Solved BSOD - ntoskrnl.exe after changing RAM. Bad RAM?

[cipley]

Hello,

My friend is experiencing BSOD many times since his laptop changed RAM. upgraded from 2GB to 4GB
Chances are the RAM is faulty, but I want to look deeper into the cause...

I attached the dump files. and also the output from WhoCrashed if it helps...

--------------------------------------------------------------------------------
Crash Dump Analysis
--------------------------------------------------------------------------------

Crash dump directory: C:\Windows\Minidump

Crash dumps are enabled on your computer.

On Mon 4/29/2013 4:01:36 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\042913-20092-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x80640)
Bugcheck code: 0x7F (0x8, 0x80050031, 0x6F8, 0xFFFFF80002C7F769)
Error: UNEXPECTED_KERNEL_MODE_TRAP
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This bug check indicates that the Intel CPU generated a trap and the kernel failed to catch this trap.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Mon 4/29/2013 3:18:52 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\042913-16036-01.dmp
This was probably caused by the following module: atikmdag.sys (0xFFFFF88004BB4092)
Bugcheck code: 0x50 (0xFFFFF88009001420, 0x0, 0xFFFFF88004BB4092, 0x0)
Error: PAGE_FAULT_IN_NONPAGED_AREA
Bug check description: This indicates that invalid system memory has been referenced.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: atikmdag.sys .
Google query: atikmdag.sys PAGE_FAULT_IN_NONPAGED_AREA



On Sun 4/28/2013 11:25:57 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\042913-16504-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x80640)
Bugcheck code: 0xA (0x3, 0x2, 0x1, 0xFFFFF80002C7F82F)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Sun 4/28/2013 5:38:46 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\042913-19593-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x80640)
Bugcheck code: 0x3B (0xC000001D, 0xFFFFF80002F1F21B, 0xFFFFF88002BD3090, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Sun 4/28/2013 2:38:49 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\042813-20607-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x80640)
Bugcheck code: 0xA (0xF60000, 0x2, 0x1, 0xFFFFF80002AD8B12)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Sun 4/28/2013 1:36:59 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\042813-21886-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x80640)
Bugcheck code: 0x50 (0xFFFFF80012ABAF38, 0x8, 0xFFFFF80012ABAF38, 0x2)
Error: PAGE_FAULT_IN_NONPAGED_AREA
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that invalid system memory has been referenced.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Sun 4/28/2013 12:49:32 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\042813-22261-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x80640)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF80002D5CDA3, 0xFFFFF88008572080, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.




--------------------------------------------------------------------------------
Conclusion
--------------------------------------------------------------------------------

7 crash dumps have been found and analyzed. A third party driver has been identified to be causing system crashes on your computer. It is strongly suggested that you check for updates for these drivers on their company websites. Click on the links below to search with Google for updates for these drivers:

atikmdag.sys

If no updates for these drivers are available, try searching with Google on the names of these drivers in combination the errors that have been reported for these drivers and include the brand and model name of your computer as well in the query. This often yields interesting results from discussions from users who have been experiencing similar problems.

any help will be appreciated

 

[Arc]

The crashes are either not showing anything precisely, or indicating to ATI display driver.

As you are saying that those BSODs took place after ram upgradation, test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

Also update your ATI/AMD display driver.
You can get it from the link in our forum, http://www.sevenforums.com/graphic-...alyst-video-driver-windows-7-a.html#post17671, or you may go to AMD Graphics Driver and Software and opt for Automatically Detect and Install the appropriate driver for your card.

During installation, you may opt for advanced installation, and install the display driver only, not the Catalyst Control Center.

Let us know the results.
__________________________________________________________________
BSOD ANALYSIS:

BugCheck A, {f60000, 2, 1, fffff80002ad8b12}

Probably caused by : win32k.sys ( win32k!xxxRealSleepThread+267 )

Followup: MachineOwner
--------------------------------------------------------------------------------
BugCheck 50, {fffff80012abaf38, 8, fffff80012abaf38, 2}


Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+448c6 )

Followup: MachineOwner
---------------------------------------------------------------------------------
BugCheck 3B, {c0000005, fffff80002d5cda3, fffff88008572080, 0}

Probably caused by : ntkrnlmp.exe ( nt!PspDereferenceQuotaBlock+17 )

Followup: MachineOwner
---------------------------------------------------------------------------------
BugCheck 50, {fffff88009001420, 0, fffff88004bb4092, 0}

*** WARNING: Unable to verify timestamp for atikmdag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmdag.sys

Could not read faulting driver name
Probably caused by : atikmdag.sys ( atikmdag+3a6092 )

Followup: MachineOwner
---------

 

[cipley]

The crashes are either not showing anything precisely, or indicating to ATI display driver.

As you are saying that those BSODs took place after ram upgradation, test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

Also update your ATI/AMD display driver.
You can get it from the link in our forum, http://www.sevenforums.com/graphic-...alyst-video-driver-windows-7-a.html#post17671, or you may go to AMD Graphics Driver and Software and opt for Automatically Detect and Install the appropriate driver for your card.

During installation, you may opt for advanced installation, and install the display driver only, not the Catalyst Control Center.

Let us know the results.
__________________________________________________________________
BSOD ANALYSIS:

BugCheck A, {f60000, 2, 1, fffff80002ad8b12}

Probably caused by : win32k.sys ( win32k!xxxRealSleepThread+267 )

Followup: MachineOwner
--------------------------------------------------------------------------------
BugCheck 50, {fffff80012abaf38, 8, fffff80012abaf38, 2}


Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+448c6 )

Followup: MachineOwner
---------------------------------------------------------------------------------
BugCheck 3B, {c0000005, fffff80002d5cda3, fffff88008572080, 0}

Probably caused by : ntkrnlmp.exe ( nt!PspDereferenceQuotaBlock+17 )

Followup: MachineOwner
---------------------------------------------------------------------------------
BugCheck 50, {fffff88009001420, 0, fffff88004bb4092, 0}

*** WARNING: Unable to verify timestamp for atikmdag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmdag.sys

Could not read faulting driver name
Probably caused by : atikmdag.sys ( atikmdag+3a6092 )

Followup: MachineOwner
---------

I figured that I had to use memtest86+, but is it also applicable to 64 bit machine?
the "86" number makes me think that it can only run on x86 ones

If so, I had to do it myself on his lappies, so might take time to update the result here.
However, I did mdsched.exe. If I read correctly, it's Windows' default memory checking utility. Will it be sufficient?

As for the driver update, I can do it remotely I guess

 

[Arc]

The 86+ is just the name .... nothing significant. It runs on any machine, as it runs as bootable and not within windows.

Windows memory diagnostic tool is insufficient, and memtest 86+ is a superior tool over it.

As you have to run memtest overnight, so your reply is expected to come at a late

 

[cipley]

ok...this happened again.
I attached the most recent dumpfile.

meanwhile, I'm about to do the memtest...will update later.

 

[Arc]

Please let us know when memtest is done.

Edit: It indicates to ESET Amon driver.

fffff880`02b489b0  fffff880`03caf100Unable to load image \SystemRoot\system32\DRIVERS\[URL="http://www.carrona.org/drivers/driver.php?id=eamonm.sys"]eamonm.sys[/URL], Win32 error 0n2
*** WARNING: Unable to verify timestamp for [URL="http://www.carrona.org/drivers/driver.php?id=eamonm.sys"]eamonm.sys[/URL]
*** ERROR: Module load completed but symbols could not be loaded for [URL="http://www.carrona.org/drivers/driver.php?id=eamonm.sys"]eamonm.sys[/URL]
 eamonm+0x2c100

Description here: Driver Reference Table - eamonm.sys

Uninstall ESET from the uninstaller listed in Uninstallers (removal tools) for common antivirus software - ESET Knowledgebase

Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.
Download, install and update those, and then run full system scans with both of them, one by one.

 

[cipley]

Please let us know when memtest is done.

Edit: It indicates to ESET Amon driver.

fffff880`02b489b0  fffff880`03caf100Unable to load image \SystemRoot\system32\DRIVERS\[URL="http://www.carrona.org/drivers/driver.php?id=eamonm.sys"]eamonm.sys[/URL], Win32 error 0n2
*** WARNING: Unable to verify timestamp for [URL="http://www.carrona.org/drivers/driver.php?id=eamonm.sys"]eamonm.sys[/URL]
*** ERROR: Module load completed but symbols could not be loaded for [URL="http://www.carrona.org/drivers/driver.php?id=eamonm.sys"]eamonm.sys[/URL]
 eamonm+0x2c100

Description here: Driver Reference Table - eamonm.sys

Uninstall ESET from the uninstaller listed in Uninstallers (removal tools) for common antivirus software - ESET Knowledgebase

Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.
Download, install and update those, and then run full system scans with both of them, one by one.

does that mean ESET was the culprit?
I installed ESET on his because I use it also on my system...and I trust it

I'll download them then. appreciate the prompt reply

 

[Arc]

Yes, it indicates ESET as the failing element. But the memtest is necessary.

I also trust ESET. Used it earlier over a long time (3 years) before being a member of SevenForums. But it is the fact that sometimes ESTE causes bluescreens.

 

[cipley]

Yes, it indicates ESET as the failing element. But the memtest is necessary.

I also trust ESET. Used it earlier over a long time (3 years) before being a member of SevenForums. But it is the fact that sometimes ESTE causes bluescreens.

ok, here's something from the memtest...I don't know how to get the result as file, so I literally get a picture of it

So, I think the RAM is also the culprit?

 

[Arc]

RAM was the first and the main culprit. A single red line in memtest indicates to corrupted RAM. As the RAM is new, get it replaced. Make it sure that the new RAM is matching with the systems specification.

Let us know how the computer is running with the replacement RAM.

 

[cipley]

RAM was the first and the main culprit. A single red line in memtest indicates to corrupted RAM. As the RAM is new, get it replaced. Make it sure that the new RAM is matching with the systems specification.

Let us know how the computer is running with the replacement RAM.

thought so...I guess I'll have to help him get the replacement.
in the meantime, his laptop's now using the old RAM...until now he said there's no further BSOD occurring

another thing...the old RAM is PC12800 while the new RAM is PC10666.
the spec of his laptop says it support both. so, does it relate in any way to the BSOD or it's just simply messed up RAM?

 

[Arc]

For Non-supported RAM, the problem should be bigger. As the laptop supports the both, it appears to be a corrupted RAM only.

And if it is working good with the original RAM, let it work

 

[cipley]

For Non-supported RAM, the problem should be bigger. As the laptop supports the both, it appears to be a corrupted RAM only.

And if it is working good with the original RAM, let it work

Then faulty RAM it is...

Thanks very much for your help, Arc not only this helping me solving the problem, I also get new things about troubleshooting

I hope I can contribute something to the community also, although maybe I have much to catch on....

Cheers

 

[Arc]

You are welcome mate
Contribute here ... it will enrich all of us.