BSOD after changing from 4GB to 8GB SODIMM RAM

[AlexBrunt]

I was using my laptop after changing my ram from 4GB to 8GB and it was working then it just suddenly bluescreened at first I thought it was just adjusting now it bluescreens after about 30 to 45 mins of use, I have attached the latest minidump file.

Please help,
as I am currently building a website and cannot have my laptop constantly going to the BSOD

and sorry for not posting according to the posting instructions

 

[x BlueRobot]

Please follow - http://www.sevenforums.com/bsod-help-support/96879-blue-screen-death-bsod-posting-instructions.html

 

[AlexBrunt]

Edited Post

I have edited the post so it now complys with the posting instructions.

 

[x BlueRobot]

[COLOR="Red"]BugCheck 1A[/COLOR], {[COLOR="Blue"]41790[/COLOR], [COLOR="SeaGreen"]fffffa80018ed6f0[/COLOR], [COLOR="Orange"]ffff[/COLOR], 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+35084 )

Usual causes:  Device driver, memory, kernel

It appears that the page table is corrupt, this is used to store the mappings between virtual and physical memory addresses. Furthermore, we can see that the reference count for the number of PTE's has dropped below zero, when a PFN is locked against a virtual address range, then the reference count is incremented, although, when a PFN is unlocked then the reference count is decremented. A device driver has been unlocking physical pages more often than locking the physical pages, thus causing the reference count to below zero.

kd> [COLOR="SeaGreen"]dt nt!_MMPFN fffffa80018ed6f0[/COLOR]
   +0x000 u1               : <unnamed-tag>
   +0x008 u2               : <unnamed-tag>
   +0x010 PteAddress       : 0xfffff6fb`40001d58 _MMPTE <-- PTE linked to current PFN
   +0x010 VolatilePteAddress : 0xfffff6fb`40001d58 Void
   +0x010 Lock             : 0n1073749336
   +0x010 PteLong          : 0xfffff6fb`40001d58
   +0x018 u3               : <unnamed-tag>
   +0x01c UsedPageTableEntries : [COLOR="Red"]0xffff[/COLOR]
   +0x01e VaType           : 0 ''
   +0x01f ViewCount        : 0 ''
   +0x020 OriginalPte      : _MMPTE
   +0x020 AweReferenceCount : 0n128
   +0x028 u4               : <unnamed-tag>

Run Driver Verifier to scan for any corrupted drivers which may be causing problems, this program works by running various stress tests on drivers, in order to produce a BSOD which will locate the driver; run for least 24 hours:

• http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

   Information

Additional Help - http://www.sevenforums.com/crash-lo...-driver-verifier-identify-issues-drivers.html

From another (Stop 0x24) bugcheck,

kd> [COLOR="SeaGreen"]lmvm athrx[/COLOR]
start             end                 module name
fffff880`06c2d000 fffff880`06ffc000   athrx    T (no symbols)           
    Loaded symbol image file: athrx.sys
    Image path: \SystemRoot\system32\DRIVERS\athrx.sys
    Image name: athrx.sys
    Timestamp:        [COLOR="Red"]Fri Nov 23 04:51:22 2012[/COLOR] (50AF00CA)
    CheckSum:         003B74A3
    ImageSize:        003CF000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Please update your Atheros driver either from your motherboard support page, or check the Device Manager for the model number of your network adapter and then update from the Atheros website - ATHEROS drivers for Microsoft Windows (Atheros?????)

Remove:

Start Menu\Programs\DAEMON Tools Lite

Download SPTD standalone installer from Disk-Tools.com, and execute the downloaded file as guided below :

• Double click to open it.
• Click this button only:
• 
• If it is grayed out, as in the picture, there is no more SPTD in your system, and you just close the window.

Daemon Tools uses a driver called sptd.sys, which is known to cause BSODs with Windows 7. It is recommend you remove this program, and use Windows own in-built features or ImgBurn.

 

[AlexBrunt]

Upon running driver verifier, I got a bluescreen at startup stating that usbfilter.sys, a driver from AMD, has been trying to use memory after it has been freed.

What should I do?

Look for an updated driver on AMD's website, or just uninstall it.

Thanks for the help so far.

 

[YoYo155]

Upload the new dump files(s) .

 

[AlexBrunt]

New Dump Files:

 

[x BlueRobot]

[COLOR="Red"]BugCheck D5[/COLOR], {fffff98007dc0df0, 0, fffff88004e961aa, 0}

*** WARNING: Unable to verify timestamp for usbfilter.sys
*** ERROR: Module load completed but symbols could not be loaded for usbfilter.sys

Could not read faulting driver name
Probably caused by : [COLOR="Red"]usbfilter.sys[/COLOR] ( usbfilter+41aa )

Usual causes:  Device driver

The above driver has referenced a memory address which was already freed, and then produced a page fault.

TRAP_FRAME:  fffff88002f89280 -- ([COLOR="SeaGreen"].trap 0xfffff88002f89280[/COLOR])
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffff88002f89478
[COLOR="Red"]rdx=fffff98007dc0dc0[/COLOR] rsi=0000000000000000 rdi=0000000000000000
rip=fffff88004e961aa rsp=fffff88002f89410 rbp=0000000000000002
 r8=0000000000000000  r9=fffff88004e961a5 r10=0000000000000100
r11=fffff8000300ae80 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
[COLOR="Blue"]usbfilter+0x41aa:[/COLOR]
fffff880`04e961aa 8b4230          mov     eax,dword ptr [COLOR="Red"][rdx+30h][/COLOR] ds:fffff980`07dc0df0=????????

kd> [COLOR="SeaGreen"]lmvm usbfilter[/COLOR]
start             end                 module name
fffff880`04e92000 fffff880`04e9f000   usbfilter T (no symbols)           
    Loaded symbol image file: usbfilter.sys
    Image path: \SystemRoot\system32\DRIVERS\usbfilter.sys
    Image name: usbfilter.sys
    Timestamp:        [COLOR="Red"]Tue Dec 22 08:26:22 2009[/COLOR] (4B3082AE)
    CheckSum:         0000DFD8
    ImageSize:        0000D000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Your AMD USB Filter driver seems to be causing the problem, and is part of your chipset, please update your chipset driver from your motherboard support page or from here - Support & Drivers

 

[AlexBrunt]

There is no update to the chipset

What should I do?
Remove it?

Edit: I did a little bit of my own research and it turns out that all usbfilter.sys does is act on filtering out USB 1.0/1.1 devices.

Upon searching through old BSOD forum threads, I found one with the exact same problem.
Further down in the thread somebody, give a guide on how to successfully uninstall it.

I am now re-running driver verifier on all other non-microsoft drivers and will keep you guys updated if any other violation is found.

Thanks for the help so far

Alex

 

[AlexBrunt]

Ok now there is another problem,

while using my computer tonight I had another BSOD that said that ntfs.sys had an error because
it had a "PAGE FAULT IN NON-PAGED AREA".

I have attached the new dump files.
Also keep in mind that I was using driver verifier to check if there was any other issues with faulty drivers.

Thanks

 

[x BlueRobot]

I did notice the other dump files, but this particular file was the most interesting:

[COLOR=Red]BugCheck D6[/COLOR], {fffff98008933000, 0, fffff8800643feb9, 0}

*** WARNING: Unable to verify timestamp for uxpatch.sys
*** ERROR: Module load completed but symbols could not be loaded for uxpatch.sys

Could not read faulting driver name
Probably caused by : [COLOR=Red]uxpatch.sys[/COLOR] ( uxpatch+1eb9 )

Usual causes:  Device driver

The driver has referenced memory beyond it's current pool allocation, and then created a illegal page fault by referencing invalid memory addresses. This is buffer overrun situation.

kd> [COLOR=SeaGreen]lmvm uxpatch[/COLOR]
start             end                 module name
fffff880`0643e000 fffff880`06448000   uxpatch  T (no symbols)           
    Loaded symbol image file: uxpatch.sys
    Image path: \??\C:\Windows\system32\drivers\uxpatch.sys
    Image name: uxpatch.sys
    Timestamp:        [COLOR=Red]Mon Jul 13 06:09:18 2009[/COLOR] (4A5AC17E)
    CheckSum:         00013F48
    ImageSize:        0000A000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

The driver seems to belong to a program called Within Network, please update the driver from here - UxStyle - no more patching.

kd> [COLOR=SeaGreen]k[/COLOR]
Child-SP          RetAddr           Call Site
fffff880`02f892f8 fffff800`02f43be0 nt!KeBugCheckEx
fffff880`02f89300 fffff800`02ec3d2e nt! ?? ::FNODOBFM::`string'+0x4518f
fffff880`02f89460 fffff880`0643feb9 [COLOR=Red]nt!KiPageFault+0x16e[/COLOR]
fffff880`02f895f0 00000000`c0000023 uxpatch+0x1eb9
fffff880`02f895f8 ffffffff`80000318 0xc0000023
fffff880`02f89600 fffff880`064423e0 0xffffffff`80000318
fffff880`02f89608 fffff800`02ec144f uxpatch+0x43e0
fffff880`02f89610 00000000`00000010 nt!KiIdleLoop+0x15f
fffff880`02f89618 fffff880`02f89648 0x10
fffff880`02f89620 fffff880`001c001a 0xfffff880`02f89648
fffff880`02f89628 fffff880`06440c30 0xfffff880`001c001a
fffff880`02f89630 00000000`00000086 uxpatch+0x2c30
fffff880`02f89638 fffff880`06440081 0x86
fffff880`02f89640 fffff880`064423e0 uxpatch+0x2081
fffff880`02f89648 fffff880`00000010 uxpatch+0x43e0
fffff880`02f89650 fffff880`064423e8 0xfffff880`00000010
fffff880`02f89658 00000000`00000000 uxpatch+0x43e8

You can disable Driver Verifier now if you haven't done so.

 

[AlexBrunt]

I have disabled driver verifier and deleted uxpatch.sys already,
but BSOD still persists and I am unsure why.

I have attached the latest dump.

 

[x BlueRobot]

[COLOR="Red"]BugCheck BE[/COLOR], {[COLOR="Blue"]fffff8a00cf6e5b8[/COLOR], [COLOR="SeaGreen"]af300001a8a4b822[/COLOR], fffff88009427660, e}

Probably caused by : fileinfo.sys ( fileinfo!FIStreamLogForNL+7b )

Usual causes:  Device driver, Memory

kd> [COLOR="SeaGreen"]!pte af300001a8a4b822[/COLOR]
                                           VA af300001a8a4b822
PXE at FFFFF6FB7DBED000    PPE at FFFFF6FB7DA00030    PDE at FFFFF6FB40006A28    PTE at FFFFF68000D45258
Unable to get PXE FFFFF6FB7DBED000
[COLOR="Red"]WARNING: noncanonical VA, accesses will fault ![/COLOR]

It seems that a device driver has referenced, and then attempted to write to a read only section of memory. We can see from the PTE, that the virtual address was non-canonical, being that the address was invalid.

kd> [COLOR="SeaGreen"]lmvm atikmdag[/COLOR]
start             end                 module name
fffff880`04844000 fffff880`05000000   atikmdag T (no symbols)           
    Loaded symbol image file: atikmdag.sys
    Image path: \SystemRoot\system32\DRIVERS\atikmdag.sys
    Image name: atikmdag.sys
    Timestamp:        [COLOR="Red"]Mon Sep 20 02:47:42 2010[/COLOR] (4C96BD3E)
    CheckSum:         0076D892
    ImageSize:        007BC000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Your AMD graphics card driver seems to be causing problems, please update the driver from here - AMD Graphics Drivers & Software

WHQL
Release Date: April 24th 2013
Version: 13.4
In Device Manager: 12.104

 

[AlexBrunt]

After re-installing windows I got my driver from the link you specified it also said 13.4
but after installing it only installed the 12.104 driver and immediately bluescreened again I will upload new dump later today.

Edit: I came back to my computer today and uninstalled my graphics driver until further notice but here are the dumps from when it was installed after the BSOD

Edit #2: Even with the graphics driver uninstalled the BSODs still persist I am really unsure why, I'll upload the latest dump as a second attachment.
Please help.

Also i'm pretty sure every bluescreen has something to do with ntfs.sys

 

[x BlueRobot]

[COLOR="Red"]BugCheck 1000007E[/COLOR], {[COLOR="SeaGreen"]ffffffffc0000005[/COLOR], fffff88005d8f446, fffff88002d5f7e8, fffff88002d5f040}

Probably caused by : [COLOR="Red"]AtihdW76.sys [/COLOR]( AtihdW76+4446 )

kd> [COLOR="SeaGreen"]lmvm AtihdW76[/COLOR]
start             end                 module name
fffff880`05d8b000 fffff880`05da7000   AtihdW76 T (no symbols)           
    Loaded symbol image file: AtihdW76.sys
    Image path: \SystemRoot\system32\drivers\AtihdW76.sys
    Image name: AtihdW76.sys
    Timestamp:        [COLOR="Red"]Thu Feb 14 22:11:09 2013[/COLOR] (511D60FD)
    CheckSum:         00019F88
    ImageSize:        0001C000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Your ATI Function Driver for HD Audio Service seems to be causing problems, please update the driver from here - Support & Drivers

---------------------------------------------------------------------------

[COLOR="Red"]BugCheck 24[/COLOR], {1904fb, fffff8800297ad38, fffff8800297a590, fffff880012f9c11}

Probably caused by : Ntfs.sys ( Ntfs!NtfsFindPrefix+121 )

Usual causes:  Disk corruption, insufficient physical memory, Device driver, Indexing, Resident antivirus, backup, defrag programs, Disk/Drive failing/failure

EXCEPTION_RECORD:  fffff8800297ad38 -- ([COLOR="SeaGreen"].exr 0xfffff8800297ad38[/COLOR])
ExceptionAddress: fffff880012f9c11 ([COLOR="Red"]Ntfs!NtfsFindPrefix[/COLOR]+0x0000000000000121)
   ExceptionCode: [COLOR="Red"]c0000005 (Access violation)[/COLOR]
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

If we compare the two dump files, the type of exception which occurred, is exactly the same, a driver has referenced and accessed a invalid memory address. The function call which caused the exception in this case is the Ntfs!NtfsFindPrefix, which is used to find the file path for a particular file or directory. The file may have already been in memory, but the memory address was inaccessible.

I would update or remove the driver from the other dump, and then run Driver Verifier again.

 

[AlexBrunt]

My uncle has had the same problem after he upgraded he's ram,
so has my dad and here is my uncles dump:

 

[x BlueRobot]

[COLOR="Red"]BugCheck 1000007E[/COLOR], {[COLOR="SeaGreen"]ffffffffc0000005[/COLOR], fffff880046a8eba, fffff880009e19e8, fffff880009e1240}

Probably caused by : [COLOR="Red"]hardware [/COLOR]( usbhub!UsbhFdoPower_PowerSequence+26 )

EXCEPTION_RECORD:  fffff880009e19e8 -- ([COLOR="SeaGreen"].exr 0xfffff880009e19e8[/COLOR])
ExceptionAddress: fffff880046a8eba (usbhub!UsbhFdoPower_PowerSequence+0x0000000000000026)
   ExceptionCode: [COLOR="Blue"]c0000005 (Access violation)[/COLOR]
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000001
   Parameter[1]: 000000000038b841
[COLOR="Red"]Attempt to write to address 000000000038b841[/COLOR]

The address is non-paged pool, and is a similar issue to your dump files.

I would recommend running Driver Verifier on your Uncle's laptop too, since there appears to quite few power related IRP calls within the call stack.

I would recommend checking for any BIOS updates, which will usually resolve hardware compatibility problems, which also raises the question of have you checked the RAM is compatible and supported by the motherboard?

TOSHIBA 1.60, [COLOR="Red"]2/03/2010[/COLOR]

What are the results from my suggestion for your computer?

 

[AlexBrunt]

I have run driver verifier on my uncle's computer and the BSOD returned but not as a driver violation,
I urge you when you look through this dump to search for an error relating to IRQL_NOT_LESS_OR_EQUAL

STOP: 0x0000000A (0xFFFFF80003372958, 0x0000000000000002, 0x0000000000000000, 0xFFFFF8000309F242)

Edit #1: My uncle's laptop has BSOD again before driver verifier even started doing it's job,
stop code was different and I have uploaded the dump with Later on the end of the filename.

 

[x BlueRobot]

[COLOR="Red"]BugCheck A[/COLOR], {fffff80003372958, 2, 0, fffff8000309f242}

Probably caused by : ntkrnlmp.exe ( nt!RtlDispatchException+122 )

Usual causes:  Kernel mode driver, System Service, BIOS, Windows, Virus scanner, Backup tool, compatibility

2: kd> [COLOR="SeaGreen"]!thread[/COLOR]
GetPointerFromAddress: unable to read from fffff800032ad000
THREAD fffffa800a1d2b50  Cid 0288.029c  Teb: 000007fffffdc000 Win32Thread: fffff900c0adac20 RUNNING on processor 2
IRP List:
    [COLOR="Red"]Unable to read nt!_IRP @ fffff98002df6b80[/COLOR]
Not impersonating
GetUlongFromAddress: unable to read from fffff800031ecba4
Owning Process            fffffa800a1b4960       Image:         winlogon.exe
Attached Process          N/A            Image:         N/A
fffff78000000000: Unable to get shared data
Wait Start TickCount      3625         
Context Switch Count      719            IdealProcessor: 0                 LargeStack
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime                  00:00:00.000
KernelTime                00:00:00.000
Win32 Start Address 0x000000007758fbc0
Stack Init fffff88002a99d10 Current fffff88002a98ea0
Base fffff88002a9b000 Limit fffff88002a92000 Call fffff88002a99d60
Priority 14 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5

2: kd> [COLOR="SeaGreen"]lmvm WRkrn[/COLOR]
start             end                 module name
fffff880`0103d000 fffff880`0105b000   WRkrn    T (no symbols)           
    Loaded symbol image file: WRkrn.sys
    Image path: \SystemRoot\System32\drivers\WRkrn.sys
    Image name: WRkrn.sys
    Timestamp:        [COLOR="Red"]Wed Jul 31 19:34:53 2013[/COLOR] (51F958CD)
    CheckSum:         0002A79F
    ImageSize:        0001E000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

The Webroot SecureAnywhere Essentials driver/Webroot SecureAnywhere Anti-virus driver seems to be causing problems, please remove the program completely with Revo Uninstaller Pro - Uninstall Software, Remove Programs easily, Forced Uninstall, Leftovers Uninstaller (couldn't find a removal tool), and then install and run full scans with these free and proven alternatives which work best with the operating system due to compatibility and lightweight nature on system resources.

Install and perform full scans with:

• Malwarebytes : Free anti-malware download
• Microsoft Security Essentials | Protect against viruses, spyware, and other malware

   Information

Remember to install the free version of Malwarebytes not the free trail; untick the free trial box during installation. MSE is the most lightweight and compatible with the Windows 7 operating system

You can also view this thread for a complete free and lightweight security protection combination:

• http://www.sevenforums.com/system-security/206705-good-free-system-security-combination.html

 

[AlexBrunt]

Oh and my laptop is not doing the usual ntfs.sys BSOD, but another one,
could you please check this dump. thanks

Edit #1: My laptop did another ntfs.sys BSOD again,
I attached the new dump file.
I have still not found the source of the problem any chance that it could be faulty ram.
Even though memtest did 10 passes on my uncles laptop.
I would also note that we all bought the same kits of ram and that my laptop is different to my uncles,
but my uncles and my dads laptop are the same.