Win7 32-bit Crashing Since Jan 2010

gedafe · 24 Jun 2010

I installed Win 7 on a new machine back in December. Here are the stats:

OS: 32 bit Win 7 Professional
CPU: Intel core i5-750 2.66GHz 8M LGA1156
Motherboard: MSI P55-GD65 LGA 1156 Intel P55 ATX Intel Motherboard
Memory: Patriot ‘Sector 5’ Edition 4GB (2 x 2GB) 240-Pin DDR3 1333
Graphics Card(s): XFX Radeon HD 4870 512MB PCIe DDR5 Dual DVI
Sound Card: Embedded
Monitor(s) Displays: Sharp LL-172 A-B, Acer AL1703
Hard Drives:

1 TB Hitachi Serial ATA 7200/32MB/SATA-3G
Western Digital Caviar Blue WD5000AAKS 500GB 7200 RPM SATA 3.0Gb/s
Western Digital Caviar Green WD15EARS 1.5TB SATA 3.0Gb/s

PSU: Ultra LSP 550w
Case: APEX Vortex 3620 SGCC/ABS ATX Mid Tower Gaming Computer Case
Cooling: Cooler Master Hyper N520 Copper Heatpipe CPU Cooler
Keyboard: steelseries merc
Mouse: Gigabite GM-G6800

I've been having trouble keeping it from getting BSOD for months. It only ran stable for a month, and then beginning end of Jan 2010, it would crash 3-14 times a month, seemingly random: sometimes while playing a game, sometimes when listening to itunes, sometimes when surfing the web, sometimes when using MS office products.

I'm sort of a novice here, but I've read and re-read multiple posts here and on other sites, looking for hints and tips to stabilize the system. I've updated all hardware/software drivers, re-installed AV software, uninstalled incompatible software, checked memory via the Win7 memory checker, etc. Even after doing all that, the longest I've managed to have win7 running without BSOD is 9-20 days.

I've attached the latest crash minidumps from this week, but I've got them for every crash back to 23 Jan 10. Any help would be greatly appreciated.

**Pauly** · 24 Jun 2010

Two different error codes there
0xa BSOD Index
0x4e BSOD Index

Have you checked the event log for any indications of a faulty service or driver as i suspect this is probably a driver issue, i would download and run memtest86 for a thorough test of the ram

CarlTR6 · 24 Jun 2010

Hi Gerald and welcome to seven forums.

Both of these dmps pointed at standby.exe. I believe this is a Corel program called Standby?

I have also found a number of old drivers on your system at the time of the crash. Windows 7 does not like old drivers and they can definitely call BSOD's. I will get back to you on these drivers shortly.

Alpham1.sys Mon Jul 23 03:56:57 2007 - ZBoards keyboard driver
Alpham2.sys Tue Mar 20 05:49:51 2007 - ZBoards keyboard driver
whfltr2k.sys Thu Jan 25 10:45:01 2007 - USB Mouse Lower filter driver, Gigabyte GM-M6800 Driver

I recommend that you update these driver ASAP.
- Search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- visit the web site of the manufacturer of the hardware/program to get the latest drivers (DON'T use Windows Update or the Update driver function of Device Manager).
- if there are difficulties in locating them, post back with questions and someone will try and help you locate the appropriate program.
- - Driver manufacturer links are on this page: Drivers and Downloads

CarlTR6 · 24 Jun 2010

I updated my post. You may have to refresh your page.

I also suggest that you uninstall Standby for troubleshooting purposes.

After you update these drivers and uninstall Standby, reboot and we will see how your system is doing.

gedafe · 24 Jun 2010

Gentlemen, thank you for your quick replies.

I am in the process of updating the drivers you suggested--I am downloading them from their respective company websites. I have a really slow internet connection at this location (I miss my fios) and it'll be over an hour before the newer version of the ZEngine for the zboards keyboard driver to be downloaded.

I installed the latest Gigabyte GM-M6800 Driver. The newest one was dated Jan 2009, but as I looked at the particular .sys file, I noted that it was dated 26 Jan 2007--not much newer (a day?) than my current one.

So far no BSOD, but I am still waiting on the keyboard drivers. Although it's the latest one they have, I'm not sure if it's any different from the one I am currently using.

As far as using memtest86, what is it, and how do you use it? I downloaded it from memtest86.com, but I can't figure out how to use it. I assume since it's a .iso file, it needs to be copied/burned to a disc and rebooted from the disc? Heh, I'm a quick learner, but still a novice. :)

As to the standby.exe, I can't find it. I did a search and it turned up nothing. Where would a program like this be? I went to the control panel-->programs-->programs and features and can't find it in the uninstall list. However, I do see corel videostudio 2010. Is this the same thing?

I'll update the post after I get everything installed or if I get another BSOD.

CarlTR6 · 24 Jun 2010

Thanks for the update; that is helpful.

Sometimes, just installing a fresh copy of the same driver solves the problem. Drivers do get corrupted every now and then. Even a newer driver by one day represents a change, an update. And if the software that goes with it has been updated, that makes it all the better.

The other side of the coin is that sometimes you have to bite the bullet and update the hardware if the drivers are obsolete. I had to ditch my webcam and microphone; the old software was not compatible with Win 7.

Regarding memtest (you can delay this until you drivers are all updated if you like),download a copy of Memtest86 and burn the ISO to a CD using Iso Recorder. Boot from the CD, and leave it running for at least 7 passes.

Ask away if you have any questions and keep us updated on your progress.

gedafe · 25 Jun 2010

Gents,

I updated the "new" drivers for both the mouse and keyboard. I also burned Memtest86 (v3.5) and tried to run it. I say "tried" because the scan only got to about 47% and then shut the computer off and restarted. I don't know what this means. I tried it again a couple times to the same result. Should I have used v3.4 instead or does the restarting mean something else?

Good news so far is that I haven't had a BSOD yet. We'll see what happens tomorrow.

Lordbob75 · 25 Jun 2010

Both BSoDs were caused by Memory_Corruption, which means bad RAM. Do as suggested above and run Memtest86+ - Advanced Memory Diagnostic Tool.

Code:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\David\AppData\Local\Temp\Temp1_Minidumps.zip\062110-23790-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0x82e1f000 PsLoadedModuleList = 0x82f67810
Debug session time: Mon Jun 21 22:33:02.003 2010 (UTC - 7:00)
System Uptime: 2 days 12:58:25.252
Loading Kernel Symbols
...............................................................
................................................................
.......................................................
Loading User Symbols
Loading unloaded module list
......
3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000002, A list entry was corrupt
Arg2: 00023226, entry in list being removed
Arg3: 000cf77f, highest physical page number
Arg4: 00000020, reference count of entry being removed

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_2

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  Standby.exe

CURRENT_IRQL:  2

TRAP_FRAME:  e3557948 -- (.trap 0xffffffffe3557948)
ErrCode = 00000000
eax=6f8e7004 ebx=00000004 ecx=00000001 edx=00000000 esi=6f8e7000 edi=e35579e8
eip=82e5d8f0 esp=e35579bc ebp=e35579c4 iopl=0         nv up ei ng nz ac pe cy
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010297
nt!memcpy+0x130:
82e5d8f0 8b448efc        mov     eax,dword ptr [esi+ecx*4-4] ds:0023:6f8e7000=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from 82eb9026 to 82efbd10

STACK_TEXT:  
e3557744 82eb9026 0000004e 00000002 00023226 nt!KeBugCheckEx+0x1e
e3557784 82ebabd5 00000000 d9ce1d20 83eec668 nt!MiUnlinkPageFromLockedList+0x51
e35577d4 82ec6e29 00000000 6f8e7000 9ea57ee8 nt!MiResolveTransitionFault+0x550
e3557820 82eaf916 00000000 6f8e7000 c037c738 nt!MiResolveProtoPteFault+0x3d8
e35578a8 82ea6dd5 6f8e7000 00000000 d9ce1d20 nt!MiDispatchFault+0x5d6
e3557930 82e65638 00000000 6f8e7000 00000000 nt!MmAccessFault+0x25cc
e3557930 82e5d8f0 00000000 6f8e7000 00000000 nt!KiTrap0E+0xdc
e35579c4 830a080e e35579e8 6f8e7000 00000004 nt!memcpy+0x130
e3557cbc 830a2c8e d9ce1b30 6f8e7000 d9ce1b30 nt!MmCopyVirtualMemory+0x1ad
e3557d18 82e6244a ffffffff 6f8e7000 01e9f460 nt!NtReadVirtualMemory+0xd5
e3557d18 770464f4 ffffffff 6f8e7000 01e9f460 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
01e9f3a8 00000000 00000000 00000000 00000000 0x770464f4


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiUnlinkPageFromLockedList+51
82eb9026 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiUnlinkPageFromLockedList+51

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cacf

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  0x4E_2_nt!MiUnlinkPageFromLockedList+51

BUCKET_ID:  0x4E_2_nt!MiUnlinkPageFromLockedList+51

Followup: MachineOwner
---------

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\David\AppData\Local\Temp\Temp1_Minidumps.zip\062410-26317-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0x82e0b000 PsLoadedModuleList = 0x82f53810
Debug session time: Thu Jun 24 12:22:30.406 2010 (UTC - 7:00)
System Uptime: 0 days 9:04:19.281
Loading Kernel Symbols
...............................................................
................................................................
......................................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {1c, 2, 0, 82ea6b38}

Probably caused by : memory_corruption ( nt!MiResolveTransitionFault+4b3 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000001c, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 82ea6b38, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from 82f73718
Unable to read MiSystemVaType memory at 82f53160
 0000001c 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!MiResolveTransitionFault+4b3
82ea6b38 f6411c20        test    byte ptr [ecx+1Ch],20h

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  Standby.exe

TRAP_FRAME:  a3fa3948 -- (.trap 0xffffffffa3fa3948)
ErrCode = 00000000
eax=633a6004 ebx=00000004 ecx=00000001 edx=00000000 esi=633a6000 edi=a3fa39e8
eip=82e498f0 esp=a3fa39bc ebp=a3fa39c4 iopl=0         nv up ei ng nz ac pe cy
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010297
nt!memcpy+0x130:
82e498f0 8b448efc        mov     eax,dword ptr [esi+ecx*4-4] ds:0023:633a6000=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from 82ea6b38 to 82e5182b

STACK_TEXT:  
a3fa371c 82ea6b38 badb0d00 00000000 c0319d28 nt!KiTrap0E+0x2cf
a3fa37d4 82eb2e29 00000000 633a6000 b1cdf4e0 nt!MiResolveTransitionFault+0x4b3
a3fa3820 82e9b916 00000000 633a6000 c0319d30 nt!MiResolveProtoPteFault+0x3d8
a3fa38a8 82e92dd5 633a6000 00000000 8a1fa730 nt!MiDispatchFault+0x5d6
a3fa3930 82e51638 00000000 633a6000 00000000 nt!MmAccessFault+0x25cc
a3fa3930 82e498f0 00000000 633a6000 00000000 nt!KiTrap0E+0xdc
a3fa39c4 8308c80e a3fa39e8 633a6000 00000004 nt!memcpy+0x130
a3fa3cbc 8308ec8e 8a1fa540 633a6000 8a1fa540 nt!MmCopyVirtualMemory+0x1ad
a3fa3d18 82e4e44a ffffffff 633a6000 01eef9cc nt!NtReadVirtualMemory+0xd5
a3fa3d18 772864f4 ffffffff 633a6000 01eef9cc nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
01eef914 00000000 00000000 00000000 00000000 0x772864f4


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiResolveTransitionFault+4b3
82ea6b38 f6411c20        test    byte ptr [ecx+1Ch],20h

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiResolveTransitionFault+4b3

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cacf

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  0xA_nt!MiResolveTransitionFault+4b3

BUCKET_ID:  0xA_nt!MiResolveTransitionFault+4b3

Followup: MachineOwner
---------

~Lordbob

CarlTR6 · 25 Jun 2010

gedafe said:

Gents,

I updated the "new" drivers for both the mouse and keyboard. I also burned Memtest86 (v3.5) and tried to run it. I say "tried" because the scan only got to about 47% and then shut the computer off and restarted. I don't know what this means. I tried it again a couple times to the same result. Should I have used v3.4 instead or does the restarting mean something else?

Good news so far is that I haven't had a BSOD yet. We'll see what happens tomorrow.

I would say that indicates some bad RAM.

Pull all of your RAM sticks but one and run memtest for at least five passes. If that passes with no errors, repeat with the same stick in a different slot. Test each slot in this manner. This will determine if you have a bad slot.

If all the slots are OK, remove that RAM stick and test the next one in any slot and so on until you test each stick individually.

Report back with the results.

gedafe · 26 Jun 2010

Gents,

Thanks for the new memtest86+ link--it worked just fine--even from a usb drive. Anyway, I ran it for 20 minutes and it cycled through 100 passes. Here's what the readout said:

Walltime 0:19:30
Cached 4087M
RsudMem 264K
MemMap e820
Cache on
ECC off
Test Std
Pass 0
Errors 0

Does this mean that my memory is ok? Just for an update, I haven't had any crashes (knock on wood) since I updated my keyboard and mouse drivers. What do I need to do next?

-Fence