Solved BSOD - when 2 modules of mem. inserted

Beren · Nov 13, 2010

Hello,

Please Help.

I experience BSOD's when I insert my second module of my 4 gb Kingston ram. I have run a memtest86 for 17 cycles with both modules inserted - all tests pass. I have tried both modules individually and both pass. I have checked the asus's memory list and my memory is listed as compatible when 2 modules are inserted.

Initially when I insert the second module, the system will boot fine and will be stable. The issues seems to occur on the next restart. Sometimes the system won't boot (no bios screen, no I/O respoonse), others - as soon as the loading screen appears for Windows - BSOD.

I have upgraded my bios to the latest version, and installed the latest drivers, but still the same problems occur. Again the system is completely stable with only ONE module installed (I have used both individually without any issues).

I have switched to a 400w psu, and the same problem occurs. I don't believe it is a temperature issue, as it occurs on start-up after the system has been turned off overnight.

Thanks!

wish · Nov 13, 2010

Hi,
Most your dump files indicate memory corruption (0xA), (0x1a), (0x50), (0x7e) --> usual caused by drivers or RAM.

It seems your Asus driver (ASACPI.sys ) is obsolete and need to be update ASAP because old driver is well known as BSOD maker.

While troubleshooting , it's better removing Avast and replace it with MSE.
You may go back to Avast after your Windows have stabled.
http://www.microsoft.com/security_essentials/

Uuninstall Alcohol/Daemon software and remove its driver (sptd.sys) with this tools --> DuplexSecure - Downloads
Because sptd.sys have some issue with Windows 7 and for alternative software you may use MagicISO.

Then uninstall your Acronis Software because it's also use old driver.

These drivers need to be updated:

Code:

ASACPI.sys   Mon Oct 30 18:09:12 [COLOR=Red]2006[/COLOR] --> [URL="http://support.asus.com/download/download.aspx"]Asus ATK0110 ACPI Utility [/URL]
Rt64win7.sys Sat Dec 19 01:11:30 2009 --> [URL="http://www.realtek.com.tw/downloads/"]Realtek NIC driver
[/URL]snapman.sys  Fri Oct 06 06:43:53 2006 --> Acronis True Image Snapshot Manager driver
sptd.sys     Sun Oct 11 13:54:02 2009 --> [COLOR=Red]Remove[/COLOR] with [URL="http://www.duplexsecure.com/en/downloads"]SPTDinst[/URL]

Log

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffa00c2fde168, 0, fffff9600018ae41, 7}


Could not read faulting driver name
Probably caused by : win32k.sys ( win32k!ValidateHwnd+f1 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa00c2fde168, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff9600018ae41, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000007, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff8000310b0e0
 fffffa00c2fde168 

FAULTING_IP: 
win32k!ValidateHwnd+f1
fffff960`0018ae41 498b9058010000  mov     rdx,qword ptr [r8+158h]

MM_INTERNAL_CODE:  7

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  explorer.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88006aa89f0 -- (.trap 0xfffff88006aa89f0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff900c2fde010 rbx=0000000000000000 rcx=0000000000010072
rdx=fffffa800576bdc0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff9600018ae41 rsp=fffff88006aa8b80 rbp=0000000000000001
 r8=fffffa00c2fde010  r9=0000000000000000 r10=fffff960001a07e0
r11=fffff900c2fde010 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
win32k!ValidateHwnd+0xf1:
fffff960`0018ae41 498b9058010000  mov     rdx,qword ptr [r8+158h] ds:6010:fffffa00`c2fde168=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002f52849 to fffff80002ed3740

STACK_TEXT:  
fffff880`06aa8888 fffff800`02f52849 : 00000000`00000050 fffffa00`c2fde168 00000000`00000000 fffff880`06aa89f0 : nt!KeBugCheckEx
fffff880`06aa8890 fffff800`02ed182e : 00000000`00000000 fffff900`c0400ab0 fffff900`c073ea00 fffff960`00184451 : nt! ?? ::FNODOBFM::`string'+0x40e0b
fffff880`06aa89f0 fffff960`0018ae41 : 00000000`0001007c fffffa80`03c88690 00000000`00000001 00000000`00000000 : nt!KiPageFault+0x16e
fffff880`06aa8b80 fffff960`001a081f : 00000000`00010072 00000000`0000a915 00000002`00000063 0000001e`000000a9 : win32k!ValidateHwnd+0xf1
fffff880`06aa8bb0 fffff800`02ed2993 : fffffa80`03c88690 fffff880`06aa8c60 00000000`00000000 00000000`00000020 : win32k!NtUserSetProp+0x3f
fffff880`06aa8be0 00000000`76c7b58a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0346f408 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76c7b58a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!ValidateHwnd+f1
fffff960`0018ae41 498b9058010000  mov     rdx,qword ptr [r8+158h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  win32k!ValidateHwnd+f1

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4c7dc13c

FAILURE_BUCKET_ID:  X64_0x50_win32k!ValidateHwnd+f1

BUCKET_ID:  X64_0x50_win32k!ValidateHwnd+f1

Followup: MachineOwner

Beren · Nov 14, 2010

Thanks! System seems to be stable

Thanks for the quick response and a details solution. So far my system has been stable ( I have yet to install avast again).

wish · Nov 14, 2010

You're welcome and hope your problem have fixed completely

Beren · Nov 15, 2010

Still getting BSOD

Hi,

I am still getting the bsod, but only on the next restart of the system. I have attached the new analysis. Thanks.

wish · Nov 15, 2010

Hello,
I see that you have update most of the drivers, but your outdated Acronis driver still load in memory.
If you have uninstalled that software but the driver still remain. Then you must manually delete that driver or rename it into .bak.
C:\Windows\system32\drivers\snapman.sys

Another dump point to NDProxy.SYS as the caused so you must perform system file checker:
Right click Command Prompt -> run as admin -> sfc /scannow

Then uninstall RAMdisk and Speedfan to see if the problem persist.

Log:

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff80002ec9b89, 0, ffffffffffffffff}

Probably caused by : ntkrnlmp.exe ( nt!IoGetAttachedDevice+9 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002ec9b89, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP: 
nt!IoGetAttachedDevice+9
fffff800`02ec9b89 488b4018        mov     rax,qword ptr [rax+18h]

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030bd0e0
 ffffffffffffffff 

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x1E

PROCESS_NAME:  explorer.exe

CURRENT_IRQL:  0

EXCEPTION_RECORD:  fffff880029cfea8 -- (.exr 0xfffff880029cfea8)
ExceptionAddress: fffff80002ec9b89 (nt!IoGetAttachedDevice+0x0000000000000009)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

TRAP_FRAME:  fffff880029cff50 -- (.trap 0xfffff880029cff50)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffff0080046089f0 rbx=0000000000000000 rcx=ffff0080046089f0
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ec9b89 rsp=fffff880029d00e8 rbp=fffff80003188260
 r8=fffffa8004609bd0  r9=0000000000000000 r10=fffffa8004609bd0
r11=fffff8a00394fd7e r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
nt!IoGetAttachedDevice+0x9:
fffff800`02ec9b89 488b4018        mov     rax,qword ptr [rax+18h] ds:2a10:ffff0080`04608a08=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002ebfa39 to fffff80002e85740

STACK_TEXT:  
fffff880`029cf6d8 fffff800`02ebfa39 : 00000000`0000001e ffffffff`c0000005 fffff800`02ec9b89 00000000`00000000 : nt!KeBugCheckEx
fffff880`029cf6e0 fffff800`02e84d82 : fffff880`029cfea8 00000000`0000000c fffff880`029cff50 fffffa80`039f3010 : nt!KiDispatchException+0x1b9
fffff880`029cfd70 fffff800`02e8368a : fffff8a0`003a5e01 fffff800`02ea1306 fffff8a0`01ec3950 fffff8a0`01ec3958 : nt!KiExceptionDispatch+0xc2
fffff880`029cff50 fffff800`02ec9b89 : fffff800`03188ac0 00000000`00000000 fffff880`01079af5 fffffa80`03717080 : nt!KiGeneralProtectionFault+0x10a
fffff880`029d00e8 fffff800`03188ac0 : 00000000`00000000 fffff880`01079af5 fffffa80`03717080 fffffa80`03947b10 : nt!IoGetAttachedDevice+0x9
fffff880`029d00f0 fffff800`0317ee84 : fffffa80`04609bd0 00000000`00000000 fffffa80`03947b10 00000000`00000000 : nt!IopParseDevice+0x860
fffff880`029d0280 fffff800`03183e4d : fffffa80`03947b10 fffff880`029d03e0 00000000`00000240 fffffa80`03717080 : nt!ObpLookupObjectName+0x585
fffff880`029d0380 fffff800`0318a917 : 00000000`00000000 00000000`00000001 00000000`00000000 00000000`00000000 : nt!ObOpenObjectByName+0x1cd
fffff880`029d0430 fffff800`03194520 : fffff880`029d0630 00000000`00100080 fffff880`00000009 fffff880`029d05d0 : nt!IopCreateFile+0x2b7
fffff880`029d04d0 fffff800`032e0148 : 00000000`00005478 fffff8a0`0039e000 00000000`4d506300 00000000`00000801 : nt!NtCreateFile+0x78
fffff880`029d0560 fffff800`032e0286 : 00000000`00000000 00000000`00000000 fffff6fb`7ea000f0 00000000`000007ff : nt!PfSnIsVolumeMounted+0xa8
fffff880`029d0620 fffff800`032e1e52 : 00000000`00000000 00000000`00000005 00000000`00000000 fffff800`42506343 : nt!PfSnOpenVolumesForPrefetch+0xc6
fffff880`029d06d0 fffff800`032e22bf : 00000084`09086e28 fffffa80`03bd6280 fffff8a0`02614000 00000000`00000000 : nt!PfSnPrefetchScenario+0x142
fffff880`029d0940 fffff800`030da6df : 00000000`00000000 00000000`7a3328da fffffa80`05640dd0 00000000`00000000 : nt!PfSnBeginAppLaunch+0x35f
fffff880`029d0a10 fffff800`031532fc : fffffa80`03bc2a10 fffffa80`05640dd0 00000000`14050800 00000000`00000000 : nt! ?? ::NNGAKEGL::`string'+0x50100
fffff880`029d0a40 fffff800`02e63d55 : fffff800`02fffe80 00000000`00000000 fffff800`03153200 fffffa80`03bc2a10 : nt!PspUserThreadStartup+0xfc
fffff880`029d0aa0 fffff800`02e63cd7 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartUserThread+0x16
fffff880`029d0be0 00000000`76d63000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartUserThreadReturn
00000000`000efca8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76d63000


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!IoGetAttachedDevice+9
fffff800`02ec9b89 488b4018        mov     rax,qword ptr [rax+18h]

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  nt!IoGetAttachedDevice+9

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

FAILURE_BUCKET_ID:  X64_0x1E_nt!IoGetAttachedDevice+9

BUCKET_ID:  X64_0x1E_nt!IoGetAttachedDevice+9

Followup: MachineOwner

Beren · Nov 16, 2010

Ok, I was able to rename the snapman.sys driver, but when I uninstalled RAMdisk I got this error in the perfmon report performed after a restart:

The device, RAMDiskVE, is reporting "tv_ConfigMgrErr31". This device will not be available until the issue is resolved. The Plug and Play ID for this device is ROOT\DATARAM_RAMDISK_DEVICES\0000.

I found this registry in the ControlSet1 directory, but I was unable to remove the keys from the registry.

I then turned off the machine and unplugged it. Came back 30 min later in started it back up. I went to log in and the system just restarted - NO BSOD though.

I checked for any minidumps and there were none for today. There were 22 error logs (for the past hour) in the event log however. Here is one:

Log Name: System
Source: Service Control Manager
Date: 11/16/2010 8:08:07 AM
Event ID: 7026
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Beren-PC
Description:
The following boot-start or system-start driver(s) failed to load:
snapman
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
<EventID Qualifiers="49152">7026</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2010-11-16T07:08:07.050793800Z" />
<EventRecordID>470492</EventRecordID>
<Correlation />
<Execution ProcessID="552" ThreadID="556" />
<Channel>System</Channel>
<Computer>Beren-PC</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">
snapman</Data>
</EventData>
</Event>

I looked at the services and noticed that "Acronis OS Selector Reinstall Service" is still listed but it is set to disabled.

Any suggestions?

Thanks.

wish · Nov 16, 2010

Use ccleaner to remove RAMDISK and Acronis registry.

And have you tried system file checker as suggested before? And what is the result?

Beren · Nov 17, 2010

Yes, I have run ccleaner and it still did not remove the registry for RAMDISK and Acronis registry.

here was the result of the sfc /scannow

Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.

zigzag3143 · Nov 17, 2010

Beren said:
Yes, I have run ccleaner and it still did not remove the registry for RAMDISK and Acronis registry.

here was the result of the sfc /scannow

Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.

Well thats some good news for a change.

Memtest may not be spotting the problem if it is caused by a driver that is loaded in win 7, because it is run outside of the environment. IN order to spot the errant driver it may be necessary to run driver verifier.

Beyond that, please run Verifier with these settings:

Using Driver Verifier is an iffy proposition. Most times it'll crash and it'll tell you what the driver is. But sometimes it'll crash and won't tell you the driver. Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.

So, I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Win7 Startup Repair feature).

Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
NOTE: You can use Low Resource Simulation if you'd like. From my limited experimentation it makes the BSOD's come faster.
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out. If it doesn't crash for you, then let it run for at least 36 hours of continuous operation (an estimate on my part).

Reboot into Windows (after the crash) and turn off Driver Verifier by going back in and selecting "Delete existing settings" on the first page, then locate and zip up the memory dump file and upload it with your next post.

If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.

If that doesn't work, post back and we'll have to see about fixing the registry entry off-line:

Code:

Delete these registry keys (works in XP, Vista, Win7):
        HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\VerifyDrivers
        HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\VerifyDriverLevel

Using Driver Verifier to identify issues with Windows drivers for advanced users

Let us know how it goes.

Ken J

Beren · Nov 18, 2010

Ok, the verifier seemed to trigger a BSOD. I have attached the dumps.

zigzag3143 · Nov 18, 2010

Beren said:
Ok, the verifier seemed to trigger a BSOD. I have attached the dumps.

Sorry to say I dont see that verifier was running in this DMP. This DMP is stilling saying memory management and a USB Mouse driver.

Please type verifier /querysettings to see if it is running.

Ken

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\Windows_NT6_BSOD_jcgriff2\111810-23696-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols;srv*e:\symbols
*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02e62000 PsLoadedModuleList = 0xfffff800`0309fe50
Debug session time: Thu Nov 18 00:39:16.191 2010 (GMT-5)
System Uptime: 0 days 0:00:28.002
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
................................................................
.................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {411, fffff6fc500425d0, 8a60000107e1a820, ffff00fc500425d1}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+6051 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000000411, The subtype of the bugcheck.
Arg2: fffff6fc500425d0
Arg3: 8a60000107e1a820
Arg4: ffff00fc500425d1

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_411

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  explorer.exe

CURRENT_IRQL:  2

TRAP_FRAME:  fffff8800283c6a0 -- (.trap 0xfffff8800283c6a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8a0084ba8c4 rbx=0000000000000000 rcx=0000000000000000
rdx=00000000ffffffff rsi=0000000000000000 rdi=0000000000000000
rip=fffff800031af8e0 rsp=fffff8800283c830 rbp=fffff8800283cc60
 r8=fffff8a000b7cb80  r9=000000000000ffff r10=fffffa80036e2390
r11=fffffa800655ab60 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!CmpFindValueByNameFromCache+0xe0:
fffff800`031af8e0 428b14b8        mov     edx,dword ptr [rax+r15*4] ds:ee48:fffff8a0`084ba8c4=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002e9971e to fffff80002ed2740

STACK_TEXT:  
fffff880`0283c348 fffff800`02e9971e : 00000000`0000001a 00000000`00000411 fffff6fc`500425d0 8a600001`07e1a820 : nt!KeBugCheckEx
fffff880`0283c350 fffff800`02f047ad : fffff8a0`084ba8c4 fffff6fc`500425d0 0000007f`fffffff8 0000007f`fffffff8 : nt! ?? ::FNODOBFM::`string'+0x6051
fffff880`0283c3a0 fffff800`02eeed26 : 00000000`00000000 fffff8a0`07dc6ca0 00000000`00000000 fffff800`0305eb40 : nt!MiResolveTransitionFault+0x38d
fffff880`0283c430 fffff800`02eeccf1 : fffff8a0`00000000 fffff6fc`50005be0 ffff0800`00000011 fffff8a0`00b06010 : nt!MiDispatchFault+0x946
fffff880`0283c540 fffff800`02ed082e : 00000000`00000000 fffff8a0`00b06010 00000000`00360000 000007fe`fe9c2a30 : nt!MmAccessFault+0x8f1
fffff880`0283c6a0 fffff800`031af8e0 : fffff8a0`00b06010 00000000`007dc8c0 fffff8a0`00b7cb80 fffff800`03084300 : nt!KiPageFault+0x16e
fffff880`0283c830 fffff800`031ae1a6 : fffff8a0`06e50b98 fffff880`0283cb20 fffff880`0283c960 fffff880`0283c968 : nt!CmpFindValueByNameFromCache+0xe0
fffff880`0283c900 fffff800`031ad933 : 00000000`00000000 fffff880`0283cb20 fffffa80`00000002 00000000`000aea70 : nt!CmQueryValueKey+0x136
fffff880`0283c9e0 fffff800`02ed1993 : fffffa80`0655ab60 00000000`000ae9f8 00000000`00000002 00000000`000aea70 : nt!NtQueryValueKey+0x381
fffff880`0283cb70 00000000`7764feca : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`000ae9d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7764feca


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+6051
fffff800`02e9971e cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+6051

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

FAILURE_BUCKET_ID:  X64_0x1a_411_nt!_??_::FNODOBFM::_string_+6051

BUCKET_ID:  X64_0x1a_411_nt!_??_::FNODOBFM::_string_+6051

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000000411, The subtype of the bugcheck.
Arg2: fffff6fc500425d0
Arg3: 8a60000107e1a820
Arg4: ffff00fc500425d1

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_411

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  explorer.exe

CURRENT_IRQL:  2

TRAP_FRAME:  fffff8800283c6a0 -- (.trap 0xfffff8800283c6a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8a0084ba8c4 rbx=0000000000000000 rcx=0000000000000000
rdx=00000000ffffffff rsi=0000000000000000 rdi=0000000000000000
rip=fffff800031af8e0 rsp=fffff8800283c830 rbp=fffff8800283cc60
 r8=fffff8a000b7cb80  r9=000000000000ffff r10=fffffa80036e2390
r11=fffffa800655ab60 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!CmpFindValueByNameFromCache+0xe0:
fffff800`031af8e0 428b14b8        mov     edx,dword ptr [rax+r15*4] ds:ee48:fffff8a0`084ba8c4=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002e9971e to fffff80002ed2740

STACK_TEXT:  
fffff880`0283c348 fffff800`02e9971e : 00000000`0000001a 00000000`00000411 fffff6fc`500425d0 8a600001`07e1a820 : nt!KeBugCheckEx
fffff880`0283c350 fffff800`02f047ad : fffff8a0`084ba8c4 fffff6fc`500425d0 0000007f`fffffff8 0000007f`fffffff8 : nt! ?? ::FNODOBFM::`string'+0x6051
fffff880`0283c3a0 fffff800`02eeed26 : 00000000`00000000 fffff8a0`07dc6ca0 00000000`00000000 fffff800`0305eb40 : nt!MiResolveTransitionFault+0x38d
fffff880`0283c430 fffff800`02eeccf1 : fffff8a0`00000000 fffff6fc`50005be0 ffff0800`00000011 fffff8a0`00b06010 : nt!MiDispatchFault+0x946
fffff880`0283c540 fffff800`02ed082e : 00000000`00000000 fffff8a0`00b06010 00000000`00360000 000007fe`fe9c2a30 : nt!MmAccessFault+0x8f1
fffff880`0283c6a0 fffff800`031af8e0 : fffff8a0`00b06010 00000000`007dc8c0 fffff8a0`00b7cb80 fffff800`03084300 : nt!KiPageFault+0x16e
fffff880`0283c830 fffff800`031ae1a6 : fffff8a0`06e50b98 fffff880`0283cb20 fffff880`0283c960 fffff880`0283c968 : nt!CmpFindValueByNameFromCache+0xe0
fffff880`0283c900 fffff800`031ad933 : 00000000`00000000 fffff880`0283cb20 fffffa80`00000002 00000000`000aea70 : nt!CmQueryValueKey+0x136
fffff880`0283c9e0 fffff800`02ed1993 : fffffa80`0655ab60 00000000`000ae9f8 00000000`00000002 00000000`000aea70 : nt!NtQueryValueKey+0x381
fffff880`0283cb70 00000000`7764feca : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`000ae9d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7764feca


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+6051
fffff800`02e9971e cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+6051

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

FAILURE_BUCKET_ID:  X64_0x1a_411_nt!_??_::FNODOBFM::_string_+6051

BUCKET_ID:  X64_0x1a_411_nt!_??_::FNODOBFM::_string_+6051

Followup: MachineOwner
---------

Beren · Nov 18, 2010

ok here is the result from the commandline:

Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>verifier /querysettings
Special pool: Enabled
Pool tracking: Enabled
Force IRQL checking: Enabled
I/O verification: Enabled
Deadlock detection: Enabled
DMA checking: Enabled
Security checks: Enabled
Force pending I/O requests: Enabled
Low resources simulation: Disabled
IRP Logging: Enabled
Miscellaneous checks: Enabled

Verified drivers:

amdxata.sys
elbycdio.sys
igdkmd64.sys
rt64win7.sys
ndis.sys
asacpi.sys
gearaspiwdm.sys
vclone.sys
scsiport.sys
viahduaa.sys
dump_dumpata.sys
dump_atapi.sys
dump_dumpfve.sys
atmfd.dll
adfs.sys
secdrv.sys

C:\Windows\system32>

Beren · Nov 19, 2010

Ok, I verified that the verifier was running on my second BSOD. I received 2 this morning.

First - like i stated in my original post, when I boot the system for the first time after shutting it down over night, I get no Bios flash screen, no keyboard response, and no monitor response. I do hear the harddrive spinning, but there is not HDD light flickering. I then to a forced power off, and reboot.

As soon as the "Windows Starting" screen appears - BSOD, so I could not verify if the verifier was running.

Second - I was able to reboot and verify, but while running the perfmon and Windows_NT6_BSOD_v3.03_jcgriff2_ with 3 browsers open and VS2010 open (like i would do if i was normally programing) BSOD

So, I hope we can find the driver which is causing the issue, but what bothers me is that I cannot boot the system on my initial try.

Beren · Nov 21, 2010

Ok, so i was getting really frustrated. My system would no longer install the drivers for all USB flash drives. I decided to completely reinstall Windows 7. So far, I haven't had and BSOD with the 4 gb of memory (of course i haven't installed many new drivers either). I am running the verifier for now. I will update if I get another BSOD.

Thanks for the help!

Beren · Sep 8, 2011

defective MB

Hello everyone,

Sorry for the delay in my reply. I was never able to fix the issue that was causing my BSOD. So I returned the MB and they told me that there was a defect in the MB which was causing the problem. I want to thank every one for your help!

Beren · Oct 6, 2011

Ok, so I have been receiving another BSOD on my office computer. I wanted to upgrate my graphics card to the Radeon 6450 HD, but every time i try to boot I get a bsod. I have returned the card and received a new one but I am still having the same issue.

- x86 (32-bit) or x64 ?
x64

- the original installed OS on the system?

it is a new install on a formated partition

- an OEM or full retail version?
Retail

- What is the age of system (hardware)?
2+ years old

What is the age of OS installation (have you re-installed the OS?)
1 month

wish · Oct 7, 2011

Hello again,

2 dump files indicate VIDEO_TDR_FAILURE (116), so I suggest you to follow this step:
http://www.sevenforums.com/1056053-post5.html

Also your Bios Version seems old enough so if there is any newer version, it would be better to update it.
But be careful before perform the update, a little mistake will make your motherboard malfunction.

Code:

BiosVersion = V1.3
BiosReleaseDate = 06/27/2008

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 116, {fffffa800b5de010, fffff88003a84a48, 0, 2}

*** WARNING: Unable to verify timestamp for atikmpag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmpag.sys
Probably caused by : atikmpag.sys ( atikmpag+7a48 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

VIDEO_TDR_FAILURE (116)
Attempt to reset the display driver and recover from timeout failed.
Arguments:
Arg1: fffffa800b5de010, Optional pointer to internal TDR recovery context (TDR_RECOVERY_CONTEXT).
Arg2: fffff88003a84a48, The pointer into responsible device driver module (e.g. owner tag).
Arg3: 0000000000000000, Optional error code (NTSTATUS) of the last failed operation.
Arg4: 0000000000000002, Optional internal context dependent data.

Solved BSOD - when 2 modules of mem. inserted

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer