BSOD - Possibly memory issues?

[Merlin2000]

I've had 3 BSODs in the past couple days. One occurred this morning, and then again 5 hours later, the previous one was from 5 days ago.

I'm not quite sure what's going on, sounds like it may just be Win 7 having some problems :huh:

I'm running:

Windows 7 x64 Pro
8GB ram (passed overnight test with memtest)
Intel Q6600
Two GeForce 8600 GTS (not in SLI)
4 74 GB SATA Raptors
2 1TB Western Digital SATA Drives (95% full)
400GB SATA Drive
320 GB SATA Drive

3: kd> .sympath srv*csymbols*Symbol information
Symbol search path is: srv*csymbols*Symbol information
Expanded Symbol search path is: srv*csymbols*Symbol information
3: kd> .reload
Loading Kernel Symbols
...............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
.....
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c000001d, Exception code that caused the bugcheck
Arg2: fffff88005cec028, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff880065d3e90, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction.

FAULTING_IP:
srvnet!SrvAdminProcessFsctl+258
fffff880`05cec028 0e ???

CONTEXT: fffff880065d3e90 -- (.cxr 0xfffff880065d3e90)
rax=0000000000146053 rbx=000000000014604b rcx=fffffa800b41d940
rdx=fffffa800aed7701 rsi=0000000000000000 rdi=fffffa800aed7710
rip=fffff88005cec028 rsp=fffff880065d4860 rbp=0000000000000000
r8=0000000000000000 r9=0000000000000000 r10=fffffa800b555850
r11=0000000000000006 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=fffffa800b555850
iopl=0 nv up ei ng nz na pe cy
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010283
srvnet!SrvAdminProcessFsctl+0x258:
fffff880`05cec028 0e ???
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: CODE_CORRUPTION

BUGCHECK_STR: 0x3B

PROCESS_NAME: svchost.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff88005cec028

STACK_TEXT:
fffff880`065d4860 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : srvnet!SrvAdminProcessFsctl+0x258


CHKIMG_EXTENSION: !chkimg -lo 50 -d !srvnet
fffff88005cec028 - srvnet!SrvAdminProcessFsctl+258
[ 0f:0e ]
1 error : !srvnet (fffff88005cec028)

MODULE_NAME: memory_corruption

IMAGE_NAME: memory_corruption

FOLLOWUP_NAME: memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MEMORY_CORRUPTOR: ONE_BIT

STACK_COMMAND: .cxr 0xfffff880065d3e90 ; kb

FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT

BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT

Followup: memory_corruption
---------

1: kd> .sympath srv*csymbols*Symbol information
Symbol search path is: srv*csymbols*Symbol information
Expanded Symbol search path is: srv*csymbols*Symbol information
1: kd> .reload
Loading Kernel Symbols
...............................................................
................................................................
.......................................................
Loading User Symbols
Loading unloaded module list
.........
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041287, The subtype of the bugcheck.
Arg2: 0000000000000058
Arg3: 0000000000000000
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR: 0x1a_41287

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: dwm.exe

CURRENT_IRQL: 0

TRAP_FRAME: fffff88009db2760 -- (.trap 0xfffff88009db2760)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff88009db2968 rbx=0000000000000000 rcx=0000000000000002
rdx=fffff88009db2920 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800031919b0 rsp=fffff88009db28f0 rbp=000000000d400001
r8=0000000000000001 r9=fffffa800bf02410 r10=0000000fffffffff
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!MiReleaseConfirmedPageFileSpace+0x40:
fffff800`031919b0 4c8b6e58 mov r13,qword ptr [rsi+58h] ds:00000000`00000058=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff8000307fb6e to fffff800030d3600

STACK_TEXT:
fffff880`09db25f8 fffff800`0307fb6e : 00000000`0000001a 00000000`00041287 00000000`00000058 00000000`00000000 : nt!KeBugCheckEx
fffff880`09db2600 fffff800`030d16ee : 00000000`00000000 00000000`11604008 fffff680`00088000 fffff680`00088000 : nt! ?? ::FNODOBFM::`string'+0x42be5
fffff880`09db2760 fffff800`031919b0 : 00000000`00000000 00000000`00000001 00000000`00000000 fffffa80`06c007d0 : nt!KiPageFault+0x16e
fffff880`09db28f0 fffff800`03146d78 : 0d400001`ae51f024 00000000`115ff000 00000000`11604008 00000000`11605000 : nt!MiReleaseConfirmedPageFileSpace+0x40
fffff880`09db2970 fffff800`03114fca : 00000000`00000000 00000000`12583fff fffffa80`00000000 fffffa80`0bf02410 : nt! ?? ::FNODOBFM::`string'+0x337d8
fffff880`09db2b30 fffff800`030d2853 : ffffffff`ffffffff 00000000`027bed10 00000000`027becd8 00000000`00008000 : nt!NtFreeVirtualMemory+0x5ca
fffff880`09db2c20 00000000`76ef009a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`027bec48 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76ef009a


STACK_COMMAND: kb

FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+42be5
fffff800`0307fb6e cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+42be5

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4b88cfeb

FAILURE_BUCKET_ID: X64_0x1a_41287_nt!_??_::FNODOBFM::_string_+42be5

BUCKET_ID: X64_0x1a_41287_nt!_??_::FNODOBFM::_string_+42be5

Followup: MachineOwner
---------

3: kd> .sympath srv*csymbols*Symbol information
Symbol search path is: srv*csymbols*Symbol information
Expanded Symbol search path is: srv*csymbols*Symbol information
3: kd> .reload
Loading Kernel Symbols
...............................................................
................................................................
.....................................................
Loading User Symbols
Loading unloaded module list
.....
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041284, A PTE or the working set list is corrupt.
Arg2: fffff8a01b7c7001
Arg3: 000000000002557c
Arg4: fffff781c0000000

Debugging Details:
------------------


BUGCHECK_STR: 0x1a_41284

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from fffff80003120df3 to fffff800030ca600

STACK_TEXT:
fffff880`037fc658 fffff800`03120df3 : 00000000`0000001a 00000000`00041284 fffff8a0`1b7c7001 00000000`0002557c : nt!KeBugCheckEx
fffff880`037fc660 fffff800`030c0249 : d7c00000`7310e963 ffffffff`ffffffff fffffa80`06d502a8 fffff880`035d5180 : nt! ?? ::FNODOBFM::`string'+0x4a83
fffff880`037fc6a0 fffff800`030bfc55 : 00000000`00000000 00000000`00000002 00000000`00000000 00000000`00000000 : nt!MiDeleteSystemPagableVm+0x179
fffff880`037fc800 fffff800`031fb34f : fffffa80`09c45440 fffff880`01e927d3 00000000`60000001 00000000`00000000 : nt!MiFreePagedPoolPages+0x129
fffff880`037fc950 fffff800`031ff87c : 00000000`00000000 fffff880`037fcb20 fffff880`037fca90 00000000`00000001 : nt!MiFreePoolPages+0x343
fffff880`037fca60 fffff800`030b48f0 : fffffa80`0f4c9160 00000000`00000000 00000000`74536d4d 00000000`00000001 : nt!ExFreePoolWithTag+0x7cc
fffff880`037fcb10 fffff800`033bc203 : fffffa80`0f4c9160 00000000`00000011 00000000`00088081 fffffa80`00088081 : nt!MiDeleteSegmentPages+0x35c
fffff880`037fcbc0 fffff800`031f1fcb : fffffa80`0f4c9168 00000000`00000001 00000000`00000000 6d6f4320`00000631 : nt!MiSegmentDelete+0x7b
fffff880`037fcc00 fffff800`031f263d : 00000000`00000000 00000000`00000080 fffffa80`06ca8840 646d60c3`00000012 : nt!MiProcessDereferenceList+0x23b
fffff880`037fccc0 fffff800`0336fa86 : 5b971d01`ae56e373 0215233d`7cedd78e 160182a3`01000103 03060d30`12018230 : nt!MiDereferenceSegmentThread+0x10d
fffff880`037fcd40 fffff800`030a8b06 : fffff880`03564180 fffffa80`06d4c510 fffff880`0356efc0 ef70d05b`10809781 : nt!PspSystemThreadStartup+0x5a
fffff880`037fcd80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+4a83
fffff800`03120df3 cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+4a83

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4b88cfeb

FAILURE_BUCKET_ID: X64_0x1a_41284_nt!_??_::FNODOBFM::_string_+4a83

BUCKET_ID: X64_0x1a_41284_nt!_??_::FNODOBFM::_string_+4a83

Followup: MachineOwner
---------

 

[CarlTR6]

It would appear that your diagnosis of memory is close. The errors point to hardware, memory, and/or drivers. I also ran Bugcheck on your dmp files.

STOP 0x0000001A: MEMORY_MANAGEMENT

Usual causes: Device driver, memory, kernel

BSOD Index

STOP 0x0000003B: SYSTEM_SERVICE_EXCEPTION

Usual causes: System service, Device driver, graphics driver, ?memory

BSOD Index

I suggest you start by [FONT=&quot]downloading a copy of Memtest86 and burn the ISO to a CD using Iso Recorder. Boot from the CD, and leave it running for at least 5 passes[/FONT]. Let's see if you have a memory problem.

Please post back with the results.

I also find a very old driver, pcouffin.sys Dec 05 2006 - The process Patin-Couffin low level access layer for CD devices or low level access layer for CD/DVD/BD devices or VSO Software pcouffin belongs to the software Low level access layer for CD devices or Patin couffin engine or VSO Software pcouffin by VSO Software (www.vso-software.fr). I suggest that you update the software associated with this driver, which should update the driver also, or uninstall the software using Revo.

You have another old driver, lmimirr.sys Apr 10 2007. This driver is associated with the software RemotelyAnywhere or LMImirr or LogMeIn by 3am Labs, Inc or LogMeIn, Inc. I suggest you update this software or uninstall it.

After you update or uninstall these obsolete programs, reboot, and post back with how your system is doing.

 

[Jonathan_King]

Please follow these directions for enabling driver verifier: http://www.sevenforums.com/crash-lo...-driver-verifier-identify-issues-drivers.html

The dmp points to RAM or drivers most likely. Since you already tested RAM, we can work on the drivers.

Update these old ones:

lmimirr.sys  Tue Apr 10 18:32:45 2007 -LogMeIn
pcouffin.sys Tue Dec 05 09:39:30 2006 -PowerISO, DVD Fab, etc type program
RaInfo.sys   Fri Jan 04 13:57:14 2008 -LogMeIn
LMIRfsDriver.sys Mon Jul 14 12:26:56 2008- LogMeIn

BSOD BUGCHECK SUMMARY

[font=lucida console]
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Tue May 25 12:35:20.734 2010 (GMT-4)
System Uptime: 0 days 0:00:49.562
BugCheck 3B, {c000001d, fffff88005cec028, fffff880065d3e90, 0}
Probably caused by : memory_corruption
BUGCHECK_STR:  0x3B
PROCESS_NAME:  svchost.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Tue Jun  1 03:03:05.494 2010 (GMT-4)
System Uptime: 3 days 15:29:27.694
BugCheck 1A, {41287, 58, 0, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+42be5 )
BUGCHECK_STR:  0x1a_41287
PROCESS_NAME:  dwm.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Tue Jun  1 16:52:48.232 2010 (GMT-4)
System Uptime: 0 days 5:52:21.013
BugCheck 1A, {41284, fffff8a01b7c7001, 2557c, fffff781c0000000}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4a83 )
BUGCHECK_STR:  0x1a_41284
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
[/font]

 

[Merlin2000]

The pcouffin.sys driver is from what Carl mentioned above VSO Software, specifically the ConvertXtoDVD program. I'll uninstall it since I no longer need it, I just wanted to mention that in case someone else was searching around and found this thread.

I'm going to make a full system backup today and then I'll go through those steps and report back.

Thanks for the information!

 

[CarlTR6]

You are welcome.

 

[Merlin2000]

Soo.. I ran through that verifier program and it immediately crashed my system. I had to do a full restore via Acronis because it wouldn't come back up.. YAY

I decided to run memtest again, and it found some problems. No idea why it was fine before, but it is definitely something with my ram that is causing some issues.

I've removed the 2 ram sticks with the issue and will see if these BSODs continue.

Thanks for the help guys.

 

[CarlTR6]

Merlin, try those RAM sticks in different slots to make sure it is the RAM and not the slots.

 

[Merlin2000]

Definitely the ram, I swapped the position of the 2 sets of 2 sticks

1|2|1|2 -> 2|1|2|1 and the same thing

Since I bought the last set of ram not too long ago, and it was a pack of 2, I'm just going to replace both sticks, dunno if 1 or both are bad, but Corsair can figure it out on their end.

That driver verifier program was pretty cool, first time I've used it.

 

[CarlTR6]

Thanks for reporting back. Great job on finding the problem.

I have only run the driver verifier program once - and it is pretty cool. I ran it just to see how it worked.

Here's hoping you will zip right along with the new RAM.