BSOD at seemingly random times

[morezozy]

I have been encountering a BSOD at random times, there are times when I play several games, such as everquest, warframe, borderlands 2 (not all at once) that it will BSOD on me, but also during idle times, no programs open etc. I am uploading the dump files. Any help would be appreciated.

Also, I forgot to mention, that sometimes it will crash within 5 minutes, and other times it wont crash for days at a time.

Managed to read it, said it was caused by memory management

Driver IRQL Not less or equal

 

[koolkat77]

Welcome to the forum.

Microsoft (R) Windows Debugger Version 6.2.9200.20512 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Yusra\Downloads\Compressed\AVA-403902-1-Wed_06_25_2014_195404_21\062514-11138-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.18247.amd64fre.win7sp1_gdr.130828-1532
Machine Name:
Kernel base = 0xfffff800`03e15000 PsLoadedModuleList = 0xfffff800`040586d0
Debug session time: Thu Jun 26 05:37:42.308 2014 (UTC + 6:00)
System Uptime: 0 days 9:35:19.136
Loading Kernel Symbols
...............................................................
................................................................
..............................................
Loading User Symbols
Loading unloaded module list
...................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41201, fffff680007fc400, 48d0000142b0a025, fffffa800b974110}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+13702 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041201, The subtype of the bugcheck.
Arg2: fffff680007fc400
Arg3: 48d0000142b0a025
Arg4: fffffa800b974110

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41201

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  SearchProtocol

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80003ee69fe to fffff80003e8abc0

STACK_TEXT:  
fffff880`155d7878 fffff800`03ee69fe : 00000000`0000001a 00000000`00041201 fffff680`007fc400 48d00001`42b0a025 : nt!KeBugCheckEx
fffff880`155d7880 fffff800`03e55b71 : 00000000`00000000 fffffa80`0ec55b50 00000000`00000000 48d00001`42b0a025 : nt! ?? ::FNODOBFM::`string'+0x13702
fffff880`155d78c0 fffff800`03e5580a : fffffa80`0b974110 fffffa80`0c520b30 fffffa80`0c520b30 00000000`ff880000 : nt!MiQueryAddressState+0x2b1
fffff880`155d7910 fffff800`04163d74 : fffff880`00000020 00000000`ff881000 fffffa80`0b974110 00000000`00000000 : nt!MiQueryAddressSpan+0xaa
fffff880`155d7980 fffff800`03e89e53 : 00000000`00000170 fffffa80`0ec55b50 fffff880`155d7a88 00000000`0018ac98 : nt!NtQueryVirtualMemory+0x382
fffff880`155d7a70 00000000`77bf14ea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0018ac78 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77bf14ea


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+13702
fffff800`03ee69fe cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+13702

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  521ea035

FAILURE_BUCKET_ID:  X64_0x1a_41201_nt!_??_::FNODOBFM::_string_+13702

BUCKET_ID:  X64_0x1a_41201_nt!_??_::FNODOBFM::_string_+13702

Followup: MachineOwner
---------

Take memtest. Run for 8 passes and test each stick in a know good slot for an additional 6 passes.

• RAM - Test with Memtest86+

The goal is to test all the RAM sticks and all the motherboard slots.

Check your motherboard manual to ensure the RAM sticks are in the recommended motherboard slots. Some motherboards have very specific slots required for the number of RAM sticks installed.

If you get errors, stop the test and continue with the next step.

1. Remove all but one stick of RAM from your computer (this will be RAM stick #1), and run Memtest86 again, for 7 passes.

*Be sure to note the RAM stick, use a piece of tape with a number, and note the motherboard slot.
​

If this stick passes the test then go to step #3.

2. If RAM stick #1 has errors, repeat the test with RAM stick #2 in the same motherboard slot.

*If RAM stick #2 passes, this indicates that RAM stick #1 may be bad. If you want to be absolutely sure, re-test RAM stick #1 in another known good slot.
​

*If RAM stick #2 has errors, this indicates another possible bad RAM stick, a possible motherboard slot failure or inadequate settings.
​

3. Test the next stick of RAM (stick #2) in the next motherboard slot.

*If this RAM stick has errors repeat step #2 using a known good stick if possible, or another stick.
​

*If this RAM stick has no errors and both sticks failed in slot#1, test RAM stick #1 in this slot.
​

4. If you find a stick that passes the test, test it in all the other motherboard slots.

If Part 2 testing shows errors, and all tests in Part 3 show errors, you will need to test the RAM sticks in another computer and/or test other RAM in your computer to identify the problem.

In this way, you can identify whether it is a bad stick of RAM, a bad motherboard, or incompatibility between the sticks.

   Information

Errors are sometimes found after 8 passes.

   Tip

Do this test overnight, before going to bed.

 

[sakthij]

I too get such error. pfa dump file

Problem signature
Problem Event Name: BlueScreen
OS Version: 6.1.7601.2.1.0.256.4
Locale ID: 2057
Extra information about the problem
BCCode: 1000009f
BCP1: 0000000000000004
BCP2: 0000000000000258
BCP3: FFFFFA800733D040
BCP4: FFFFF800053FF3D0
OS Version: 6_1_7601
Service Pack: 1_0
Product: 256_1

 

[morezozy]

Ran through 10 passes, no errors were found.

 

[koolkat77]

Any new BSOD's?

 

[morezozy]

Just happened overnight

 

[koolkat77]

Upload new logs.

 

[morezozy]

Newest log

 

[koolkat77]

Sorry about the delay.

---

Enable Driver Verifier to see if it catches any misbehaving driver:

• Driver Verifier - Enable and Disable

 

[Thedoctor44]

BugCheck A, {[COLOR="red"]1[/COLOR], [COLOR="Blue"]2[/COLOR], 1, fffff80003eee437}

A pointer to an invalid address, more specifically an IP misalignment.

[COLOR="red"]MISALIGNED_IP: 
nt!MiUnlinkPageFromLockedList+1d7[/COLOR]

The problem is that a function was made to unlink a certain page of memory from a locked list, it's an undocumented function so I don't know too much about it, looks like a singly linked list.

I decided to look at the unloaded modules and Norton anti virus was loaded and unloaded twice.

Unloaded modules:
fffff880`0d806000 fffff880`0d828000   [COLOR="red"]ENG64.SYS[/COLOR]
fffff880`0d600000 fffff880`0d806000   [COLOR="red"]EX64.SYS[/COLOR]
fffff880`0d822000 fffff880`0d844000   [COLOR="red"]ENG64.SYS[/COLOR]
fffff880`0d61c000 fffff880`0d822000   [COLOR="Red"]EX64.SYS[/COLOR]

My bet is that Norton was the cause for the misaligned Instruction Pointer.

Use Norton's removal tool then replace it with MSE.

http://windows.microsoft.com/en-GB/windows/security-essentials-download

 

[morezozy]

PFN_LIST_CORRUPT was the what I got this time, MSE wouldn't install, I ended up doing malewarebytes (free version), I removed Norton before I tried installing MSE.

 

[morezozy]

New log

 

[koolkat77]

[FONT="Lucida Console"]Built by: 7601.18247.amd64fre.win7sp1_gdr.130828-1532
Debug session time: Thu Jul  3 19:31:09.736 2014 (UTC + 6:00)
System Uptime: 0 days 1:50:18.564
BugCheck 4E, {99, 1f0b16, 2, 1d2b17}
Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )
BUGCHECK_STR:  0x4E_99
PROCESS_NAME:  SearchProtocol
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7601.18247.amd64fre.win7sp1_gdr.130828-1532
Debug session time: Thu Jul  3 09:56:36.306 2014 (UTC + 6:00)
System Uptime: 1 days 9:08:36.134
BugCheck 1A, {41201, fffff680000057c8, c7b00001a75c4867, fffffa800b7b1650}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+13702 )
BUGCHECK_STR:  0x1a_41201
PROCESS_NAME:  SearchProtocol
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7601.18247.amd64fre.win7sp1_gdr.130828-1532
Debug session time: Wed Jul  2 00:47:36.287 2014 (UTC + 6:00)
System Uptime: 0 days 8:59:58.114
BugCheck 1A, {41201, fffff680007fc7c8, b7b0000124de1867, fffffa800a62d2e0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+13702 )
BUGCHECK_STR:  0x1a_41201
PROCESS_NAME:  SearchProtocol
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7601.18247.amd64fre.win7sp1_gdr.130828-1532
Debug session time: Tue Jul  1 15:46:49.697 2014 (UTC + 6:00)
System Uptime: 0 days 22:03:14.524
BugCheck 3B, {c000001d, fffff80003ebe402, fffff88012a92d60, 0}
Probably caused by : memory_corruption
BUGCHECK_STR:  0x3B
PROCESS_NAME:  SearchProtocol
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
[/FONT]

Still too many memory corruption errors.

Could you follow this part for memtest:

The goal is to test all the RAM sticks and all the motherboard slots.

Check your motherboard manual to ensure the RAM sticks are in the recommended motherboard slots. Some motherboards have very specific slots required for the number of RAM sticks installed.

If you get errors, stop the test and continue with the next step.

1. Remove all but one stick of RAM from your computer (this will be RAM stick #1), and run Memtest86 again, for 7 passes.

*Be sure to note the RAM stick, use a piece of tape with a number, and note the motherboard slot.
​

If this stick passes the test then go to step #3.

2. If RAM stick #1 has errors, repeat the test with RAM stick #2 in the same motherboard slot.

*If RAM stick #2 passes, this indicates that RAM stick #1 may be bad. If you want to be absolutely sure, re-test RAM stick #1 in another known good slot.
​

*If RAM stick #2 has errors, this indicates another possible bad RAM stick, a possible motherboard slot failure or inadequate settings.
​

3. Test the next stick of RAM (stick #2) in the next motherboard slot.

*If this RAM stick has errors repeat step #2 using a known good stick if possible, or another stick.
​

*If this RAM stick has no errors and both sticks failed in slot#1, test RAM stick #1 in this slot.
​

4. If you find a stick that passes the test, test it in all the other motherboard slots.

If Part 2 testing shows errors, and all tests in Part 3 show errors, you will need to test the RAM sticks in another computer and/or test other RAM in your computer to identify the problem.

In this way, you can identify whether it is a bad stick of RAM, a bad motherboard, or incompatibility between the sticks.

   Information

Errors are sometimes found after 8 passes.

   Tip

Memtest should be done overnight.