Solved BSODs after first boot of the day: 0x00000109 / ntoskrnl.exe+7f1c0

[nashkent]

Hello,

I have had two BSODs this week; one on Monday and the other one today, Thursday. Both occured within 30 minutes after Windows had been started (resumed from hibernation) for the first time that day. The same thing happened a few months ago. I'm beginning to see a pattern.

Other than these "morning" BSODs, my laptop is operating quite stable. It's being used about 12 hours a day yet I have never had a BSOD other than those after the first start of the day.

Because of this, my gut feeling is that this is more likely a hardware related BSOD. Maybe some part or device is unable to handle the initial temperature rise after cooling down over night. (Although the laptop is always stored at room temperature).

Another pattern is that BlueScreenView displays the same values for all three BSODs in these columns:

Bug Check Code: 0x00000109
Parameter 1: a3a039d8`[...]
Parameter 2: b3b7465e`[...]
Parameter 3: fffff800`[...]
Parameter 4: 00000000`00000001
Crash Address: ntoskrnl.exe+7f1c0

(Minidump files are attached.)

Event viewer shows no unusual events between Windows start and BSOD. I'm using a genuine Windows copy, always with the newest updates from Microsoft and my drivers and BIOS are up to date too. I'm currently running Driver Verifier to see if I can catch a BSOD this way.


My hardware checks so far:

RAM: memtest86 found no errors after 8 passes, neither did Windows' own Memory Diagnostics Tool. I even ran memtest86 again after letting the laptop cool down to see if the memory would behave differently, but still no errors.

PSU: Stated output is 19.5V, I measured 19.8V. Seems ok to me.

HDD: Ran various tests (HDD scans, filesystem checks...); no errors or bad sectors.


Any suggestions or interpretations of my minidump files are appreciated.

 

[koolkat77]

Please upload your msinfo32.nfo file. To get this:

• Click on the Start rb:
• Type msinfo32 into the Search programs and files box
• When it opens, go to File, Save
• Save as msinfo32.nfo and save in a place you will remember
• Let it finish the process of gathering and saving the system info
• Right click the .nfo file, click send to compressed (zipped) folder
• Upload the .zip file here.

 

[koolkat77]

Well both your dumps show memory corruption.

If you are overclocking any hardware, please stop.

STOP 0x00000109: CRITICAL_STRUCTURE_CORRUPTION BSOD Index

Usual causes: Device driver, Breakpoint set with no debugger attached,
Hardware (Memory in particular)

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Yusra\Downloads\firstdayofboot\091012-15303-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17835.amd64fre.win7sp1_gdr.120503-2030
Machine Name:
Kernel base = 0xfffff800`0301b000 PsLoadedModuleList = 0xfffff800`0325f670
Debug session time: Mon Sep 10 14:42:40.192 2012 (UTC + 6:00)
System Uptime: 2 days 21:55:43.417
Loading Kernel Symbols
...............................................................
................................................................
...................................................
Loading User Symbols
Loading unloaded module list
..................................................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 109, {a3a039d89fdc65c3, b3b7465ef2593529, fffff80003410db0, 1}

*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : [COLOR="red"]memory_corruption[/COLOR]

Followup: [COLOR="red"]memory_corruption[/COLOR]
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

[COLOR="red"]CRITICAL_STRUCTURE_CORRUPTION (109)[/COLOR]
[COLOR="Blue"]This bugcheck is generated when the kernel detects that critical kernel code or
data have been corrupted. There are generally three causes for a corruption:
1) A driver has inadvertently or deliberately modified critical kernel code
 or data. See http://www.microsoft.com/whdc/driver/kernel/64bitPatching.mspx
2) A developer attempted to set a normal kernel breakpoint using a kernel
 debugger that was not attached when the system was booted. Normal breakpoints,
 "bp", can only be set if the debugger is attached at boot time. Hardware
 breakpoints, "ba", can be set at any time.
3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data.[/COLOR]
Arguments:
Arg1: a3a039d89fdc65c3, Reserved
Arg2: b3b7465ef2593529, Reserved
Arg3: fffff80003410db0, Failure type dependent information
Arg4: 0000000000000001, Type of corrupted region, can be
	0 : A generic data region
	1 : Modification of a function or .pdata
	2 : A processor IDT
	3 : A processor GDT
	4 : Type 1 process list corruption
	5 : Type 2 process list corruption
	6 : Debug routine modification
	7 : Critical MSR modification

Debugging Details:
------------------


BUGCHECK_STR:  0x109

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff8000309a1c0

STACK_TEXT:  
fffff880`033c4498 00000000`00000000 : 00000000`00000109 a3a039d8`9fdc65c3 b3b7465e`f2593529 fffff800`03410db0 : nt!KeBugCheckEx


STACK_COMMAND:  kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
    fffff80003410e2b - nt!PopQpcTimeInMs+7b
	[ 90:80 ]
1 error : !nt (fffff80003410e2b)

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  ONE_BIT

FAILURE_BUCKET_ID:  [COLOR="red"]X64_MEMORY_CORRUPTION_ONE_BIT[/COLOR]

BUCKET_ID:  [COLOR="red"]X64_MEMORY_CORRUPTION_ONE_BIT[/COLOR]

Followup: [COLOR="Red"]memory_corruption[/COLOR]
---------

Suggest to run memtest86+ again on each stick separately (overnight preferable):
http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

You can also insert one stick in your computer at a time to see whether your computer bsods
or is stable with that stick. You may also lend some from a friend/neighbor (which are compatible with your motherboard).

Keep us posted of what you have done

 

[nashkent]

Please find my zipped msinfo32.nfo attached to this post.

I'm not overclocking.

I'll keep memtest86+ running overnight, one stick today and the other one tomorrow, and post my results here.

Would you suggest using the same memory slot both times or might it better to switch between the two slots, in case one of the slots is causing the problem?

Thank you!

 

[koolkat77]

It's a mere possibility that the RAM slots are bad, but a bad RAM module is a frequent case. Our primary intention is to test the RAMs. If you prefer extra precaution - you can do the swap.

 

[nashkent]

The good news is that memtest86+ found an error with one of the RAM sticks, but only once during eight passes (pass 6, test 6 - photo attached).

I tried to confirm the error by testing the same RAM stick in the other slot for the last eight hours, and this time 10 passes went through without an error. Not quite sure what to make of this. I'm probably going to keep memtest86+ running for most of the next 36 hours, and if I can't reproduce the error with this stick, try a good stick on the slot where the error was detected.

If you have any other suggestions, please let me know.

 

[koolkat77]

Even one error is a problem.
Like I said earlier you may lend from your friend or neighbor to test how your computer works.

 

[koolkat77]

Hi,

Were you able to resolve the blue screens?

 

[nashkent]

Since replacing the RAM sticks, I haven't had any blue screens like the ones above. It's hard to tell if that really fixed the problem because the blue screens appeared sporadically, but I guess I consider this solved (at least for now ).

Thanks for your help!

 

[koolkat77]

Okay..do you mean you still have blue screens?

 

[nashkent]

One that was clearly hardware/driver related (happened just when I plugged in a USB device) and where the error codes were totally different from those I had seen before. In addition to that the system (a laptop) now repeatedly fails to recognize the AC adapter, so maybe this is a more fundamental hardware problem after all. I can't afford to spend any more time on this at this point, so I'm going to replace the AC adapter and, if that doesn't improve the situation, the whole system.

 

[koolkat77]

Sorry to hear that :/