BSOD 41(63), Second clean install

[edeedbeebe]

Win7 Pro x86 (32-bit)
Original installed OS
OEM
Age of system (hardware): 2010 December
Age of OS installation: Two days

I did complete SFC /SCANNOW without any errors. I've run a diagnostic on the memory that didn't turn up anything and my case is running cool. I have several others from the same lot that are all working well (including the one I'm on now). I did get my first BSOD this time around after install of SP1 install without restart yet. After installing AVG (I know...) it occurred again. I can't really give this computer to anyone until it doesn't crash randomly.

I am very appreciative of any help! Thanks!

 

[writhziden]

[list=1]
[*]

Loading Dump File [F:\BSODDmpFiles\edeedbeebe\Windows_NT6_BSOD_jcgriff2\012412-29515-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17713.x86fre.win7sp1_gdr.111025-1505
Machine Name:
Kernel base = 0x82844000 PsLoadedModuleList = 0x8298d4d0
Debug session time: Tue Jan 24 14:11:01.044 2012 (GMT-7)
System Uptime: 0 days 0:07:21.699
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {8c62ec80, 2, 1, 828d1eda}

Probably caused by : memory_corruption ( nt!MiUnlinkPageFromLockedList+258 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 8c62ec80, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 828d1eda, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from 829ad848
Unable to read MiSystemVaType memory at 8298ce20
 8c62ec80 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!MiUnlinkPageFromLockedList+258
828d1eda 89441a04        mov     dword ptr [edx+ebx+4],eax

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  8a743bb4 -- (.trap 0xffffffff8a743bb4)
ErrCode = 00000002
eax=ffffffff ebx=83a00000 ecx=ae06f629 edx=08c2ec7c esi=83ef6560 edi=8298ca94
eip=828d1eda esp=8a743c28 ebp=8a743c4c iopl=0         ov up ei ng nz ac po cy
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010a93
nt!MiUnlinkPageFromLockedList+0x258:
828d1eda 89441a04        mov     dword ptr [edx+ebx+4],eax ds:0023:8c62ec80=cc8b4eea
Resetting default scope

LAST_CONTROL_TRANSFER:  from 828d1eda to 828855fb

STACK_TEXT:  
8a743bb4 828d1eda badb0d00 08c2ec7c 000001ff nt!KiTrap0E+0x2cf
8a743c4c 828b9600 00000000 84888430 868fb378 nt!MiUnlinkPageFromLockedList+0x258
8a743cec 828b9ab0 868fb378 00000000 84888430 nt!MiGatherMappedPages+0x777
8a743d50 82a4cfda 00000000 a1062977 00000000 nt!MiMappedPageWriter+0x13d
8a743d90 828f51f9 828b9973 00000000 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiUnlinkPageFromLockedList+258
828d1eda 89441a04        mov     dword ptr [edx+ebx+4],eax

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiUnlinkPageFromLockedList+258

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4ea76eb4

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  0xA_nt!MiUnlinkPageFromLockedList+258

BUCKET_ID:  0xA_nt!MiUnlinkPageFromLockedList+258

Followup: MachineOwner
---------
[*]
Loading Dump File [F:\BSODDmpFiles\edeedbeebe\Windows_NT6_BSOD_jcgriff2\012312-12511-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16905.x86fre.win7_gdr.111025-1503
Machine Name:
Kernel base = 0x82853000 PsLoadedModuleList = 0x8299b810
Debug session time: Mon Jan 23 19:42:59.075 2012 (GMT-7)
System Uptime: 0 days 0:59:44.730
Loading Kernel Symbols
...............................................................
................................................................
.........
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {b80024, ff, 0, 828d8413}

Probably caused by : ntkrpamp.exe ( nt!PoIdle+17c )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00b80024, memory referenced
Arg2: 000000ff, IRQL
Arg3: 00000000, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 828d8413, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from 829bb718
Unable to read MiSystemVaType memory at 8299b160
 00b80024 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!PoIdle+17c
828d8413 3b7004          cmp     esi,dword ptr [eax+4]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  82979c2c -- (.trap 0xffffffff82979c2c)
ErrCode = 00000000
eax=00b80020 ebx=000004ed ecx=00000000 edx=000184e5 esi=00000000 edi=8297cd20
eip=828d8413 esp=82979ca0 ebp=82979d20 iopl=0         nv up di pl nz ac po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010012
nt!PoIdle+0x17c:
828d8413 3b7004          cmp     esi,dword ptr [eax+4] ds:0023:00b80024=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from 828d8413 to 8289986b

STACK_TEXT:  
82979c2c 828d8413 badb0d00 000184e5 8ea676e8 nt!KiTrap0E+0x2cf
82979d20 828bb14d 00000000 0000000e 00000000 nt!PoIdle+0x17c
82979d24 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0xd


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!PoIdle+17c
828d8413 3b7004          cmp     esi,dword ptr [eax+4]

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!PoIdle+17c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4ea76ed3

FAILURE_BUCKET_ID:  0xA_nt!PoIdle+17c

BUCKET_ID:  0xA_nt!PoIdle+17c

Followup: MachineOwner
---------


[/list]

1. Possible causes are Memory problems... Corrupted hard disk system files... Corrupted System Files... Lack of Windows updates... Antivirus Software...
2. Possible causes are Memory problems... Corrupted hard disk system files... Corrupted System Files... Lack of Windows updates... Antivirus Software...

Thanks to Dave76 for help understanding possible causes.


What kind of memory diagnostic did you run? How long did it run?

We will start with the most likely, common problems first (see bold possible causes). Do the following steps and test after each to see if stability increases (the memory tests you can run concurrently as they will not increase stability unless you are forced to move modules around). Post back your results after each step, and if you get a blue screen crash, upload the files again and await further instructions after we are able to analyze the crash.

• If you are overclocking anything, please stop.
  
  
  
• Remove AVG at least for testing using its remover from AVG - Download tools and utilities and install AVG - Download tools and utilities in its place to run with Windows firewall.
  
  
  
• Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).
  
  
  
• Update your Intel graphics driver:

  igdkmd32	8ea28000	8ef25000	Wed May 06 12:13:40 2009 (4a01d354)	0048df97		igdkmd32.sys

  Use the Intel® Driver Update Utility
  

 

[edeedbeebe]

Thank-you for those instructions. I've attached the new results after:
- Removed AVG with uninstall tool
- Updated Intel graphics driver
- Completed 10 passes of memtest without any errors

No further Windows updates are available, nor were any suppressed. I'm not overclocking or modifying anything - It's a basic cheap workstation from Dell. The previous tests I had run were Dell Diagnostics from the utility partition before the most recent re-install. I will begin the Windows Memory Diagnostics Tool now and let it run overnight.

 

[writhziden]

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [H:\BSODDmpFiles\edeedbeebe\Windows_NT6_BSOD_jcgriff2\012412-18283-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17713.x86fre.win7sp1_gdr.111025-1505
Machine Name:
Kernel base = 0x82855000 PsLoadedModuleList = 0x8299e4d0
Debug session time: Tue Jan 24 18:41:27.806 2012 (UTC - 7:00)
System Uptime: 0 days 4:26:43.476
Loading Kernel Symbols
...............................................................
................................................................
...................
Loading User Symbols
Loading unloaded module list
..............................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 828f537b, 94fcfb44, 0}

Probably caused by : memory_corruption ( nt!MiRemoveMappedView+3c4 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 828f537b, The address that the exception occurred at
Arg3: 94fcfb44, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!MiRemoveMappedView+3c4
828f537b ff4808          dec     dword ptr [eax+8]

TRAP_FRAME:  94fcfb44 -- (.trap 0xffffffff94fcfb44)
ErrCode = 00000002
eax=7866744e ebx=86a1fa20 ecx=855e5030 edx=866ced28 esi=8299e960 edi=855e5030
eip=828f537b esp=94fcfbb8 ebp=94fcfc78 iopl=0         nv up ei pl zr na pe cy
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010247
nt!MiRemoveMappedView+0x3c4:
828f537b ff4808          dec     dword ptr [eax+8]    ds:0023:78667456=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x8E

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 828f4f91 to 828f537b

STACK_TEXT:  
94fcfc78 828f4f91 00000000 8697a878 855e5030 nt!MiRemoveMappedView+0x3c4
94fcfca0 82a9c357 855e5030 00000000 ffffffff nt!MiRemoveVadAndView+0xe5
94fcfd04 82aba74f 866ceb38 00ee0000 00000000 nt!MiUnmapViewOfSection+0x265
94fcfd24 8289321a ffffffff 00ee0000 0306f588 nt!NtUnmapViewOfSection+0x55
94fcfd24 77c87094 ffffffff 00ee0000 0306f588 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
0306f588 00000000 00000000 00000000 00000000 0x77c87094


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiRemoveMappedView+3c4
828f537b ff4808          dec     dword ptr [eax+8]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!MiRemoveMappedView+3c4

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4ea76eb4

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  0x8E_nt!MiRemoveMappedView+3c4

BUCKET_ID:  0x8E_nt!MiRemoveMappedView+3c4

Followup: MachineOwner
---------

Let us know how the memory diagnostic goes. This is still pointing to memory.

 

[edeedbeebe]

Hi,

The memory diagnostic passed without a hitch - I also ran Dell's boot diagnostics from DVD and passed the "Windows Blue Screen" (from their symptom tree selection). Before I ran the Dell tests I removed the CMOS battery and reseated the RAM sticks. I'm going to use the computer today to see if it BSODs again. Attached are the reports. I'm concerned that a component within the motherboard is causing the issue and I'm kicking myself for not returning it to Dell within the return timeframe.

 

[writhziden]

Hi,

The memory diagnostic passed without a hitch - I also ran Dell's boot diagnostics from DVD and passed the "Windows Blue Screen" (from their symptom tree selection). Before I ran the Dell tests I removed the CMOS battery and reseated the RAM sticks. I'm going to use the computer today to see if it BSODs again. Attached are the reports. I'm concerned that a component within the motherboard is causing the issue and I'm kicking myself for not returning it to Dell within the return timeframe.

It may be the motherboard or it could be an underlying driver that is causing problems. That will be the next set of tests if the RAM re-seating does not yield more stability...

How much memory originally came with the system? 2 GB is the minimum for Windows 7, so I am a little surprised you are running with so little RAM unless it is for diagnostic purposes, in which case it is fine.



Any luck with the RAM re-seating?