010-20482-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*Symbol information
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02a63000 PsLoadedModuleList = 0xfffff800`02ca0e50
Debug session time: Fri Aug 20 10:05:52.127 2010 (GMT+7)
System Uptime: 0 days 0:18:23.593
Loading Kernel Symbols
...............................................................
................................................................
.........................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffffa8015d98010, 2, 1, fffff80002b91ab7}

Probably caused by : win32k.sys ( win32k!SURFACE::bDeleteSurface+3a2 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffffa8015d98010, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002b91ab7, address which referenced memory

Debugging Details:
------------------

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002d0b0e0
fffffa8015d98010

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiReleaseConfirmedPageFileSpace+87
fffff800`02b91ab7 480fb328 btr qword ptr [rax],rbp

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: chrome.exe

TRAP_FRAME: fffff88006caef70 -- (.trap 0xfffff88006caef70)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8004f18010 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002b91ab7 rsp=fffff88006caf100 rbp=0000000087400001
r8=fffff88006caf130 r9=fffffa8004397b30 r10=0000000fffffffff
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!MiReleaseConfirmedPageFileSpace+0x87:
fffff800`02b91ab7 480fb328 btr qword ptr [rax],rbp ds:fffffa80`04f18010=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff80002ad2ca9 to fffff80002ad3740

STACK_TEXT:
fffff880`06caee28 fffff800`02ad2ca9 : 00000000`0000000a fffffa80`15d98010 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`06caee30 fffff800`02ad1920 : 00000000`00020000 fffffa80`03c85390 00000000`00020000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`06caef70 fffff800`02b91ab7 : fffffa80`0315ab00 fffffa80`03c85390 fffffa80`04587ed0 fffffa80`0298ef90 : nt!KiPageFault+0x260
fffff880`06caf100 fffff800`02b46e38 : 87400001`00000000 00000000`0a3ff000 00000000`00000290 00000000`0a400000 : nt!MiReleaseConfirmedPageFileSpace+0x87
fffff880`06caf180 fffff800`02b06df9 : 000004e8`00000000 00000000`0a557fff fffff880`00000000 fffff800`00000000 : nt! ?? ::FNODOBFM::`string'+0x33798
fffff880`06caf340 fffff800`02dec1d0 : fffffa80`04582010 0007ffff`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0xd9
fffff880`06caf460 fffff800`02dec5db : 00000000`00000000 00000000`0a1f0000 fffffa80`00000001 fffff960`00164100 : nt!MiUnmapViewOfSection+0x1b0
fffff880`06caf520 fffff800`02ad2993 : fffff900`c1f447c8 00000000`00000000 fffffa80`04397b30 00000000`00000000 : nt!NtUnmapViewOfSection+0x5f
fffff880`06caf570 fffff800`02acef30 : fffff960`001651b2 00000000`00000001 fffff900`c00bf010 fffff900`c2099cd0 : nt!KiSystemServiceCopyEnd+0x13
fffff880`06caf708 fffff960`001651b2 : 00000000`00000001 fffff900`c00bf010 fffff900`c2099cd0 00000000`00000001 : nt!KiServiceLinkage
fffff880`06caf710 fffff960`0016d5b9 : 00000000`00000000 fffff880`00000001 fffff900`c2099cd0 fffff900`00000000 : win32k!SURFACE::bDeleteSurface+0x3a2
fffff880`06caf860 fffff960`00164a10 : 00000000`00000a80 fffff880`06cafc00 fffff900`c279c3d0 fffff880`00000000 : win32k!NtGdiCloseProcess+0x2c9
fffff880`06caf8c0 fffff960`00164157 : fffffa80`05098300 fffff880`06cafc20 fffffa80`03c80000 00000000`00000000 : win32k!GdiProcessCallout+0x200
fffff880`06caf940 fffff800`02db8a01 : fffffa80`050983e0 00000000`00000000 00000000`00000000 fffffa80`03c85390 : win32k!W32pProcessCallout+0x6b
fffff880`06caf970 fffff800`02d91635 : 00000000`c0000005 00000000`00000001 00000000`78457300 00000000`00000000 : nt!PspExitThread+0x561
fffff880`06cafa30 fffff800`02ab01db : 00000000`06cafca0 fffffa80`03f2ab70 00000000`004ae5b0 00000000`00000000 : nt!PsExitSpecialApc+0x1d
fffff880`06cafa60 fffff800`02ab0620 : 00000000`01f5faf4 fffff880`06cafae0 fffff800`02d9174c 00000000`00000001 : nt!KiDeliverApc+0x2eb
fffff880`06cafae0 fffff800`02ad2a37 : fffffa80`03c85390 00000000`7ef4d000 fffff880`000000c0 00000000`7ef4d000 : nt!KiInitiateUserApc+0x70
fffff880`06cafc20 00000000`7783165a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`004ae588 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7783165a

STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!SURFACE::bDeleteSurface+3a2
fffff960`001651b2 e9d6010000 jmp win32k!SURFACE::bDeleteSurface+0x57d (fffff960`0016538d)

SYMBOL_STACK_INDEX: a

SYMBOL_NAME: win32k!SURFACE::bDeleteSurface+3a2

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c483f

FAILURE_BUCKET_ID: X64_0xA_win32k!SURFACE::bDeleteSurface+3a2

BUCKET_ID: X64_0xA_win32k!SURFACE::bDeleteSurface+3a2

Followup: MachineOwner
---------

Jonathan_King · 20 Aug 2010

Remove Avast with this tool: http://files.avast.com/files/eng/aswclear5.exe

Install MSE instead: http://www.microsoft.com/security_essentials

Your Broadcom drivers still need to be updated. If you follow the BSOD Posting Instructions, perhaps we can locate a driver for you.

vietnam · 20 Aug 2010

Jonathan_King said:

Remove Avast with this tool: http://files.avast.com/files/eng/aswclear5.exe

Install MSE instead: http://www.microsoft.com/security_essentials

Your Broadcom drivers still need to be updated. If you follow the BSOD Posting Instructions, perhaps we can locate a driver for you.

OK, i dit as you said.

Removed Avast, installed MSE, followed as BSOD Posting Instructions.
Please help me to find cause of my BSOD.
i tested 2 Rams with memtest86+ (one stick each slot, and both of them), no errors with 9 passed, i think that it doesn't come from my RAM.

My basic system information :

- x64
- format and installed new OS on the system
- Full Retail
- the age of system (hardware) : from 2007

Thanks you so much !! (Tuan oi, giup minh luon nhe)

P/s : I forgot one thing,

After buying a new Ram, tested all with good results. I don't get any BSOD for 5 days.
Yesterday i try to install new driver for SOUND (i.e. i want to add Stereo Mix) but i doesn't work, so i removed it. This morning, i got 2 BSOD. What can i do in this situation ?

(

BSOD Please help me to read my dump files

Mình dùng WinDbg thì nhận được kết quả sau :

BSOD has returned