BSOD - Possibly memory issues?


  1. Posts : 91
    Windows 7
       #1

    BSOD - Possibly memory issues?


    I've had 3 BSODs in the past couple days. One occurred this morning, and then again 5 hours later, the previous one was from 5 days ago.

    I'm not quite sure what's going on, sounds like it may just be Win 7 having some problems

    I'm running:

    Windows 7 x64 Pro
    8GB ram (passed overnight test with memtest)
    Intel Q6600
    Two GeForce 8600 GTS (not in SLI)
    4 74 GB SATA Raptors
    2 1TB Western Digital SATA Drives (95% full)
    400GB SATA Drive
    320 GB SATA Drive

    3: kd> .sympath srv*csymbols*Symbol information
    Symbol search path is: srv*csymbols*Symbol information
    Expanded Symbol search path is: srv*csymbols*Symbol information
    3: kd> .reload
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    .............................
    Loading User Symbols
    Loading unloaded module list
    .....
    3: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    SYSTEM_SERVICE_EXCEPTION (3b)
    An exception happened while executing a system service routine.
    Arguments:
    Arg1: 00000000c000001d, Exception code that caused the bugcheck
    Arg2: fffff88005cec028, Address of the exception record for the exception that caused the bugcheck
    Arg3: fffff880065d3e90, Address of the context record for the exception that caused the bugcheck
    Arg4: 0000000000000000, zero.

    Debugging Details:
    ------------------


    EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction.

    FAULTING_IP:
    srvnet!SrvAdminProcessFsctl+258
    fffff880`05cec028 0e ???

    CONTEXT: fffff880065d3e90 -- (.cxr 0xfffff880065d3e90)
    rax=0000000000146053 rbx=000000000014604b rcx=fffffa800b41d940
    rdx=fffffa800aed7701 rsi=0000000000000000 rdi=fffffa800aed7710
    rip=fffff88005cec028 rsp=fffff880065d4860 rbp=0000000000000000
    r8=0000000000000000 r9=0000000000000000 r10=fffffa800b555850
    r11=0000000000000006 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=fffffa800b555850
    iopl=0 nv up ei ng nz na pe cy
    cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010283
    srvnet!SrvAdminProcessFsctl+0x258:
    fffff880`05cec028 0e ???
    Resetting default scope

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: CODE_CORRUPTION

    BUGCHECK_STR: 0x3B

    PROCESS_NAME: svchost.exe

    CURRENT_IRQL: 0

    LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff88005cec028

    STACK_TEXT:
    fffff880`065d4860 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : srvnet!SrvAdminProcessFsctl+0x258


    CHKIMG_EXTENSION: !chkimg -lo 50 -d !srvnet
    fffff88005cec028 - srvnet!SrvAdminProcessFsctl+258
    [ 0f:0e ]
    1 error : !srvnet (fffff88005cec028)

    MODULE_NAME: memory_corruption

    IMAGE_NAME: memory_corruption

    FOLLOWUP_NAME: memory_corruption

    DEBUG_FLR_IMAGE_TIMESTAMP: 0

    MEMORY_CORRUPTOR: ONE_BIT

    STACK_COMMAND: .cxr 0xfffff880065d3e90 ; kb

    FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT

    BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT

    Followup: memory_corruption
    ---------
    1: kd> .sympath srv*csymbols*Symbol information
    Symbol search path is: srv*csymbols*Symbol information
    Expanded Symbol search path is: srv*csymbols*Symbol information
    1: kd> .reload
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    .......................................................
    Loading User Symbols
    Loading unloaded module list
    .........
    1: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
    Arguments:
    Arg1: 0000000000041287, The subtype of the bugcheck.
    Arg2: 0000000000000058
    Arg3: 0000000000000000
    Arg4: 0000000000000000

    Debugging Details:
    ------------------


    BUGCHECK_STR: 0x1a_41287

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

    PROCESS_NAME: dwm.exe

    CURRENT_IRQL: 0

    TRAP_FRAME: fffff88009db2760 -- (.trap 0xfffff88009db2760)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=fffff88009db2968 rbx=0000000000000000 rcx=0000000000000002
    rdx=fffff88009db2920 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff800031919b0 rsp=fffff88009db28f0 rbp=000000000d400001
    r8=0000000000000001 r9=fffffa800bf02410 r10=0000000fffffffff
    r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0 nv up ei pl zr na po nc
    nt!MiReleaseConfirmedPageFileSpace+0x40:
    fffff800`031919b0 4c8b6e58 mov r13,qword ptr [rsi+58h] ds:00000000`00000058=????????????????
    Resetting default scope

    LAST_CONTROL_TRANSFER: from fffff8000307fb6e to fffff800030d3600

    STACK_TEXT:
    fffff880`09db25f8 fffff800`0307fb6e : 00000000`0000001a 00000000`00041287 00000000`00000058 00000000`00000000 : nt!KeBugCheckEx
    fffff880`09db2600 fffff800`030d16ee : 00000000`00000000 00000000`11604008 fffff680`00088000 fffff680`00088000 : nt! ?? ::FNODOBFM::`string'+0x42be5
    fffff880`09db2760 fffff800`031919b0 : 00000000`00000000 00000000`00000001 00000000`00000000 fffffa80`06c007d0 : nt!KiPageFault+0x16e
    fffff880`09db28f0 fffff800`03146d78 : 0d400001`ae51f024 00000000`115ff000 00000000`11604008 00000000`11605000 : nt!MiReleaseConfirmedPageFileSpace+0x40
    fffff880`09db2970 fffff800`03114fca : 00000000`00000000 00000000`12583fff fffffa80`00000000 fffffa80`0bf02410 : nt! ?? ::FNODOBFM::`string'+0x337d8
    fffff880`09db2b30 fffff800`030d2853 : ffffffff`ffffffff 00000000`027bed10 00000000`027becd8 00000000`00008000 : nt!NtFreeVirtualMemory+0x5ca
    fffff880`09db2c20 00000000`76ef009a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    00000000`027bec48 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76ef009a


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    nt! ?? ::FNODOBFM::`string'+42be5
    fffff800`0307fb6e cc int 3

    SYMBOL_STACK_INDEX: 1

    SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+42be5

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME: ntkrnlmp.exe

    DEBUG_FLR_IMAGE_TIMESTAMP: 4b88cfeb

    FAILURE_BUCKET_ID: X64_0x1a_41287_nt!_??_::FNODOBFM::_string_+42be5

    BUCKET_ID: X64_0x1a_41287_nt!_??_::FNODOBFM::_string_+42be5

    Followup: MachineOwner
    ---------
    3: kd> .sympath srv*csymbols*Symbol information
    Symbol search path is: srv*csymbols*Symbol information
    Expanded Symbol search path is: srv*csymbols*Symbol information
    3: kd> .reload
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    .....................................................
    Loading User Symbols
    Loading unloaded module list
    .....
    3: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
    Arguments:
    Arg1: 0000000000041284, A PTE or the working set list is corrupt.
    Arg2: fffff8a01b7c7001
    Arg3: 000000000002557c
    Arg4: fffff781c0000000

    Debugging Details:
    ------------------


    BUGCHECK_STR: 0x1a_41284

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

    PROCESS_NAME: System

    CURRENT_IRQL: 0

    LAST_CONTROL_TRANSFER: from fffff80003120df3 to fffff800030ca600

    STACK_TEXT:
    fffff880`037fc658 fffff800`03120df3 : 00000000`0000001a 00000000`00041284 fffff8a0`1b7c7001 00000000`0002557c : nt!KeBugCheckEx
    fffff880`037fc660 fffff800`030c0249 : d7c00000`7310e963 ffffffff`ffffffff fffffa80`06d502a8 fffff880`035d5180 : nt! ?? ::FNODOBFM::`string'+0x4a83
    fffff880`037fc6a0 fffff800`030bfc55 : 00000000`00000000 00000000`00000002 00000000`00000000 00000000`00000000 : nt!MiDeleteSystemPagableVm+0x179
    fffff880`037fc800 fffff800`031fb34f : fffffa80`09c45440 fffff880`01e927d3 00000000`60000001 00000000`00000000 : nt!MiFreePagedPoolPages+0x129
    fffff880`037fc950 fffff800`031ff87c : 00000000`00000000 fffff880`037fcb20 fffff880`037fca90 00000000`00000001 : nt!MiFreePoolPages+0x343
    fffff880`037fca60 fffff800`030b48f0 : fffffa80`0f4c9160 00000000`00000000 00000000`74536d4d 00000000`00000001 : nt!ExFreePoolWithTag+0x7cc
    fffff880`037fcb10 fffff800`033bc203 : fffffa80`0f4c9160 00000000`00000011 00000000`00088081 fffffa80`00088081 : nt!MiDeleteSegmentPages+0x35c
    fffff880`037fcbc0 fffff800`031f1fcb : fffffa80`0f4c9168 00000000`00000001 00000000`00000000 6d6f4320`00000631 : nt!MiSegmentDelete+0x7b
    fffff880`037fcc00 fffff800`031f263d : 00000000`00000000 00000000`00000080 fffffa80`06ca8840 646d60c3`00000012 : nt!MiProcessDereferenceList+0x23b
    fffff880`037fccc0 fffff800`0336fa86 : 5b971d01`ae56e373 0215233d`7cedd78e 160182a3`01000103 03060d30`12018230 : nt!MiDereferenceSegmentThread+0x10d
    fffff880`037fcd40 fffff800`030a8b06 : fffff880`03564180 fffffa80`06d4c510 fffff880`0356efc0 ef70d05b`10809781 : nt!PspSystemThreadStartup+0x5a
    fffff880`037fcd80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    nt! ?? ::FNODOBFM::`string'+4a83
    fffff800`03120df3 cc int 3

    SYMBOL_STACK_INDEX: 1

    SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+4a83

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME: ntkrnlmp.exe

    DEBUG_FLR_IMAGE_TIMESTAMP: 4b88cfeb

    FAILURE_BUCKET_ID: X64_0x1a_41284_nt!_??_::FNODOBFM::_string_+4a83

    BUCKET_ID: X64_0x1a_41284_nt!_??_::FNODOBFM::_string_+4a83

    Followup: MachineOwner
    ---------
      My Computer


  2. Posts : 11,990
    Windows 7 Ultimate 32 bit
       #2

    It would appear that your diagnosis of memory is close. The errors point to hardware, memory, and/or drivers. I also ran Bugcheck on your dmp files.

    STOP 0x0000001A: MEMORY_MANAGEMENT

    Usual causes: Device driver, memory, kernel

    BSOD Index

    STOP 0x0000003B: SYSTEM_SERVICE_EXCEPTION

    Usual causes: System service, Device driver, graphics driver, ?memory

    BSOD Index
    I suggest you start by downloading a copy of Memtest86 and burn the ISO to a CD using Iso Recorder. Boot from the CD, and leave it running for at least 5 passes. Let's see if you have a memory problem.

    Please post back with the results.

    I also find a very old driver, pcouffin.sys Dec 05 2006 - The process Patin-Couffin low level access layer for CD devices or low level access layer for CD/DVD/BD devices or VSO Software pcouffin belongs to the software Low level access layer for CD devices or Patin couffin engine or VSO Software pcouffin by VSO Software (www.vso-software.fr). I suggest that you update the software associated with this driver, which should update the driver also, or uninstall the software using Revo.

    You have another old driver, lmimirr.sys Apr 10 2007. This driver is associated with the software RemotelyAnywhere or LMImirr or LogMeIn by 3am Labs, Inc or LogMeIn, Inc. I suggest you update this software or uninstall it.

    After you update or uninstall these obsolete programs, reboot, and post back with how your system is doing.
    Last edited by CarlTR6; 01 Jun 2010 at 17:26.
      My Computer


  3. Posts : 13,354
    Windows 7 Professional x64
       #3

    Please follow these directions for enabling driver verifier: Using Driver Verifier to identify issues with Drivers

    The dmp points to RAM or drivers most likely. Since you already tested RAM, we can work on the drivers.

    Update these old ones:
    Code:
    lmimirr.sys  Tue Apr 10 18:32:45 2007 -LogMeIn
    pcouffin.sys Tue Dec 05 09:39:30 2006 -PowerISO, DVD Fab, etc type program
    RaInfo.sys   Fri Jan 04 13:57:14 2008 -LogMeIn
    LMIRfsDriver.sys Mon Jul 14 12:26:56 2008- LogMeIn
    BSOD BUGCHECK SUMMARY
    Code:
    
    Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
    Debug session time: Tue May 25 12:35:20.734 2010 (GMT-4)
    System Uptime: 0 days 0:00:49.562
    BugCheck 3B, {c000001d, fffff88005cec028, fffff880065d3e90, 0}
    Probably caused by : memory_corruption
    BUGCHECK_STR:  0x3B
    PROCESS_NAME:  svchost.exe
    ииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииии
    Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
    Debug session time: Tue Jun  1 03:03:05.494 2010 (GMT-4)
    System Uptime: 3 days 15:29:27.694
    BugCheck 1A, {41287, 58, 0, 0}
    Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+42be5 )
    BUGCHECK_STR:  0x1a_41287
    PROCESS_NAME:  dwm.exe
    ииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииии
    Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
    Debug session time: Tue Jun  1 16:52:48.232 2010 (GMT-4)
    System Uptime: 0 days 5:52:21.013
    BugCheck 1A, {41284, fffff8a01b7c7001, 2557c, fffff781c0000000}
    Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4a83 )
    BUGCHECK_STR:  0x1a_41284
    PROCESS_NAME:  System
    ииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииии
    
      My Computer


  4. Posts : 91
    Windows 7
    Thread Starter
       #4

    The pcouffin.sys driver is from what Carl mentioned above VSO Software, specifically the ConvertXtoDVD program. I'll uninstall it since I no longer need it, I just wanted to mention that in case someone else was searching around and found this thread.

    I'm going to make a full system backup today and then I'll go through those steps and report back.

    Thanks for the information!
      My Computer


  5. Posts : 11,990
    Windows 7 Ultimate 32 bit
       #5

    You are welcome.
      My Computer


  6. Posts : 91
    Windows 7
    Thread Starter
       #6

    Soo.. I ran through that verifier program and it immediately crashed my system. I had to do a full restore via Acronis because it wouldn't come back up.. YAY

    I decided to run memtest again, and it found some problems. No idea why it was fine before, but it is definitely something with my ram that is causing some issues.

    I've removed the 2 ram sticks with the issue and will see if these BSODs continue.

    Thanks for the help guys.
      My Computer


  7. Posts : 11,990
    Windows 7 Ultimate 32 bit
       #7

    Merlin, try those RAM sticks in different slots to make sure it is the RAM and not the slots.
      My Computer


  8. Posts : 91
    Windows 7
    Thread Starter
       #8

    Definitely the ram, I swapped the position of the 2 sets of 2 sticks

    1|2|1|2 -> 2|1|2|1 and the same thing

    Since I bought the last set of ram not too long ago, and it was a pack of 2, I'm just going to replace both sticks, dunno if 1 or both are bad, but Corsair can figure it out on their end.

    That driver verifier program was pretty cool, first time I've used it.
      My Computer


  9. Posts : 11,990
    Windows 7 Ultimate 32 bit
       #9

    Thanks for reporting back. Great job on finding the problem.

    I have only run the driver verifier program once - and it is pretty cool. I ran it just to see how it worked.

    Here's hoping you will zip right along with the new RAM.
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

й Designer Media Ltd
All times are GMT -5. The time now is 06:15.
Find Us