Blue Screen, Please Help :(

[Niicoo]

Hi guys. ive had a blue screen twice this week, it happens randomly, can be days, hours. i just cant figure out what it is! ive uploaded Dump files below! Thanks.

 

[HarriePateman]

I found this on multiple instances in your Event log.

Event[8481]:
  Log Name: System
  Source: Microsoft-Windows-MemoryDiagnostics-Results
  Date: 2014-06-30T16:26:25.889
  Event ID: 1202
  Task: N/A
  Level: Error
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: Nico-PC
  Description: 
[COLOR="Red"]The Windows Memory Diagnostic tested the computer's memory and detected hardware errors. To identify and repair these problems, contact the computer manufacturer[/COLOR]

I have also found some very interesting things in your dump report. But im going to ask some friends to have a look as im not to sure.

 

[Niicoo]

Thank you so much! really appreciated

 

[HarriePateman]

No worries, i have sent "TheDoctor44" a message not sure when he will get here.

 

[Niicoo]

Got this also, if it helps....

Crash Dump Analysis provided by OSR Open Systems Resources, Inc. (OSR Homepage - OSR)
Online Crash Dump Analysis Service
See OSR Online - The Home Page for Windows Driver Developers for more information
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.18409.amd64fre.win7sp1_gdr.140303-2144
Machine Name:
Kernel base = 0xfffff800`02e68000 PsLoadedModuleList = 0xfffff800`030ab890
Debug session time: Mon Jun 30 10:21:10.133 2014 (UTC - 4:00)
System Uptime: 0 days 5:41:29.383
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff88011140dbb, The address that the exception occurred at
Arg3: fffff88003edf228, Exception Record Address
Arg4: fffff88003edea80, Context Record Address

Debugging Details:
------------------

TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
atikmdag+c7dbb
fffff880`11140dbb 488b83a8060000 mov rax,qword ptr [rbx+6A8h]

EXCEPTION_RECORD: fffff88003edf228 -- (.exr 0xfffff88003edf228)
ExceptionAddress: fffff88011140dbb (atikmdag+0x00000000000c7dbb)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 00000000000006a8
Attempt to read from address 00000000000006a8

CONTEXT: fffff88003edea80 -- (.cxr 0xfffff88003edea80)
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=00000000003c0000 rdi=0000000000000002
rip=fffff88011140dbb rsp=fffff88003edf460 rbp=fffffa8008322960
r8=0000000000000002 r9=000000f417fb0000 r10=0000000000000000
r11=fffff88003edf690 r12=fffffa8008810f40 r13=fffffa80079215c0
r14=fffffa800c9cd740 r15=fffff88011079000
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00210246
atikmdag+0xc7dbb:
fffff880`11140dbb 488b83a8060000 mov rax,qword ptr [rbx+6A8h] ds:002b:00000000`000006a8=????????????????
Resetting default scope

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: 0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: 00000000000006a8

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003115100
GetUlongFromAddress: unable to read from fffff800031151c0
00000000000006a8 Nonpaged pool

FOLLOWUP_IP:
atikmdag+c7dbb
fffff880`11140dbb 488b83a8060000 mov rax,qword ptr [rbx+6A8h]

BUGCHECK_STR: 0x7E

LAST_CONTROL_TRANSFER: from fffff88000000001 to fffff88011140dbb

STACK_TEXT:
fffff880`03edf460 fffff880`00000001 : fffff880`00000000 fffffa80`08810f00 00000000`00000000 fffffa80`0c9cd740 : atikmdag+0xc7dbb
fffff880`03edf468 fffff880`00000000 : fffffa80`08810f00 00000000`00000000 fffffa80`0c9cd740 fffff880`111a1f6f : 0xfffff880`00000001
fffff880`03edf470 fffffa80`08810f00 : 00000000`00000000 fffffa80`0c9cd740 fffff880`111a1f6f 00000000`00000000 : 0xfffff880`00000000
fffff880`03edf478 00000000`00000000 : fffffa80`0c9cd740 fffff880`111a1f6f 00000000`00000000 fffff880`11f99181 : 0xfffffa80`08810f00


SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: atikmdag+c7dbb

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: atikmdag

IMAGE_NAME: atikmdag.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 53508a3c

STACK_COMMAND: .cxr 0xfffff88003edea80 ; kb

FAILURE_BUCKET_ID: X64_0x7E_atikmdag+c7dbb

BUCKET_ID: X64_0x7E_atikmdag+c7dbb

Followup: MachineOwner
---------

 

[Thedoctor44]

When you next post a lot of text from Windbg please use the # symbol and past the information between the [CODE] [/CODE]

BugCheck 1000007E, {[COLOR="Red"]ffffffffc0000005[/COLOR], [COLOR="Green"]fffff88011140dbb[/COLOR], fffff88003edf228, fffff88003edea80}

This bugcheck indicates an exception wasn't handled, more specifically an access violation which is where system memory was referenced that the CPU couldn't physically address.

EXCEPTION_RECORD:  fffff88003edf228 -- (.exr 0xfffff88003edf228)
ExceptionAddress: fffff88011140dbb (atikmdag+0x00000000000c7dbb)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 00000000000006a8
Attempt to read from address [COLOR="Red"]00000000000006a8[/COLOR]

It attempted to read from that address which is clearly invalid as its deemed reserved altogether.

rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=00000000003c0000 rdi=0000000000000002
rip=[COLOR="orange"]fffff88011140dbb[/COLOR] rsp=fffff88003edf460 rbp=fffffa8008322960
 r8=0000000000000002  r9=000000f417fb0000 r10=0000000000000000
r11=fffff88003edf690 r12=fffffa8008810f40 r13=fffffa80079215c0
r14=fffffa800c9cd740 r15=fffff88011079000
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00210246
atikmdag+0xc7dbb:
fffff880`11140dbb 488b83a8060000  mov     rax,qword ptr [[COLOR="red"]rbx+6A8h[/COLOR]] ds:002b:[COLOR="red"]00000000`000006a8[/COLOR]=????????????????

We can see the register rbx was dereferenced and added 6A8 which results in a memory read to that address which is invalid.

4: kd> [COLOR="green"]lm vm atikmdag[/COLOR]
start             end                 module name
fffff880`11079000 fffff880`11f89000   atikmdag T (no symbols)           
    Loaded symbol image file: atikmdag.sys
    Image path: atikmdag.sys
    Image name: atikmdag.sys
    Timestamp:        [COLOR="Red"]Fri Apr 18 03:13:16 2014[/COLOR] (53508A3C)
    CheckSum:         00EAEEE6
    ImageSize:        00F10000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Your display driver is quite new but I recommend using 13.9 as its the most stable driver so far I believe.

 

[Niicoo]

Thank you for the quick reply's so from what am reading i need to update driver to 13.9 and there's a problem with my RAM?

 

[Thedoctor44]

No sorry for getting the wrong end of the stick, the display driver is problematic so updating it to 13.9 should do the trick.
It's the way the current driver has been allocating memory which is causing problems, not the memory itself.

 

[Niicoo]

ahhh thats even better lol so its just a driver problem then? *noob*

 

[Niicoo]

I uninstalled the Cata display drivers, and installed 13.9, rebooted etc. just ran Windows diagnostic memory test and its coming up with memory hardware issues detected still, although i did move the ram into the black sockets from the blue, think it could be that? although i dont think it matters......... Thanks.

 

[Thedoctor44]

Oh, maybe it is RAM as well.
I forgot about HLPTech's post when he looked into the event log, in fact that explains a lot.
It might be a bad DIMM slot, move the stick(s) to the alternative slot(s) and see if that helps, if so its a bad board and you should replace it.
If not then its bad RAM.

 

[HarriePateman]

Oh, maybe it is RAM as well.
I forgot about HLPTech's post when he looked into the event log, in fact that explains a lot.
It might be a bad DIMM slot, move the stick(s) to the alternative slot(s) and see if that helps, if so its a bad board and you should replace it.
If not then its bad RAM.

Possibly try a mem test?

 

[Niicoo]

Thank you so much for your help guys, what ive done is went to 13.9 drivers, ive tested both bits of ram on windows memory diagnostics and 1 of them is faulty. so im just going to run on 4GB till i replace it, its still under warranty so thats good news. <3

 

[HarriePateman]

No worries glad we could help.