Win7 32-bit Crashing Since Jan 2010

[gedafe]

I installed Win 7 on a new machine back in December. Here are the stats:

OS: 32 bit Win 7 Professional
CPU: Intel core i5-750 2.66GHz 8M LGA1156
Motherboard: MSI P55-GD65 LGA 1156 Intel P55 ATX Intel Motherboard
Memory: Patriot ‘Sector 5’ Edition 4GB (2 x 2GB) 240-Pin DDR3 1333
Graphics Card(s): XFX Radeon HD 4870 512MB PCIe DDR5 Dual DVI
Sound Card: Embedded
Monitor(s) Displays: Sharp LL-172 A-B, Acer AL1703
Hard Drives:

1 TB Hitachi Serial ATA 7200/32MB/SATA-3G
Western Digital Caviar Blue WD5000AAKS 500GB 7200 RPM SATA 3.0Gb/s
Western Digital Caviar Green WD15EARS 1.5TB SATA 3.0Gb/s
​

PSU: Ultra LSP 550w
Case: APEX Vortex 3620 SGCC/ABS ATX Mid Tower Gaming Computer Case
Cooling: Cooler Master Hyper N520 Copper Heatpipe CPU Cooler
Keyboard: steelseries merc
Mouse: Gigabite GM-G6800

I've been having trouble keeping it from getting BSOD for months. It only ran stable for a month, and then beginning end of Jan 2010, it would crash 3-14 times a month, seemingly random: sometimes while playing a game, sometimes when listening to itunes, sometimes when surfing the web, sometimes when using MS office products.

I'm sort of a novice here, but I've read and re-read multiple posts here and on other sites, looking for hints and tips to stabilize the system. I've updated all hardware/software drivers, re-installed AV software, uninstalled incompatible software, checked memory via the Win7 memory checker, etc. Even after doing all that, the longest I've managed to have win7 running without BSOD is 9-20 days.

I've attached the latest crash minidumps from this week, but I've got them for every crash back to 23 Jan 10. Any help would be greatly appreciated.

 

[Pauly]

Two different error codes there
0xa BSOD Index
0x4e BSOD Index

Have you checked the event log for any indications of a faulty service or driver as i suspect this is probably a driver issue, i would download and run memtest86 for a thorough test of the ram

 

[CarlTR6]

Hi Gerald and welcome to seven forums.

Both of these dmps pointed at standby.exe. I believe this is a Corel program called Standby?

I have also found a number of old drivers on your system at the time of the crash. Windows 7 does not like old drivers and they can definitely call BSOD's. I will get back to you on these drivers shortly.

Alpham1.sys Mon Jul 23 03:56:57 2007 - ZBoards keyboard driver
Alpham2.sys Tue Mar 20 05:49:51 2007 - ZBoards keyboard driver
whfltr2k.sys Thu Jan 25 10:45:01 2007 - USB Mouse Lower filter driver, Gigabyte GM-M6800 Driver

I recommend that you update these driver ASAP.[FONT=&quot]
- Search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- visit the web site of the manufacturer of the hardware/program to get the latest drivers (DON'T use Windows Update or the Update driver function of Device Manager).
- if there are difficulties in locating them, post back with questions and someone will try and help you locate the appropriate program. [/FONT]
- - Driver manufacturer links are on this page: Drivers and Downloads

 

[CarlTR6]

I updated my post. You may have to refresh your page.

I also suggest that you uninstall Standby for troubleshooting purposes.

After you update these drivers and uninstall Standby, reboot and we will see how your system is doing.

 

[gedafe]

Gentlemen, thank you for your quick replies.

I am in the process of updating the drivers you suggested--I am downloading them from their respective company websites. I have a really slow internet connection at this location (I miss my fios) and it'll be over an hour before the newer version of the ZEngine for the zboards keyboard driver to be downloaded.

I installed the latest Gigabyte GM-M6800 Driver. The newest one was dated Jan 2009, but as I looked at the particular .sys file, I noted that it was dated 26 Jan 2007--not much newer (a day?) than my current one.

So far no BSOD, but I am still waiting on the keyboard drivers. Although it's the latest one they have, I'm not sure if it's any different from the one I am currently using.

As far as using memtest86, what is it, and how do you use it? I downloaded it from memtest86.com, but I can't figure out how to use it. I assume since it's a .iso file, it needs to be copied/burned to a disc and rebooted from the disc? Heh, I'm a quick learner, but still a novice.

As to the standby.exe, I can't find it. I did a search and it turned up nothing. Where would a program like this be? I went to the control panel-->programs-->programs and features and can't find it in the uninstall list. However, I do see corel videostudio 2010. Is this the same thing?

I'll update the post after I get everything installed or if I get another BSOD.

 

[CarlTR6]

Thanks for the update; that is helpful.

Sometimes, just installing a fresh copy of the same driver solves the problem. Drivers do get corrupted every now and then. Even a newer driver by one day represents a change, an update. And if the software that goes with it has been updated, that makes it all the better.

The other side of the coin is that sometimes you have to bite the bullet and update the hardware if the drivers are obsolete. I had to ditch my webcam and microphone; the old software was not compatible with Win 7.

Regarding memtest (you can delay this until you drivers are all updated if you like), download a copy of Memtest86 and burn the ISO to a CD using Iso Recorder. Boot from the CD, and leave it running for at least 7 passes.

Ask away if you have any questions and keep us updated on your progress.

 

[gedafe]

Gents,

I updated the "new" drivers for both the mouse and keyboard. I also burned Memtest86 (v3.5) and tried to run it. I say "tried" because the scan only got to about 47% and then shut the computer off and restarted. I don't know what this means. I tried it again a couple times to the same result. Should I have used v3.4 instead or does the restarting mean something else?

Good news so far is that I haven't had a BSOD yet. We'll see what happens tomorrow.

 

[Lordbob75]

Both BSoDs were caused by Memory_Corruption, which means bad RAM. Do as suggested above and run Memtest86+ - Advanced Memory Diagnostic Tool.

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\David\AppData\Local\Temp\Temp1_Minidumps.zip\062110-23790-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0x82e1f000 PsLoadedModuleList = 0x82f67810
Debug session time: Mon Jun 21 22:33:02.003 2010 (UTC - 7:00)
System Uptime: 2 days 12:58:25.252
Loading Kernel Symbols
...............................................................
................................................................
.......................................................
Loading User Symbols
Loading unloaded module list
......
3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000002, A list entry was corrupt
Arg2: 00023226, entry in list being removed
Arg3: 000cf77f, highest physical page number
Arg4: 00000020, reference count of entry being removed

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_2

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  Standby.exe

CURRENT_IRQL:  2

TRAP_FRAME:  e3557948 -- (.trap 0xffffffffe3557948)
ErrCode = 00000000
eax=6f8e7004 ebx=00000004 ecx=00000001 edx=00000000 esi=6f8e7000 edi=e35579e8
eip=82e5d8f0 esp=e35579bc ebp=e35579c4 iopl=0         nv up ei ng nz ac pe cy
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010297
nt!memcpy+0x130:
82e5d8f0 8b448efc        mov     eax,dword ptr [esi+ecx*4-4] ds:0023:6f8e7000=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from 82eb9026 to 82efbd10

STACK_TEXT:  
e3557744 82eb9026 0000004e 00000002 00023226 nt!KeBugCheckEx+0x1e
e3557784 82ebabd5 00000000 d9ce1d20 83eec668 nt!MiUnlinkPageFromLockedList+0x51
e35577d4 82ec6e29 00000000 6f8e7000 9ea57ee8 nt!MiResolveTransitionFault+0x550
e3557820 82eaf916 00000000 6f8e7000 c037c738 nt!MiResolveProtoPteFault+0x3d8
e35578a8 82ea6dd5 6f8e7000 00000000 d9ce1d20 nt!MiDispatchFault+0x5d6
e3557930 82e65638 00000000 6f8e7000 00000000 nt!MmAccessFault+0x25cc
e3557930 82e5d8f0 00000000 6f8e7000 00000000 nt!KiTrap0E+0xdc
e35579c4 830a080e e35579e8 6f8e7000 00000004 nt!memcpy+0x130
e3557cbc 830a2c8e d9ce1b30 6f8e7000 d9ce1b30 nt!MmCopyVirtualMemory+0x1ad
e3557d18 82e6244a ffffffff 6f8e7000 01e9f460 nt!NtReadVirtualMemory+0xd5
e3557d18 770464f4 ffffffff 6f8e7000 01e9f460 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
01e9f3a8 00000000 00000000 00000000 00000000 0x770464f4


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiUnlinkPageFromLockedList+51
82eb9026 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiUnlinkPageFromLockedList+51

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cacf

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  0x4E_2_nt!MiUnlinkPageFromLockedList+51

BUCKET_ID:  0x4E_2_nt!MiUnlinkPageFromLockedList+51

Followup: MachineOwner
---------

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\David\AppData\Local\Temp\Temp1_Minidumps.zip\062410-26317-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0x82e0b000 PsLoadedModuleList = 0x82f53810
Debug session time: Thu Jun 24 12:22:30.406 2010 (UTC - 7:00)
System Uptime: 0 days 9:04:19.281
Loading Kernel Symbols
...............................................................
................................................................
......................................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {1c, 2, 0, 82ea6b38}

Probably caused by : memory_corruption ( nt!MiResolveTransitionFault+4b3 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000001c, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 82ea6b38, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from 82f73718
Unable to read MiSystemVaType memory at 82f53160
 0000001c 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!MiResolveTransitionFault+4b3
82ea6b38 f6411c20        test    byte ptr [ecx+1Ch],20h

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  Standby.exe

TRAP_FRAME:  a3fa3948 -- (.trap 0xffffffffa3fa3948)
ErrCode = 00000000
eax=633a6004 ebx=00000004 ecx=00000001 edx=00000000 esi=633a6000 edi=a3fa39e8
eip=82e498f0 esp=a3fa39bc ebp=a3fa39c4 iopl=0         nv up ei ng nz ac pe cy
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010297
nt!memcpy+0x130:
82e498f0 8b448efc        mov     eax,dword ptr [esi+ecx*4-4] ds:0023:633a6000=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from 82ea6b38 to 82e5182b

STACK_TEXT:  
a3fa371c 82ea6b38 badb0d00 00000000 c0319d28 nt!KiTrap0E+0x2cf
a3fa37d4 82eb2e29 00000000 633a6000 b1cdf4e0 nt!MiResolveTransitionFault+0x4b3
a3fa3820 82e9b916 00000000 633a6000 c0319d30 nt!MiResolveProtoPteFault+0x3d8
a3fa38a8 82e92dd5 633a6000 00000000 8a1fa730 nt!MiDispatchFault+0x5d6
a3fa3930 82e51638 00000000 633a6000 00000000 nt!MmAccessFault+0x25cc
a3fa3930 82e498f0 00000000 633a6000 00000000 nt!KiTrap0E+0xdc
a3fa39c4 8308c80e a3fa39e8 633a6000 00000004 nt!memcpy+0x130
a3fa3cbc 8308ec8e 8a1fa540 633a6000 8a1fa540 nt!MmCopyVirtualMemory+0x1ad
a3fa3d18 82e4e44a ffffffff 633a6000 01eef9cc nt!NtReadVirtualMemory+0xd5
a3fa3d18 772864f4 ffffffff 633a6000 01eef9cc nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
01eef914 00000000 00000000 00000000 00000000 0x772864f4


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiResolveTransitionFault+4b3
82ea6b38 f6411c20        test    byte ptr [ecx+1Ch],20h

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiResolveTransitionFault+4b3

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cacf

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  0xA_nt!MiResolveTransitionFault+4b3

BUCKET_ID:  0xA_nt!MiResolveTransitionFault+4b3

Followup: MachineOwner
---------

~Lordbob

 

[CarlTR6]

Gents,

I updated the "new" drivers for both the mouse and keyboard. I also burned Memtest86 (v3.5) and tried to run it. I say "tried" because the scan only got to about 47% and then shut the computer off and restarted. I don't know what this means. I tried it again a couple times to the same result. Should I have used v3.4 instead or does the restarting mean something else?

Good news so far is that I haven't had a BSOD yet. We'll see what happens tomorrow.

I would say that indicates some bad RAM.

Pull all of your RAM sticks but one and run memtest for at least five passes. If that passes with no errors, repeat with the same stick in a different slot. Test each slot in this manner. This will determine if you have a bad slot.

If all the slots are OK, remove that RAM stick and test the next one in any slot and so on until you test each stick individually.

Report back with the results.

 

[gedafe]

Gents,

Thanks for the new memtest86+ link--it worked just fine--even from a usb drive. Anyway, I ran it for 20 minutes and it cycled through 100 passes. Here's what the readout said:

Walltime 0:19:30
Cached 4087M
RsudMem 264K
MemMap e820
Cache on
ECC off
Test Std
Pass 0
Errors 0

Does this mean that my memory is ok? Just for an update, I haven't had any crashes (knock on wood) since I updated my keyboard and mouse drivers. What do I need to do next?

-Fence

 

[Lordbob75]

Gents,

Thanks for the new memtest86+ link--it worked just fine--even from a usb drive. Anyway, I ran it for 20 minutes and it cycled through 100 passes. Here's what the readout said:

Walltime 0:19:30
Cached 4087M
RsudMem 264K
MemMap e820
Cache on
ECC off
Test Std
Pass 0
Errors 0

Does this mean that my memory is ok? Just for an update, I haven't had any crashes (knock on wood) since I updated my keyboard and mouse drivers. What do I need to do next?

-Fence

How did it run so fast?

But yes, it should mean that the RAM is fine.

~Lordbob

 

[gedafe]

Gents,

It seems to me that I indeed spoke too soon. BSOD happened at 5:44 am this morning. I've attached the .dmp file. I believe the only thing running was the Firefox browser. Also, I don't have the computer set to a sleep mode.

 

[CarlTR6]

I would for you to rerun memtest following these instructions. As Lordbob said, your test ran faster than I am used to seeing it run. I want to make sure it ran properly. Download a copy of Memtest86 and burn the ISO to a CD using Iso Recorder. Boot from the CD, and leave it running for at least 5 passes.

The error code is still pointing to a possible memory problem. Error code 1A -

STOP 0x0000001A: MEMORY_MANAGEMENT

Usual causes: Device driver, memory, kernel

I am still finding an old driver running when you had the BSOD:

whfltr2k.sys Thu Jan 25 10:45:01 2007 - USB Mouse Lower filter driver, Gigabyte GM-M6800 Driver. Please update this driver and we will go from there.

 

[gedafe]

Carl,

Thanks, I'll redo the memtest. Just so I'm not missing anything, when it's doing the memtest, the number of passes is listed in the top of the screen along with the type of test it's running, right? I noted that the first time I ran the test the other day, it got to 100 passes, and then reset the pass counter to 1. Did this mean it ran 100 passes, or am I not looking at the right data line?

Also, I went to the Gigabyte website, and re-downloaded their latest mouse driver. Unfortunately, the zip file only includes the driver from Jan 25, 2007. I've attached it for your perusal. The driver (whfltr2k.sys) is located in the driver\win2k_xp_vista folder.

I'll re-run the memtest and get back to you. Another novice question: when the memtest does its five-seven passes, it just keeps running, right? I've got to push escape to get out of it--but does it save a output file? The last time, I just wrote down what was on the screen.

I'll post the results as soon as I get them. Heh, I'm glad you guys are the experts--this BSOD thing is driving me quite mad. Thanks again for all your help.

-Fence

 

[CarlTR6]

Yes, the number of loops or passes is the number of times it has run. After 7 or 8, you can stop it. Memtest gives you a display on the screen and will show you any any errors.

Have you got another mouse you can try - maybe a standard PS2 mouse or a newer USB mouse? If you do, install it and then completely uninstall your current mouse. YOu can always reinstall it it if it proves not to be a the source of your problem. If it were me, I would just buy a new gaming mouse and verify that it is Win 7 compatible before I purchase it.

 

[gedafe]

Carl,

Hah, I'm proving my "noob"-ness. Duh, the pass column says how many passes the memtest has done, not the test row at the top of the screen--that shows what percent of which pass has finished. I think I win the "not-so-bright" post of the day.

Anyway, I've attached a screenshot of the new 5 pass memtest. It also indicates no errors.

Yes, I have another microsoft mouse at home--problem is I won't be home for another 3 months. I guess I can always buy another one. Is that probably what's BSOD-ing this machine? Heh, my first rig killed off by a faulty/old mouse driver...

Not to badger the issue, but could the BSOD be caused by anything else? No other indications that it was caused by a program? If I remember somewhat correctly, the computer liked to crash when Kaspersky was doing deep scans and also when trying to accomplish back-ups. It didn't BSOD all the time, but those are two incidents when the randomness of BSOD didn't seem so random. Just providing more info.

-Fence

 

[gedafe]

Gents,

Hah, no sooner than I posted the last post, guess what--BSOD.

Here's the next minidump. [grumble, grumble]

-Fence

 

[CarlTR6]

Looks like your memory is good; that is good to know. Good job.

You raised something that I need to ask you about, do you still have Kaspersky installed? If so, please uninstall it for the purposes of trouble shooting. Kaspersky is well known for causing BSOD's on Win 7 systems. Replace it with MSE and make sure Windows Firewall is turned on.

I can't really answer your question about the mouse except to say it is certainly possible that the driver could be causing problems. The only way I know to test it is to try another mouse. A 2007 driver is pretty old for a Win 7 system. But, yes, the BSOD could have been caused by something else.

Trouble shooting is a trial and error thing. There is no software that will definitively pin point an exact cause. I wish there were such a critter.

Edited to add - You posted your latest dump while I was posting. I will look at this one and get back.

 

[CarlTR6]

This dmp shows the same error code, 1A - memory management.

Once you have done the things I posted above, I suggest you run Driver Verifier.

Using Driver Verifier to identify issues with Drivers

Please follow these instructions in order to run it:

Using Driver Verifier is an iffy proposition. Most times it'll crash and it'll tell you what the driver is. But sometimes it'll crash and won't tell you the driver. Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.

So, I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Windows 7 Startup Repair feature).

Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out. If it doesn't crash for you, then let it run for at least 36 hours of continuous operation (an estimate on my part).

Reboot into Windows (after the crash) and turn off Driver Verifier by going back in and selecting "Delete existing settings" on the first page, then locate and zip up the memory dump file and upload it with your next post.

If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.
If that doesn't work, post back and we'll have to see about fixing the registry entry off-line.

More info on this at this link: Using Driver Verifier to identify issues with Windows drivers for advanced users

 

[gedafe]

Carl,

Ooo, that was pretty scary for a computer novice--I'm in safe mode, but the computer seemed like it was in an infinite loop of BSODs after I went into verifier. I went back and zipped the multiple crashes (attached). It seemed to have a different code after each crash.

Hopefully, after this update, I can get back into normal mode. What is the next step? Are the minidumps any more help this time?

-Fence