Help with BSOD

[gillibyte]

I am constantly having these BSODs and I cant seem to fnd out what's causing it.

I have the dump file attached. Please help. Having problems for weeks.

 

[gillibyte]

Happened again

 

[Golden]

Additional information is required.

1. Download the DM Log Collector application to your desktop by clicking the link below

DM Log Collector.exe

2. Run it by double-clicking the icon on your desktop, and follow the prompts.
3. Locate the .ZIP file that is created on your desktop, and upload it here in your next reply.

 

[gillibyte]

Here is the uploaded file, as instructed.

 

[cluberti]

Well, this is bad. I don't need to do much more than run !analyze -v on this one to see it's complaining about memory (yes, physical memory) corruption - bitflip, it thinks:

CRITICAL_STRUCTURE_CORRUPTION (109)
This bugcheck is generated when the kernel detects that critical kernel code or
data have been corrupted. There are generally three causes for a corruption:
1) A driver has inadvertently or deliberately modified critical kernel code
 or data. See http://www.microsoft.com/whdc/driver/kernel/64bitPatching.mspx
2) A developer attempted to set a normal kernel breakpoint using a kernel
 debugger that was not attached when the system was booted. Normal breakpoints,
 "bp", can only be set if the debugger is attached at boot time. Hardware
 breakpoints, "ba", can be set at any time.
3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data.
Arguments:
Arg1: a3a039d89a4e49c5, Reserved
Arg2: b3b7465eeccb199b, Reserved
Arg3: fffff800030030c0, Failure type dependent information
Arg4: 0000000000000001, Type of corrupted region, can be
	0 : A generic data region
	1 : Modification of a function or .pdata
	2 : A processor IDT
	3 : A processor GDT
	4 : Type 1 process list corruption
	5 : Type 2 process list corruption
	6 : Debug routine modification
	7 : Critical MSR modification

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

BUGCHECK_STR:  0x109

PROCESS_NAME:  System

CURRENT_IRQL:  0

ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff80002c8abc0

STACK_TEXT:  
fffff880`033a15d8 00000000`00000000 : 00000000`00000109 a3a039d8`9a4e49c5 b3b7465e`eccb199b fffff800`030030c0 : nt!KeBugCheckEx


STACK_COMMAND:  kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
    fffff800030031ca - nt!AuthzBasepGetSecurityAttributeValueCopyoutBufferSize+10a
	[ e9:e8 ]
1 error : !nt (fffff800030031ca)

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  ONE_BIT

FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT

BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_memory_corruption_one_bit

FAILURE_ID_HASH:  {2dbb898e-c425-bad1-90fe-71c78117521f}

Followup: memory_corruption

While it's possible that this is being caused by a virus or malware (the kernel in memory has been modified and doesn't match the binary on disk, in this bugcheck), the higher likelihood (say, 99.999%) is that there is some actual corruption of data on the physical RAM - this is how bitflips happen. If you haven't already, you should be testing your RAM with memtestx86+. Note that I've actually seen bad CPUs cause memory errors too, so don't rule out the CPU being the culprit if the RAM passes. In any case, this error was a hardware error, so do a thorough check, but this is almost always a RAM problem.

 

[Golden]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 109, {a3a039d899bd6852, b3b7465eec3a3818, fffff80003002fa4, 1}

Probably caused by : ntkrnlmp.exe ( nt!AdtpBuildAccessesString+0 )

Followup: MachineOwner
---------

Run a minimum of 8 consecutive passes, preferably overnight, or until errors occur using MemTest86+.

Reference this tutorial to help you use MemTest86+:
http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

 

[gillibyte]

ok, will do so now. Thanks