Dump file help

[theunknwnbstrd]

Could someone please help me to read the dmp files? I've been getting multiple BSOD's lately.

I tried several times last night on my W7 PC and it wasn't working. I tried the debugger and that said to I don't have the proper symbols, so I installed that and directed debugger to it, but it didn't help.

I'm not too sure how the dumpfiles work, but I am at work now, so I don't think I can do anything with the files here (on XP).

I'll attach the recent dumps.

Quick History:
Built the PC a little more than a month ago, installed XP. Had BSOD's but figured it was XP related, so let it be (knowing I was going to install W7 in a few weeks). Once W7 was out I installed it and have run into far less BSOD's. Only having one until yesterday when I had 5 in like an hour or so.
​

Thanks.

 

[torrentg]

Run memtest for as long as you can. 5 hours at least. I think there is something wrong with you RAM module(s). Especially because you said XP and here on 7.

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [E:\Temp\Rar$DI12.937\110309-25412-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02a09000 PsLoadedModuleList = 0xfffff800`02c46e50
Debug session time: Tue Nov  3 19:45:34.850 2009 (GMT-5)
System Uptime: 0 days 0:44:15.927
Loading Kernel Symbols
...............................................................
................................................................
...............
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffff6800037f550, 0, 0, fffff80002a4f2a7}

Probably caused by : memory_corruption ( nt!MiDeleteAddressesInWorkingSet+11b )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff6800037f550, memory referenced
Arg2: 0000000000000000, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002a4f2a7, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cb10e0
 fffff6800037f550 

CURRENT_IRQL:  0

FAULTING_IP: 
nt!MiDeleteAddressesInWorkingSet+11b
fffff800`02a4f2a7 488b1e          mov     rbx,qword ptr [rsi]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  firefox.exe

TRAP_FRAME:  fffff88003911ed0 -- (.trap 0xfffff88003911ed0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000098000000000 rbx=0000000000000000 rcx=0000000000006f08
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002a4f2a7 rsp=fffff88003912060 rbp=fffff7000108c008
 r8=fffffa8004212d78  r9=0000000000000001 r10=0000000000000a67
r11=fffff70001080000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po cy
nt!MiDeleteAddressesInWorkingSet+0x11b:
fffff800`02a4f2a7 488b1e          mov     rbx,qword ptr [rsi] ds:163b:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002a7a469 to fffff80002a7af00

STACK_TEXT:  
fffff880`03911d88 fffff800`02a7a469 : 00000000`0000000a fffff680`0037f550 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
fffff880`03911d90 fffff800`02a790e0 : 00000000`00000000 0000000f`ffffffff 00000000`00001000 fffff800`02badbfe : nt!KiBugCheckDispatch+0x69
fffff880`03911ed0 fffff800`02a4f2a7 : 00000003`00000000 f6f00000`8c550867 fffff700`0108c000 fffff680`000043b8 : nt!KiPageFault+0x260
fffff880`03912060 fffff800`02a4deee : fffffa80`042129e0 fffffa80`00000000 fffff880`00000a67 fffff800`00000000 : nt!MiDeleteAddressesInWorkingSet+0x11b
fffff880`03912910 fffff800`02d5d7af : fffff8a0`0abcea50 fffff880`03912c20 00000000`00000000 fffffa80`041cc060 : nt!MmCleanProcessAddressSpace+0x96
fffff880`03912960 fffff800`02d37b3d : 00000000`00000001 00000000`00000001 00000000`7efd5000 fffffa80`06dbcb60 : nt!PspExitThread+0x47f
fffff880`03912a30 fffff800`02a57a43 : 00000000`03912ca0 fffffa80`069847e0 00000000`0293e710 fffff880`03912be0 : nt!PsExitSpecialApc+0x1d
fffff880`03912a60 fffff800`02a57e80 : 00000000`02b8fdb4 fffff880`03912ae0 fffff800`02d38710 00000000`00000001 : nt!KiDeliverApc+0x2eb
fffff880`03912ae0 fffff800`02a7a1f7 : fffffa80`041cc060 00000000`7efd5000 fffff880`000000c0 00000000`7efd5000 : nt!KiInitiateUserApc+0x70
fffff880`03912c20 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiDeleteAddressesInWorkingSet+11b
fffff800`02a4f2a7 488b1e          mov     rbx,qword ptr [rsi]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!MiDeleteAddressesInWorkingSet+11b

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0xA_nt!MiDeleteAddressesInWorkingSet+11b

BUCKET_ID:  X64_0xA_nt!MiDeleteAddressesInWorkingSet+11b

Followup: MachineOwner
---------

Also, update your bios to latest available and run under "optimized default settings" from within it.

Check the event viewer logs for anything suspicious or related.

Update all drivers possible, for the system.

Disable Windows Search service as a test. Use services.msc at start menu search box.

 

[torrentg]

I just noticed you have OCZ ram. They commonly need higher voltages to run well. Visit their site and see recommended voltage. Set motherboard accordingly and crashes should stop.

http://www.ocztechnology.com/products/memory/ocz_ddr3_pc3_10666_platinum_amd_edition

Set to 1.65v instead of default 1.5v. Match timings shown in bios to the website.

Enjoy your new build, man.

 

[theunknwnbstrd]

Thanks a lot..

When I go home, I'll up the voltage, then when I go to bed I'll still let memtest run.

updates after...

 

[torrentg]

I wouldn't bother with memtest until you get another crash. The voltage change is going to fix this for you. Almost guaranteed.

PS - Look at my memory. I know OCZ stuff. heh I'm running very high above default for DDR to match mine.

You're welcome.

 

[theunknwnbstrd]

Sounds good to me..

One question though.. Could you explain this a little further:

Match timings shown in bios to the website.

 

[torrentg]

Sure. For memory settings, most likely same place where you set the VDIMM (voltage for ram) -

set as follows:

CAS = 7
TRCD = 7
TRP = 7
TRAS = 20

Read the motherboard manual if they are listed with different names. They should say that though.

 

[theunknwnbstrd]

Ok, I'll keep an eye out for it..

Again, thanks a lot...

 

[theunknwnbstrd]

Hey, I tried changing the voltage, but it didn't fix the problem.

I've had 3 BSOD's while trying to write this out..

trying to get this up before i get another...

attached are the dumps and a photo of my bios settings to make sure i'm doing it right..

i only changed the tRASmin to [20] and memory voltage to 1.65.

let me know what you think..
thanks.

 

[theunknwnbstrd]

Also, I just ran MemTest and it passed 100%

Isn't memtest supposed to take hours to run? or do people just let the test run over and over?

If the memtest is correct then I'm guessing that I just screwed something up in setting up the voltage for the RAM. hopefully.

(posting from my XP machine while memtest runs)

 

[torrentg]

You have stop 0x24 errors.
Please see this for further information that could be helpful to you:
http://msdn.microsoft.com/en-us/library/ms793935.aspx

Run chkdsk /r command for each partition and /or drive on the system.

For example:

chkdsk /r C:
for C: etc...change to D: for another partition until all are finished.

Do this from an elevated command prompt. Copy and paste can be used.

 

[theunknwnbstrd]

memtest has been running this whole time, and just 2 seconds ago I got errors galore...

not really sure what any of them mean tho, i just see a bunch of red..

i'll try what you are suggesting in a bit..

 

[usasma]

Multiple errors in Memtest mean you've got memory problems.
Follow Steps 7 to 10 in this link to test the sticks and the slots individually: http://www.carrona.org/memdiag.html

 

[theunknwnbstrd]

that's what i've been doing today. I brought my pc to work so I can work better on the bench.

I'll post more once I know more..

 

[theunknwnbstrd]

Both sticks have failed numerous times in multiple slots.

I have requested an RMA from OCZ, so once I get the new RAM, I will update the post.

Thank you guys for your help so far.

 

[webup]

do yo need to use memtest on win7 machines??? or the built in memory diagnostics on the boot menu?

 

[torrentg]

Both are useful.

 

[theunknwnbstrd]

Ok well here's an update:

Since my last post I had gotten a hold of another pair of RAM and tested my slots to make sure it wasn't my mobo. It wasn't, they both passed. So then I tried resetting my CMOS. That seemed to fix

the problem. I haven't had a BSOD since that night. Then just a few minutes ago I did.

I want to see if it's still memory related. I have included the dump.

I also ran the Windows Memory Diagnostics Tool and while it was running it said (immediately) that there were hardware problems, but when I logged into windows, after the scan, there was no

logfile. Or I just don't know where to find it.

I guess I still do have to go forth with the RMA to OCZ.

Just want to wait to make sure that the dumpfile says its RAM related again.

Thanks in advance.

 

[torrentg]

That's showing a 0xC2 error with mpfilter.sys, which is a Microsoft Windows Malware protection system driver file.

As a theory, possibly some malware is running on the pc that could be causing this. You could scan with Malwarebytes to see or possibly others too.

But yeah, it is some type of memory error.

"The current thread attempted to free the pool, which was already freed."