BSOD while browsing in Chrome; also reported in Facebook

[mike44njdevils]

My computer is pushing 3 years old now, and she's been giving me some problems. It's a custom build running Win 7 Home Premium.

I'm getting a lot of random BSOD's, though I'm not the main user of the computer. My mother uses it the most, and her main usage is Facebook and YouTube. She says it BSOD's while in Facebook a lot.

I personally have seen it BSOD simply clicking around in Chrome. I ran BlueSreenView to see what was going on, and it looks like it's all over the place. I just checked my memory with Memtest86 for a few passes, no errors. What else should I check?

 

[mike44njdevils]

TTT, it's off the first page. Don't want it to get lost. I did want to add I removed another virus with Avast last night. Don't think it was affecting these BSOD's though.

 

[koolkat77]

Welcome.

Microsoft (R) Windows Debugger Version 6.3.9600.16384 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\YUSRA\Downloads\Compressed\MIKE-PC-Tue_02_03_2015_140455_53\020315-17752-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.18700.amd64fre.win7sp1_gdr.141211-1742
Machine Name:
Kernel base = 0xfffff800`03a5f000 PsLoadedModuleList = 0xfffff800`03ca2890
Debug session time: Wed Feb  4 00:41:27.767 2015 (UTC + 6:00)
System Uptime: 0 days 0:45:48.672
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
................................................................
.................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, 91d44, 2, 748c3}

Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 0000000000091d44, page frame number
Arg3: 0000000000000002, current page state
Arg4: 00000000000748c3, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_99

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  chrome.exe

CURRENT_IRQL:  2

ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) x86fre

LAST_CONTROL_TRANSFER:  from fffff80003b63a9c to fffff80003ad5e80

STACK_TEXT:  
fffff880`0b85e088 fffff800`03b63a9c : 00000000`0000004e 00000000`00000099 00000000`00091d44 00000000`00000002 : nt!KeBugCheckEx
fffff880`0b85e090 fffff800`03a824fd : fffff680`000bb518 00000000`176a3000 fffffa80`07b05ec8 fffff880`04102562 : nt!MiBadShareCount+0x4c
fffff880`0b85e0d0 fffff800`03acac81 : 3ca00000`00000000 fffff680`000bb518 00000000`00000200 000fffff`00000001 : nt! ?? ::FNODOBFM::`string'+0x32728
fffff880`0b85e150 fffff800`03ac2442 : 00000000`176a2000 00000000`00000000 fffffa80`07b05b30 fffffa80`07b05ec8 : nt!MiDecommitPages+0x1a1
fffff880`0b85e9e0 fffff800`03ad5113 : ffffffff`ffffffff 00000000`001cdec0 00000000`001cdeb8 00000000`00004000 : nt!NtFreeVirtualMemory+0x382
fffff880`0b85eae0 00000000`77ca149a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`001cde88 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77ca149a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiBadShareCount+4c
fffff800`03b63a9c cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiBadShareCount+4c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  548a6e28

IMAGE_VERSION:  6.1.7601.18700

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_0x4e_99_nt!mibadsharecount+4c

FAILURE_ID_HASH:  {4c83cdad-f603-74ff-b7e1-9eb7f3029c2a}

Followup: MachineOwner
---------

Microsoft (R) Windows Debugger Version 6.3.9600.16384 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\YUSRA\Downloads\Compressed\MIKE-PC-Tue_02_03_2015_140455_53\020315-17518-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.18700.amd64fre.win7sp1_gdr.141211-1742
Machine Name:
Kernel base = 0xfffff800`03a59000 PsLoadedModuleList = 0xfffff800`03c9c890
Debug session time: Wed Feb  4 00:54:17.959 2015 (UTC + 6:00)
System Uptime: 0 days 0:11:47.239
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
................................................................
.................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa8003306060, ffff, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+35084 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, A page table page has been corrupted. On a 64 bit OS, parameter 2
	contains the address of the PFN for the corrupted page table page.
	On a 32 bit OS, parameter 2 contains a pointer to the number of used
	PTEs, and parameter 3 contains the number of used PTEs.
Arg2: fffffa8003306060
Arg3: 000000000000ffff
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41790

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  chrome.exe

CURRENT_IRQL:  0

ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) x86fre

LAST_CONTROL_TRANSFER:  from fffff80003b3fda0 to fffff80003acfe80

STACK_TEXT:  
fffff880`0baa86e8 fffff800`03b3fda0 : 00000000`0000001a 00000000`00041790 fffffa80`03306060 00000000`0000ffff : nt!KeBugCheckEx
fffff880`0baa86f0 fffff800`03b02ac9 : 00000000`00000000 00000000`0717ffff 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x35084
fffff880`0baa88b0 fffff800`03de8381 : fffffa80`044492e0 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0xd9
fffff880`0baa89d0 fffff800`03de8783 : 00000000`00000000 00000000`06f80000 fffffa80`00000001 00000000`00000001 : nt!MiUnmapViewOfSection+0x1b1
fffff880`0baa8a90 fffff800`03acf113 : fffffa80`0408b1e0 00000000`02a1070c fffffa80`03ef0060 fffffa80`07bfd980 : nt!NtUnmapViewOfSection+0x5f
fffff880`0baa8ae0 00000000`7762155a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`001ce178 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7762155a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+35084
fffff800`03b3fda0 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+35084

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  548a6e28

IMAGE_VERSION:  6.1.7601.18700

FAILURE_BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+35084

BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+35084

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_0x1a_41790_nt!_??_::fnodobfm::_string_+35084

FAILURE_ID_HASH:  {f6a6ed79-e275-9f8c-d5a4-3a37a32b0b4e}

Followup: MachineOwner
---------

Take memtest. Run for 8 passes and test each stick in a know good slot for an additional 6 passes.

• RAM - Test with Memtest86+

The goal is to test all the RAM sticks and all the motherboard slots.

Check your motherboard manual to ensure the RAM sticks are in the recommended motherboard slots. Some motherboards have very specific slots required for the number of RAM sticks installed.

If you get errors, stop the test and continue with the next step.

1. Remove all but one stick of RAM from your computer (this will be RAM stick #1), and run Memtest86 again, for 7 passes.

*Be sure to note the RAM stick, use a piece of tape with a number, and note the motherboard slot.
​

If this stick passes the test then go to step #3.

2. If RAM stick #1 has errors, repeat the test with RAM stick #2 in the same motherboard slot.

*If RAM stick #2 passes, this indicates that RAM stick #1 may be bad. If you want to be absolutely sure, re-test RAM stick #1 in another known good slot.
​

*If RAM stick #2 has errors, this indicates another possible bad RAM stick, a possible motherboard slot failure or inadequate settings.
​

3. Test the next stick of RAM (stick #2) in the next motherboard slot.

*If this RAM stick has errors repeat step #2 using a known good stick if possible, or another stick.
​

*If this RAM stick has no errors and both sticks failed in slot#1, test RAM stick #1 in this slot.
​

4. If you find a stick that passes the test, test it in all the other motherboard slots.

If Part 2 testing shows errors, and all tests in Part 3 show errors, you will need to test the RAM sticks in another computer and/or test other RAM in your computer to identify the problem.

In this way, you can identify whether it is a bad stick of RAM, a bad motherboard, or incompatibility between the sticks.

   Information

Errors are sometimes found after 8 passes.

   Tip

Memtest should be done overnight.

 

[mike44njdevils]

So much for the "few passes" sentiment: ran it again this morning and it errored in its first pass. ::sigh:: well at least I know what to try next.