Random BSOD - Memory failing?

[southampig]

Hello,
I`ve been getting random BSOD for a couple of months, tonight I replaced the power supply as I thought that might have been it but it is still happening.
My next thought was the memory, I have now run memtest86 and it found over 60,000 errors, I have tried it in a different slot with similar results.
However looking at the BSOD dmp files I`m wondering if there is also a software fault?
I`d be very grateful if someone could have a look and see what they think.
Thanks
John

 

[koolkat77]

Microsoft (R) Windows Debugger Version 6.2.9200.20512 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\USER\Downloads\southampig\SF_29-11-2013\112913-19858-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18247.amd64fre.win7sp1_gdr.130828-1532
Machine Name:
Kernel base = 0xfffff800`0344f000 PsLoadedModuleList = 0xfffff800`036926d0
Debug session time: Sat Nov 30 02:32:28.078 2013 (UTC + 6:00)
System Uptime: 0 days 1:35:23.373
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
................................................................
................................................................

Loading User Symbols
Loading unloaded module list
........................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa8003d8f7b0, ffff, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+35084 )

Followup: MachineOwner
---------

5: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, A page table page has been corrupted. On a 64 bit OS, parameter 2
	contains the address of the PFN for the corrupted page table page.
	On a 32 bit OS, parameter 2 contains a pointer to the number of used
	PTEs, and parameter 3 contains the number of used PTEs.
Arg2: fffffa8003d8f7b0
Arg3: 000000000000ffff
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41790

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  SearchFilterHo

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80003535d50 to fffff800034c4bc0

STACK_TEXT:  
fffff880`0a45a628 fffff800`03535d50 : 00000000`0000001a 00000000`00041790 fffffa80`03d8f7b0 00000000`0000ffff : nt!KeBugCheckEx
fffff880`0a45a630 fffff800`034f77d9 : fffffa80`00000000 00000000`7f0dffff 00000000`00000000 fffffa80`079fe938 : nt! ?? ::FNODOBFM::`string'+0x35084
fffff880`0a45a7f0 fffff800`03495a24 : ffffffff`ffffffff 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0xd9
fffff880`0a45a910 fffff800`0379915a : fffff8a0`1130d450 00000000`00000001 00000000`00000000 fffffa80`0bf01b50 : nt!MmCleanProcessAddressSpace+0x228
fffff880`0a45a960 fffff800`0377d6b8 : 00000000`00000000 00000000`00000001 000007ff`fffde000 00000000`00000000 : nt!PspExitThread+0x56a
fffff880`0a45aa60 fffff800`034c3e53 : fffffa80`0cb6eb30 00000000`00000000 fffffa80`0bf01b50 00000000`00000000 : nt!NtTerminateProcess+0x138
fffff880`0a45aae0 00000000`7788157a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0024f978 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7788157a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+35084
fffff800`03535d50 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+35084

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  521ea035

FAILURE_BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+35084

BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+35084

Followup: MachineOwner
---------

Take memtest. Run for 8 passes and test each stick in a know good slot for an additional 6 passes.

• RAM - Test with Memtest86+

The goal is to test all the RAM sticks and all the motherboard slots.

Check your motherboard manual to ensure the RAM sticks are in the recommended motherboard slots. Some motherboards have very specific slots required for the number of RAM sticks installed.

If you get errors, stop the test and continue with the next step.

1. Remove all but one stick of RAM from your computer (this will be RAM stick #1), and run Memtest86 again, for 7 passes.

*Be sure to note the RAM stick, use a piece of tape with a number, and note the motherboard slot.
​

If this stick passes the test then go to step #3.

2. If RAM stick #1 has errors, repeat the test with RAM stick #2 in the same motherboard slot.

*If RAM stick #2 passes, this indicates that RAM stick #1 may be bad. If you want to be absolutely sure, re-test RAM stick #1 in another known good slot.
​

*If RAM stick #2 has errors, this indicates another possible bad RAM stick, a possible motherboard slot failure or inadequate settings.
​

3. Test the next stick of RAM (stick #2) in the next motherboard slot.

*If this RAM stick has errors repeat step #2 using a known good stick if possible, or another stick.
​

*If this RAM stick has no errors and both sticks failed in slot#1, test RAM stick #1 in this slot.
​

4. If you find a stick that passes the test, test it in all the other motherboard slots.

If Part 2 testing shows errors, and all tests in Part 3 show errors, you will need to test the RAM sticks in another computer and/or test other RAM in your computer to identify the problem.

In this way, you can identify whether it is a bad stick of RAM, a bad motherboard, or incompatibility between the sticks.

   Information

Errors are sometimes found after 8 passes.

   Tip

Do this test overnight, before going to bed.

 

[southampig]

Thanks Koolkat77,
I`ve only got the one stick but will test all the slots as well.
2nd stick on order soon too.

 

[x BlueRobot]

If you don't find any problems with the RAM, then please follow:

[COLOR=Red]BugCheck 1A[/COLOR], {[COLOR=Blue]41790[/COLOR], [COLOR=SeaGreen]fffffa8003d8f7b0[/COLOR], [COLOR=Orange]ffff[/COLOR], 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+35084 )

As said before, the bugcheck indicates that a PTE has become corrupt. Since this is a x64 system, then the address of the PFN for the page is parameter 2. It can be caused by drivers, unlocking a MDL more than locking it, causing the reference count to drop below 0.

Run Driver Verifier to scan for any corrupted drivers which may be causing problems, this program works by running various stress tests on drivers, in order to produce a BSOD which will locate the driver; run for least 24 hours:

• http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

   Information

Additional Help - http://www.sevenforums.com/crash-lo...-driver-verifier-identify-issues-drivers.html

5: kd> [COLOR=SeaGreen]dt nt!_MMPFN fffffa8003d8f7b0[/COLOR]
   +0x000 u1               : <unnamed-tag>
   +0x008 u2               : <unnamed-tag>
   +0x010 PteAddress       : 0xfffff6fb`40001fb8 _MMPTE
   +0x010 VolatilePteAddress : 0xfffff6fb`40001fb8 Void
   +0x010 Lock             : 0n1073749944
   +0x010 PteLong          : 0xfffff6fb`40001fb8
   +0x018 u3               : <unnamed-tag>
   +0x01c UsedPageTableEntries : [COLOR=Red]0xffff[/COLOR]
   +0x01e VaType           : 0 ''
   +0x01f ViewCount        : 0 ''
   +0x020 OriginalPte      : _MMPTE
   +0x020 AweReferenceCount : 0n128
   +0x028 u4               : <unnamed-tag>

5: kd> [COLOR=SeaGreen]!dpx[/COLOR]
Start memory scan  : 0xfffff8800a45a628 ($csp)
End memory scan    : 0xfffff8800a45b000 (Stack Base)

0xfffff8800a45a748 : 0xfffff800035cb7d3 : nt!MiQueuePageAccessLog+0x93
0xfffff8800a45a778 : 0xfffff800034dff6a : nt!MiCheckControlArea+0x28a
0xfffff8800a45a7e8 : 0xfffff800034f77d9 : nt!MiRemoveMappedView+0xd9
0xfffff8800a45a848 : 0xfffff800034f846b : nt!MiDeletePteRange+0x304
0xfffff8800a45a858 : 0xfffff800035f830d : nt!ExFreePoolWithTag+0x22d
0xfffff8800a45a8a8 : 0xfffff800034b3474 : [COLOR=Red]nt!MiRebalanceNode+0xa4[/COLOR] <<< AVL Tree for VADs?
0xfffff8800a45a8b0 : 0xfffff80003652940 : nt!PspSystemQuotaBlock
0xfffff8800a45a908 : 0xfffff80003495a24 : nt!MmCleanProcessAddressSpace+0x228
0xfffff8800a45a958 : 0xfffff8000379915a : nt!PspExitThread+0x56a
0xfffff8800a45a9b8 : 0xfffff80003764fd3 : nt!PsGetNextProcessThread+0xe3
0xfffff8800a45aa58 : 0xfffff8000377d6b8 : nt!NtTerminateProcess+0x138
0xfffff8800a45aad8 : 0xfffff800034c3e53 : nt!KiSystemServiceCopyEnd+0x13
0xfffff8800a45aae0 : 0xfffffa800cb6eb30 :  Trap @ fffff8800a45aae0

 

[southampig]

Thanks xbluerobot I will follow that next if needed.

The first memory test is currently 22 hours in and on its 8th pass, there are currently 1,548,288 errors showing, they all seem to be around the 5253mb area too.
I also now have another stick so I plan to test that one next before trying the next slot, I'll try running windows with it for a few hours too to see if I get a crash.
I can't post a pic of the memtest screen yet as I'm on mobile.

 

[x BlueRobot]

There may be some serious RAM issues then.

 

[southampig]

I reckon so
I stopped it on the 9th pass and tried the other stick butits not compatible anyway (borrowed it) so I tried mine in the next slot. Did 1 pass and looking similar to the other slot.
Should get a return authorization tomorrow for it so will see how it goes from there.
Thanks for the help so far its really appreciated.

 

[southampig]

Memtest results from first slot.
( just testing pic uploading for future use)

 

[Arc]

..

Post #2 of this thread:

• RAM - Test with Memtest86+

If you get errors, stop the test and continue with the next step.

1. Remove all but one stick of RAM from your computer (this will be RAM stick #1), and run Memtest86 again, for 7 passes.

*Be sure to note the RAM stick, use a piece of tape with a number, and note the motherboard slot.
​

If this stick passes the test then go to step #3.

2. If RAM stick #1 has errors, repeat the test with RAM stick #2 in the same motherboard slot.

*If RAM stick #2 passes, this indicates that RAM stick #1 may be bad. If you want to be absolutely sure, re-test RAM stick #1 in another known good slot.
​

*If RAM stick #2 has errors, this indicates another possible bad RAM stick, a possible motherboard slot failure or inadequate settings.
​

3. Test the next stick of RAM (stick #2) in the next motherboard slot.

*If this RAM stick has errors repeat step #2 using a known good stick if possible, or another stick.
​

*If this RAM stick has no errors and both sticks failed in slot#1, test RAM stick #1 in this slot.
​

4. If you find a stick that passes the test, test it in all the other motherboard slots.

If Part 2 testing shows errors, and all tests in Part 3 show errors, you will need to test the RAM sticks in another computer and/or test other RAM in your computer to identify the problem.

In this way, you can identify whether it is a bad stick of RAM, a bad motherboard, or incompatibility between the sticks.

   Information

Errors are sometimes found after 8 passes.

   Tip

Do this test overnight, before going to bed.

 

[x BlueRobot]

1,762,560 errors so far, I think your computer is okay

 

[southampig]

Update:
I`ve had 2 new 4GB sticks in for a week now and not one crash. I havn`t done a memtest as I havn`t had time but its looking like its ok. Got a full refund on my old memory, Corsair Vengeance, and got Corsair again but low profile.