suspected memory problems, memtest86 won't run

[James7679]

So, recently my computer started having various errors, bsods, and crashes. I started posting with some of my concerns and got no where. After thinking for a few days I realized that I had the same problem about 8 months ago. Someone suggested I run a memory diagnostics. It was in fact bad ram. One of my 4 corsair dominator sticks were bad. Problem solved. This time I ran win mem diag and immediately got an error. Unfortunately after I left for work the comp had crashed again and I couldn't find the results details. The event log only shows that there was a problem but doesn't tell me what. So I ran mem diag again last night 10 passes, no fail. So I burned a memtest86 disk and upon reboot it seems like it is running but I only get a black screen. Any suggestions?

 

[CarlTR6]

James, upload your dump files to us following the instructions in this tutorial and we will be glad to help you.

http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html

 

[James7679]

I tried but "take ownership" is not allowing me to take ownership.

 

[CarlTR6]

Copy the files to your desktop and zip them from the desktop.

 

[James7679]

here you go, do you want a copy of the original event log when it showed bad mem?

 

[James7679]

Log Name: Microsoft-Windows-MemoryDiagnostics-Results/Debug
Source: Microsoft-Windows-MemoryDiagnostics-Results
Date: 10/11/2010 11:48:43 AM
Event ID: 2001
Task Category: None
Level: Information
Keywords:
User: SYSTEM
Computer: James-PC
Description:
Windows Memory Diagnostic results
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-MemoryDiagnostics-Results" Guid="{5F92BC59-248F-4111-86A9-E393E12C6139}" />
<EventID>2001</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x4000000000000000</Keywords>
<TimeCreated SystemTime="2010-10-11T15:48:43.397460900Z" />
<EventRecordID>1</EventRecordID>
<Correlation />
<Execution ProcessID="1636" ThreadID="3744" />
<Channel>Microsoft-Windows-MemoryDiagnostics-Results/Debug</Channel>
<Computer>James-PC</Computer>
<Security UserID="S-1-5-18" />
</System>
<UserData>
<Results xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="http://manifests.microsoft.com/win/2005/08/windows/Reliability/Postboot/Events">
<MemDiagRawData>FF1F0000000000001100000003000000060000000C000000AC4400006E0000000A000000FF010000C1FA1F0079040000200000001700000010000000180000001800000018000000180000001600000016000000180000001C00000018000000180000001400000017000000180000001800000000000000E00500000000000050655B000000000001000000E00500002000000060050000000000006E00000038000000DA070A000B0006002C00170000000700C1FA1F0079040000090000C0000001004400010017000000020001001C00010010000000040001002100010018000000060001002E0001001800000001000100530001001800000003000100E600010018000000000001000B0001001600000008000100550001001600000007000100740101001800000005000100270301001C000000060001002F00010018000000000001000A00020018000000020001001D00020014000000040001002000020017000000060001002F0002001800000001000100520002001800000003000100E70002001B000000000001000A00020019000000080001005600020018000000070001007401020018000000050001002703020019000000060001002F00020018000000000001000A00030013000000020001001D00030013000000040001002000030018000000060001002F0003001600000001000100520003001800000003000100E700030018000000000001000A00030016000000080001005600030016000000070001007401030018000000050001002703030018000000060001002E00030016000000000001000B0004000F000000020001001C00040014000000040001002100040016000000060001002E0004001600000001000100530004001A00000003000100E60004001B000000000001000B0004001400000008000100550004001200000007000100740104001A00000005000100270304001B000000060001002E00040013000000000001000B00050013000000020001001D00050015000000040001002000050011000000060001002E0005001400000001000100530005001800000003000100E600050017000000000001000B00050012000000080001005600050011000000070001007301050018000000050001002703050018000000060001002F00050015000000000001000A00060013000000020001001D00060014000000040001002000060018000000060001002E0006001500000001000100530006001800000003000100E700060018000000000001000A0006000E000000080001005600060015000000070001007301060018000000050001002703060018000000060001002F00060013000000000001000A00070012000000020001001D00070012000000040001002000070013000000060001002F0007001100000001000100520007001800000003000100E700070017000000000001000A00070012000000080001005600070013000000070001007401070016000000050001002603070018000000060001002F0007000D000000000001000A0008000F000000020001001D00080010000000040001002000080010000000060001002F0008001000000001000100520008001600000003000100E700080018000000000001000A0008000C000000080001005600080010000000070001007401080015000000050001002703080019000000060001002E00080014000000000001000A0009000F000000020001001D0009000F000000040001002000090011000000060001002F0009000C00000001000100520009001600000003000100E700090014000000000001000A00090011000000080001005600090011000000070001007401090011000000050001002703090018000000060001002E00090010000000000001000A000A0011000000020001001D000A00120000000400010020000A0010000000060001002F000A00110000000100010052000A001700000003000100E7000A0016000000000001000A000A00120000000800010056000A000E0000000700010074010A00130000000500010026030A001C000000060001002F000A000F000000A8D60000A9D60000AAD60000ABD60000380C0600390C06003A0C06003B0C0600B48E0600B58E0600B68E0600B78E0600AC300800AD300800AE300800AF30080032190B0033190B00A2FD0B00A3FD0B0031190B0030190B00A0FD0B00A1FD0B00A3CD0300A2CD0300A0CD0300A1CD03003F260B003C260B003E260B003D260B00</MemDiagRawData>
</Results>
</UserData>
</Event>

 

[CarlTR6]

Good job. Please, also follow the instructions in this tutorial so that we have your system information. This info can be quite helpful in resolving hardware problems.

http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html

I looked at all of the dumps. All of them point to memory issues and blame Windows system driver, which is not like the real cause. One of the dumps is a Driver Verifier enabled dump; it also blames a Windows core system driver.

Error code 1E, KMODE_EXCEPTION_NOT_HANDLED. Usual causes: Device driver, hardware, System service, compatibility, Remote control programs, memory, BIOS.

Error code 50, PAGE_FAULT_IN_NONPAGED_AREA. Usual causes: Defective hardware (particularly memory - but not just RAM), Faulty system service, Antivirus, Device driver, NTFS corruption, BIOS.

Error code 1A, MEMORY_MANAGEMENT. Usual causes: Device driver, memory, kernel.

Error code C4, DRIVER_VERIFIER_DETECTED_VIOLATION. Usual cause: device driver.

Kernel base = 0xfffff800`01c5b000 PsLoadedModuleList = 0xfffff800`01e98e50
Debug session time: Fri Oct  8 23:06:35.831 2010 (GMT-4)
System Uptime: 0 days 0:06:58.534
Loading Kernel Symbols
...............................................................
................................................................
..................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff80001ca2dad, 0, ffffffffffffffff}

Probably caused by : memory_corruption ( nt!MiComputeImagePteIndex+41 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80001ca2dad, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!MiComputeImagePteIndex+41
fffff800`01ca2dad 488b8f88000000  mov     rcx,qword ptr [rdi+88h]

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80001f030e0
 ffffffffffffffff 

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x1E

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

EXCEPTION_RECORD:  fffff880094563e8 -- (.exr 0xfffff880094563e8)
ExceptionAddress: fffff80001ca2dad (nt!MiComputeImagePteIndex+0x0000000000000041)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

TRAP_FRAME:  fffff88009456490 -- (.trap 0xfffff88009456490)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa80035844f0 rbx=0000000000000000 rcx=0000058000000000
rdx=fffffa8009cce6b0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80001ca2dad rsp=fffff88009456620 rbp=fffffa8007875c40
 r8=0000000000000001  r9=0000000000000727 r10=fffff8800128f700
r11=fffff880094564f0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!MiComputeImagePteIndex+0x41:
fffff800`01ca2dad 488b8f88000000  mov     rcx,qword ptr [rdi+88h] ds:40f0:00000000`00000088=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80001d05a39 to fffff80001ccb740

STACK_TEXT:  
fffff880`09455c18 fffff800`01d05a39 : 00000000`0000001e ffffffff`c0000005 fffff800`01ca2dad 00000000`00000000 : nt!KeBugCheckEx
fffff880`09455c20 fffff800`01ccad82 : fffff880`094563e8 fffff8a0`03219600 fffff880`09456490 fffffa80`089adce8 : nt!KiDispatchException+0x1b9
fffff880`094562b0 fffff800`01cc968a : fffffa80`06e05fb8 fffffa80`06e05bd0 fffffa80`0748bc30 00000000`00000000 : nt!KiExceptionDispatch+0xc2
fffff880`09456490 fffff800`01ca2dad : 00000000`00000000 fffffa80`09df5b60 fffffa80`076c3300 fffffa80`09cce6b2 : nt!KiGeneralProtectionFault+0x10a
fffff880`09456620 fffff800`0200110b : fffffa80`07178010 fffffa80`099adc30 fffffa80`076c33a1 00000000`00000001 : nt!MiComputeImagePteIndex+0x41
fffff880`09456650 fffff800`01f2bafb : 00000000`00000001 00000000`00000001 fffffa80`071d9680 00000000`00000004 : nt! ?? ::NNGAKEGL::`string'+0x19135
fffff880`094566b0 fffff800`021290ad : 00000000`0000002a 00000000`0000002a fffffa80`071d9680 fffff880`09456778 : nt!MmPrefetchPages+0xfb
fffff880`09456710 fffff800`021310ce : fffff8a0`00000000 fffff8a0`00000000 fffff8a0`00000019 00000000`00000000 : nt!PfpPrefetchFilesTrickle+0x21d
fffff880`09456810 fffff800`02131c67 : 00000000`00000000 fffff880`09456ca0 fffff880`09456a08 fffff8a0`01f16060 : nt!PfpPrefetchRequestPerform+0x30e
fffff880`09456960 fffff800`0213e23e : fffff880`09456a08 00000000`00000001 fffffa80`08793f60 00000000`00000000 : nt!PfpPrefetchRequest+0x176
fffff880`094569d0 fffff800`0214296e : 00000000`00000000 00000000`05faf7f0 00000000`0000004f fffffa80`07b07201 : nt!PfSetSuperfetchInformation+0x1ad
fffff880`09456ab0 fffff800`01cca993 : fffffa80`09df5b60 00000000`00000000 fffffa80`07852b40 00000000`00000001 : nt!NtSetSystemInformation+0xb91
fffff880`09456c20 00000000`77af144a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`05faf7c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77af144a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiComputeImagePteIndex+41
fffff800`01ca2dad 488b8f88000000  mov     rcx,qword ptr [rdi+88h]

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  nt!MiComputeImagePteIndex+41

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x1E_nt!MiComputeImagePteIndex+41

BUCKET_ID:  X64_0x1E_nt!MiComputeImagePteIndex+41

Followup: MachineOwner
---------

Kernel base = 0xfffff800`01c15000 PsLoadedModuleList = 0xfffff800`01e52e50
Debug session time: Mon Oct 11 06:42:53.113 2010 (GMT-4)
System Uptime: 0 days 10:29:26.800
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffab004d9cc8b, 0, fffff80001c995ff, 5}


Could not read faulting driver name
Probably caused by : memory_corruption ( nt!MiAgeWorkingSet+4df )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffab004d9cc8b, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80001c995ff, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000005, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80001ebd0e0
 fffffab004d9cc8b 

FAULTING_IP: 
nt!MiAgeWorkingSet+4df
fffff800`01c995ff 410fb6471b      movzx   eax,byte ptr [r15+1Bh]

MM_INTERNAL_CODE:  5

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  iexplore.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff880021327a0 -- (.trap 0xfffff880021327a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000ffffffff rbx=0000000000000000 rcx=fffff68000012480
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80001c995ff rsp=fffff88002132930 rbp=0000000000000000
 r8=0000000000000001  r9=fffffa80079549c8 r10=0000000000000005
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz ac po cy
nt!MiAgeWorkingSet+0x4df:
fffff800`01c995ff 410fb6471b      movzx   eax,byte ptr [r15+1Bh] ds:204a:00000000`0000001b=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80001d048c1 to fffff80001c85740

STACK_TEXT:  
fffff880`02132638 fffff800`01d048c1 : 00000000`00000050 fffffab0`04d9cc8b 00000000`00000000 fffff880`021327a0 : nt!KeBugCheckEx
fffff880`02132640 fffff800`01c8382e : 00000000`00000000 6b801001`9deed025 00000000`00001000 fffff800`01db9bfe : nt! ?? ::FNODOBFM::`string'+0x40e8b
fffff880`021327a0 fffff800`01c995ff : 00000003`00000000 6b700001`ca0de025 00000000`00000000 00000000`000006b7 : nt!KiPageFault+0x16e
fffff880`02132930 fffff800`01d07a5e : fffffa80`079549c8 fffff880`00000001 00000000`00000001 fffff880`02132bb0 : nt!MiAgeWorkingSet+0x4df
fffff880`02132ae0 fffff800`01c99ee2 : 00000000`00000ec3 00000000`00000000 fffffa80`00000000 00000000`00000004 : nt! ?? ::FNODOBFM::`string'+0x496d6
fffff880`02132b80 fffff800`01c9a173 : 00000000`00000008 fffff880`02132c10 00000000`00000001 fffffa80`00000000 : nt!MmWorkingSetManager+0x6e
fffff880`02132bd0 fffff800`01f29c06 : fffffa80`06d20040 00000000`00000080 fffffa80`06d07040 00000000`00000001 : nt!KeBalanceSetManager+0x1c3
fffff880`02132d40 fffff800`01c63c26 : fffff800`01dffe80 fffffa80`06d20040 fffff800`01e0dc40 b887f600`28608368 : nt!PspSystemThreadStartup+0x5a
fffff880`02132d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiAgeWorkingSet+4df
fffff800`01c995ff 410fb6471b      movzx   eax,byte ptr [r15+1Bh]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!MiAgeWorkingSet+4df

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x50_nt!MiAgeWorkingSet+4df

BUCKET_ID:  X64_0x50_nt!MiAgeWorkingSet+4df

Followup: MachineOwner
---------

Kernel base = 0xfffff800`01c19000 PsLoadedModuleList = 0xfffff800`01e56e50
Debug session time: Sun Oct 10 18:47:25.938 2010 (GMT-4)
System Uptime: 0 days 10:02:42.625
Loading Kernel Symbols
...............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {5002, fffff70001080000, 1785, 3786fffffffe}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+21b31 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000005002, The subtype of the bugcheck.
Arg2: fffff70001080000
Arg3: 0000000000001785
Arg4: 00003786fffffffe

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_5002

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  avgcsrva.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80001cf1971 to fffff80001c89740

STACK_TEXT:  
fffff880`07a48a68 fffff800`01cf1971 : 00000000`0000001a 00000000`00005002 fffff700`01080000 00000000`00001785 : nt!KeBugCheckEx
fffff880`07a48a70 fffff800`01ca404c : fffff680`00019788 fffff880`07a48b40 00000000`00000000 ffffffff`ffffffff : nt! ?? ::FNODOBFM::`string'+0x21b31
fffff880`07a48ac0 fffff800`01c8782e : 00000000`00000001 00000000`00001895 00000000`00000001 fffffa80`09f84f20 : nt!MmAccessFault+0xc4c
fffff880`07a48c20 0000000a`008cc0ec : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`0816d890 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xa`008cc0ec


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+21b31
fffff800`01cf1971 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+21b31

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

FAILURE_BUCKET_ID:  X64_0x1a_5002_nt!_??_::FNODOBFM::_string_+21b31

BUCKET_ID:  X64_0x1a_5002_nt!_??_::FNODOBFM::_string_+21b31

Followup: MachineOwner
---------

Kernel base = 0xfffff800`01c0b000 PsLoadedModuleList = 0xfffff800`01e48e50
Debug session time: Sun Oct 10 01:07:21.732 2010 (GMT-4)
System Uptime: 0 days 10:04:52.669
Loading Kernel Symbols
...............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C4, {91, 0, fffffa800ce4bb60, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4904 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 0000000000000091, A driver switched stacks using a method that is not supported by
    the operating system. The only supported way to extend a kernel
    mode stack is by using KeExpandKernelStackAndCallout.
Arg2: 0000000000000000
Arg3: fffffa800ce4bb60
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0xc4_91

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

EXCEPTION_RECORD:  fffff8800b806858 -- (.exr 0xfffff8800b806858)
ExceptionAddress: fffff80001f76e4f (nt!IoRemoveIoCompletion+0x000000000000009f)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 0000000000000010
Attempt to read from address 0000000000000010

TRAP_FRAME:  fffff8800b806900 -- (.trap 0xfffff8800b806900)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80001f76e4f rsp=fffff8800b806a90 rbp=fffffa800b806ca0
 r8=fffff80001c0b000  r9=0000000000000000 r10=fffffffffffffffe
r11=fffffa8009a33630 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz ac po cy
nt!IoRemoveIoCompletion+0x9f:
fffff800`01f76e4f 8b4b10          mov     ecx,dword ptr [rbx+10h] ds:00000000`00000010=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80001cd024a to fffff80001c7b740

STACK_TEXT:  
fffff880`0b805968 fffff800`01cd024a : 00000000`000000c4 00000000`00000091 00000000`00000000 fffffa80`0ce4bb60 : nt!KeBugCheckEx
fffff880`0b805970 fffff800`01ca86b3 : 00000000`00000000 00000000`00000000 00000000`00000003 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x4904
fffff880`0b8059b0 fffff800`01cb59ef : fffff880`0b806858 fffff880`0b8065c0 fffff880`0b806900 00000000`00000000 : nt!RtlDispatchException+0x33
fffff880`0b806090 fffff800`01c7ad82 : fffff880`0b806858 00000000`00000000 fffff880`0b806900 00000000`00000001 : nt!KiDispatchException+0x16f
fffff880`0b806720 fffff800`01c798fa : 00000000`00000000 00000000`00000000 fffffa80`0ce4bb00 fffff880`009b8180 : nt!KiExceptionDispatch+0xc2
fffff880`0b806900 fffff800`01f76e4f : 00000200`00000000 fffff880`0b806bc8 00000a00`00000000 00000000`00000000 : nt!KiPageFault+0x23a
fffff880`0b806a90 fffff800`01c8baa6 : 000007fe`00000000 fffff880`0b806ba8 fffff880`0b806bc8 00000000`00000001 : nt!IoRemoveIoCompletion+0x9f
fffff880`0b806b20 fffff800`01c7a993 : fffffa80`0ce4bb60 00000000`779c4270 00000000`00000000 00000000`00000000 : nt!NtWaitForWorkViaWorkerFactory+0x285
fffff880`0b806c20 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+4904
fffff800`01cd024a cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+4904

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

FAILURE_BUCKET_ID:  X64_0xc4_91_nt!_??_::FNODOBFM::_string_+4904

BUCKET_ID:  X64_0xc4_91_nt!_??_::FNODOBFM::_string_+4904

Followup: MachineOwner
---------

To begin your troubleshooting, I recommend that you uninstall AVG. AVG is known to cause BSOD's on some Win 7 systems and antivirus scanner is mentioned in the usual causes above. Download and install Microsoft Security Essentials in its place. We want to eliminate all possible causes of crashes.

I see some out of date drivers on your system. Out of date drivers can and do cause memory corruption and crashes. Each of your dumps indicated memory issues. Update these drivers, especially the drivers dated 2006 and 2008:

000.fcl Fri Sep 26 09:11:22 2008 - CyberLink FCL Driver, http://www.gocyberlink.com

nvstor.sys Wed May 20 02:45:37 2009 - nVidia Storage Drivers Drivers - Download NVIDIA Drivers

pcouffin.sys Tue Dec 05 09:39:30 2006 - low level access layer for CD devices (A part of many different CD/DVD burning programs) http://www.vso-software.fr
or
rename to pcouffin.BAK and see what CD/DVD program it breaks. This software is way obsolete; it is XP software.

RimSerial_AMD64.sys Mon Nov 24 12:01:01 2008 - Virtual Serial Port driver for Blackberry Research In Motion - Products. If you cannot update this driver, uninstall the software. It is obsolete. Upgrade to software certified to be compatible with Win 7.

Uninstall AVG, update/uninstall the above drivers and reboot. Run your system and see if there is an improvement. If you get another BSOD, upload the dump and test your RAM using Memtest86. Follow the instructions in this tutorial: http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html. Post back with the results.

 

[James7679]

I am not at my computer to complete the task that you requested. I am on my blackberry, so if there is anything that a can tell you please let me know. Thank you for your help.

 

[James7679]

Thank you for your help. I will complete the suggested tasks and get back to you. Again thank you for your help.

 

[CarlTR6]

You are very welcome; it is my pleasure.

 

[James7679]

I have been working on getting the drivers updated and noticed today that when i tried to print something, i could'nt. My "devices and printers" tab is inactive and says"32bit" next to it. When i go into devices and printers from control panel it gives me an explorer.exe error stating that there is no program associated with it. Good news is that after uninstalling AVG i was able to run sfc/scannow. Bad news is it could not fix everything. I will include the log. Also i tried doing a repair install and i stil lget a message that states "The following issues are preventing Windows from upgrading. Cancel the upgrade, complete each task, and then restart the upgrade to continue.

• 
  [*]For these items, make the following changes:

• Uninstall these programs. Open Control Panel and search for "uninstall a program".

• • 
    [*]WindowBlinds 6 (and earlier)"
    
  
  

Again, I don't have this installed on my pc and never have. is it time to copy reformat and reinstall?

 

[CarlTR6]

James, follow the instructions in this tutorial: http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html. Run the utility, zip and upload the files. We need to see the files with system and application information.

In the meantime, follow the instructions in this tutorial: http://www.sevenforums.com/tutorials/19449-default-file-type-associations-restore.html. This may help with the printer problem.

After we take a look at your system and and application information, you can make a decision about performing a clean install. I apologize for the delayed reply; I was not online very much yesterday.

 

[James7679]

do you want me to post the files in this thread or a new one?

 

[James7679]

Here is the requested data. The "devices and printers" tab is not a default programs issue. I think it is something much more sinister. :sarc:

 

[CarlTR6]

You definitely have something going on. Have you modified your services, either disabling some or setting some to manual? I find several instances of services failing to start and duplicate services trying to start in looking at your logs. Have you used a registry clearner or modified your registry?

Download and install Malwarebytes, update it and run a quick scan. Let's eliminate malware as a possibility.

I also see that pfc.sys caused a crash. This is a driver for Padus(R) ASPI Shell or Padus R ASPI Shell belongs to the software Padus ASPI Shell or Adobe Audition by Padus, Inc (www.padus.com). This crash happened during loading with only 36 seconds of up time.

\SystemRoot\SysWow64\drivers\pfc.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

Before you resort to a clean install, let's make sure your hardware is OK. You already know that you have a RAM issue. Have you tested each RAM stick individually with Memtest? Is your RAM listed on the compatibility list of your motherboard?

Run Prime95 following the instructions in this tutorial:

http://www.sevenforums.com/tutorials/100352-cpu-stress-test-prime95.html

Run 3 separate tests, on each of the settings (Blend, Small FFTs, Large FFTs).

Post your results.

I also see that you have a problem device:

SMB 1.x MiniRedirector ROOT\LEGACY_MRXSMB10\0000

 

[James7679]

Carl, i tried to update the cyberlink files without success. I was unable to ascertain which version i had therefore unable to update. Updated nVidia mobo drivers, the most current ones were only from 10/09. Pcouffin.sys was found in 3 seperate locations, renamed 2, unable to change the third. Also deleted Blackberry software. I uninstalled AVG and installed Microsoft Security Essentials(FYI, it picked up two virusses that AVG did not, Could this have been the culprit?). Still unable to run Memtest86(black screen only). Although, I don't think that I have had a BSOD since I unistalled AVG. As far as modding my services(?), I don't recall ever doing so. I did use CC cleaner recently, I backed up the registry as it suggested, but I am unable to figure out how to restore the backup. The Problems you see with services starting and stopping multuple times started before that though. I will get to the rest and get back to you as soon as possible.

 

[James7679]

Downloaded malwarebytes, no malware. Padus api shell probably came from nVidia purevideo.

 

[CarlTR6]

Sounds like you are making progress. I am glad to hear you have not had another BSOD. I suspected a virus may have had a hand in this. By the way, did you received my PM (private message)?

When you have the opportunity, run a deep scan with Malwarebytes. I don't think it will find anything; but let's make sure.

Restoring the registry. Read this tutorial carefully. Note that you can use a restore point and restore your system files as well as the registry or you can restore just the registry form registry backups (registry exports). http://www.sevenforums.com/tutorials/4230-registry-backup-restore.html.

A word of caution about using any registry cleaner. Ccleaner's registry cleaner is pretty safe. However, no registry cleaner is 100% safe. Only delete keys that you know are obsolete and belong to software you have uninstalled. Review each key before you delete it. If you are not sure what that key does or what it is for, leave it. Obsolete keys will not hurt your system; Windows simply ignores them. Win 7 manages the registry much differently and much more efficiently than did XP of even Vista. Registry cleaning is not necessary; Win 7 will not bog down as XP did. There are a lot of keys that MS has included in the registry, particularly file extensions, that may not be used at the moment. However, these keys may well be used by when you install additional software. Registry cleaners will target these keys for deletion; don't delete them. There is a lot of interworking between some registry keys and deleting one can screw up your system. Again, only delete keys you know are associated with programs you have uninstalled.

The "magic" date for third party drivers is July 13, 2009 or later. Drivers dated July 13, 2009 or later should be good to go with Win 7. Drivers dated prior to July 13, 2009 are not designed for Win 7. That said, some with earlier dates in 2009 may work as they are Vista drivers. Drivers prior to to 2009 are more than likely not going to work.

There is an updated version of 000.fcl available for Cyberlink. Your version of Cyberlink is CyberLink PowerDVD 8 (version 8.04 ?).

 

[James7679]

Thank you Carl. Your help is greatly appreciated. I will work on this tonight and get back to you asap. Yes sir, I did get your pm. I first have to figure out when I will have time.

 

[CarlTR6]

Very good; just let me know.