Win7 Pro 64Bit - memdump

[BMXer]

How do you read these things. I found a utility, but its not completely compatible with Win7 64bit. Computer was running great then I started getting blue screen memory dumps. I can find the dump file, but not the xml file ...

dump file attached. Link to a utility and/or a how to would be greatly appreciated.

 

[usasma]

Link to a how-to: WinDbg Analysis Report

Unfortunately, the Windows Debugging Tools aren't able to access symbols for your operating system files (in particular Win32k.sys) from the Microsoft Symbol Server - so that makes debugging them difficult if not impossible.

Please do the following (this will not affect the analysis of the current files - but it may help later files that are acquired):
- activate/validate the Windows installation at Genuine Microsoft Software
- run sfc.exe /scannow to replace any problem files
- open a support incident with Microsoft to see if they can fix the missing symbols issue ( Support for Windows 7 technical problems and troubleshooting )
- If that doesn't fix it, then wipe the hard drive and reinstall Windows
- don't use "leaked"/torrent builds (if this is the case we may never find a fix)

So, let's try some old-fashioned detective work.....

First, please provide this info: http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html

Please update your ASACPI.sys file immediately. The 2005 version (which you have) is a known cause of BSOD's.
Go to this page: ASUSTeK Computer Inc.-Support- download_item_mkt
Enter your OS in the dropdown box
Scroll down to the Utilities section and download/install the "ATK0110 driver for WindowsXP/Vista/Win7 32&64-bit " - it's the 15th item down in the Utilities section

Here's more info on the specific error that you're getting: BSOD Index

So, let's start with this set of free tests:

H/W Diagnostics:
Please start by running these bootable hardware diagnostics:
Memory Diagnostics (read the details at the link)
HD Diagnostic (read the details at the link)

Also, please run one of these free, independent online malware scans to ensure that your current protection hasn't been compromised: Free Online AntiMalware Scanners (read the details at the link)

OLDER DRIVERS PRESENT IN THE DUMP FILES
- Please update these drivers from the device manufacturer's website - or uninstall/remove them from your system. Reference links are included below.
- DO NOT use Windows Update or the Update Drivers function of Device Manager.
- Please feel free to post back about any drivers that you are having difficulty locating.
- Windows Update exceptions may be noted below for Windows drivers:

[font=lucida console]
vmbus.sys       Sat Nov 20 04:57:29 2010 (4CE79B89)
winhv.sys       Sat Nov 20 04:20:02 2010 (4CE792C2)
amdxata.sys     Fri Mar 19 12:18:18 2010 (4BA3A3CA)
mfehidk.sys     Wed Oct 06 15:55:49 2010 (4CACD445)
mfewfpk.sys     Wed Oct 06 15:56:04 2010 (4CACD454)
athurx.sys      Mon Jan 04 22:23:16 2010 (4B42B0A4) - Atheros AR9271 [B]Wireless[/B] Network Adapter 
mfenlfk.sys     Wed Oct 06 15:56:13 2010 (4CACD45D)
mfeavfk.sys     Wed Oct 06 15:56:49 2010 (4CACD481)
[Color=Red]ASACPI.sys      Sun Mar 27 22:30:36 2005 (42476C4C)[/Color]
GEARAspiWDM.sys Mon May 18 08:17:04 2009 (4A1151C0)
mfefirek.sys    Wed Oct 06 15:59:47 2010 (4CACD533)
cfwids.sys      Wed Oct 06 16:00:36 2010 (4CACD564)
mfeapfk.sys     Wed Oct 06 15:56:26 2010 (4CACD46A)
[/font]

http://www.carrona.org/dvrref.html#vmbus.sys
http://www.carrona.org/dvrref.html#winhv.sys
http://www.carrona.org/dvrref.html#amdxata.sys
http://www.carrona.org/dvrref.html#mfehidk.sys
http://www.carrona.org/dvrref.html#mfewfpk.sys
http://www.carrona.org/dvrref.html#mfenlfk.sys
http://www.carrona.org/dvrref.html#mfeavfk.sys
http://www.carrona.org/dvrref.html#ASACPI.sys
http://www.carrona.org/dvrref.html#GEARAspiWDM.sys
http://www.carrona.org/dvrref.html#mfefirek.sys
http://www.carrona.org/dvrref.html#cfwids.sys
http://www.carrona.org/dvrref.html#mfeapfk.sys

BSOD BUGCHECK SUMMARY

[font=lucida console]
Built by: 7601.17514.amd64fre.win7sp1_rtm.101119-1850
Debug session time: Sat Apr  9 04:08:45.595 2011 (UTC - 4:00)
System Uptime: 1 days 5:50:00.000
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption
BUGCHECK_STR:  0x109
DEFAULT_BUCKET_ID:  CODE_CORRUPTION
PROCESS_NAME:  System
FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT
Bugcheck code 00000109
Arguments a3a039d8`9d63b4f9 b3b7465e`efe0844f fffff800`03450720 00000000`00000001
BiosVersion = 0503   
BiosReleaseDate = 09/28/2009
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
  
  [/font]

 

[BMXer]

Wow, you guys are good. This is a new install. I had a drive failure, or so I thought, and redid everything. Its a validated and activated OS. Updating driver files now and will do the SFC scan when done.

Thanks again, I'll update when done.

 

[BMXer]

Drivers updated and it looks like all is good now.

Here is the NT6_BSOD Zip file.

Question ... I had the driver verify running for a day. Why does it dog the system so bad? The resources weren't that high, but it brought my system to its knees. And I have a fairy strong setup.

 

[usasma]

It depends on what settings you used for Driver Verifier. All settings will impact performance in one way or another - but using all of them (particularly Low Resource Simulation) will bring any system to it's knees. It's all the extra work that the system has to do to stress the drivers.

It appears that the NT6_BSOD Zip file doesn't have all the files needed. Don't worry about it for now, but if the BSOD's come back we'll have to work on getting it to work.

 

[BMXer]

Thanks for the help.

 

[BMXer]

I'm backkkk ... unfortunately

Woke up this morning with a BSOD. Ran the BSOD tool, and I think it got everything this time. While getting the file I noticed that my mouse has been a little sketchy. Its a USB wireless/infrared mouse. One part is plugged into a USB port. I was moving the mouse, it froze, like it does a lot, then the screens went crazy and blue screen came up ...

Anyway, zip attached ... is there a howto on how to read the files, or what to look for?

Thanks for any and all help ...

 

[usasma]

Everyone has a different way to analyze the BSOD's - here's a link to my instructions: WinDbg Analysis Report It's long and complicated - but just follow the steps and you'll get the same answers that we do.

We'll need the perfmon.html report (it wasn't included in the upload) in order to try and figure out what the Unknown USB Device is on your system:

Unknown Device USB\VID_0000&PID_0000\5&1DDA42A3&0&3 43

You've also got the infamous 2005 version of ASACPI.sys Also, it's the driver blamed by your Driver Verifier enabled memory dump from 10 Apr 2011.

Please visit the Asus website here: ASUSTeK Computer Inc.-Support- download_item_mkt
Select your OS and then expand the Utilities category.
Select "ATK0110 driver for WindowsXP/Vista/Win7 32&64-bit" (the 15th one down the list) and download/install it.

Then do this:
OLDER DRIVERS PRESENT IN THE DUMP FILES
- Create a System Restore Point prior to doing any of this. DO NOT mess with the drivers themselves - leave the Windows\System32\drivers directory alone unless we specifically direct you to it!
- Please update these drivers from the device manufacturer's website - or uninstall them from your system. Reference links are included below.
- DO NOT use Windows Update or the Update Drivers function of Device Manager.
- Please feel free to post back about any drivers that you are having difficulty locating.
- Windows Update exceptions may be noted below for Windows drivers:

[FONT=lucida console]
amdxata.sys     Fri Mar 19 12:18:18 2010 (4BA3A3CA)
vmbus.sys       Sat Nov 20 04:57:29 2010 (4CE79B89)
winhv.sys       Sat Nov 20 04:20:02 2010 (4CE792C2)
mfehidk.sys     Wed Oct 06 15:55:49 2010 (4CACD445)
mfenlfk.sys     Wed Oct 06 15:56:13 2010 (4CACD45D)
mfewfpk.sys     Wed Oct 06 15:56:04 2010 (4CACD454)
athurx.sys      Mon Jan 04 22:23:16 2010 (4B42B0A4)
AsUpIO.sys      Sun Jul 05 22:21:38 2009 (4A515FB2)
AsIO.sys        Mon Aug 03 03:03:16 2009 (4A768BB4)
mfeavfk.sys     Wed Oct 06 15:56:49 2010 (4CACD481)
GEARAspiWDM.sys Mon May 18 08:17:04 2009 (4A1151C0)
ASACPI.sys      Wed May 13 21:25:17 2009 (4A0B72FD)
mfefirek.sys    Wed Oct 06 15:59:47 2010 (4CACD533)
mfeapfk.sys     Wed Oct 06 15:56:26 2010 (4CACD46A)
cfwids.sys      Wed Oct 06 16:00:36 2010 (4CACD564)
atikmpag.sys    Wed Jan 26 17:13:33 2011 (4D409C8D)
atikmdag.sys    Wed Jan 26 17:48:28 2011 (4D40A4BC)
[COLOR=Red]ASACPI.sys      Sun Mar 27 22:30:36 2005 (42476C4C)[/COLOR]
[/FONT]

http://www.carrona.org/dvrref.html#amdxata.sys
http://www.carrona.org/dvrref.html#vmbus.sys
http://www.carrona.org/dvrref.html#winhv.sys
http://www.carrona.org/dvrref.html#mfehidk.sys
http://www.carrona.org/dvrref.html#mfenlfk.sys
http://www.carrona.org/dvrref.html#mfewfpk.sys
http://www.carrona.org/dvrref.html#athurx.sys
http://www.carrona.org/dvrref.html#AsUpIO.sys
http://www.carrona.org/dvrref.html#AsIO.sys
http://www.carrona.org/dvrref.html#mfeavfk.sys
http://www.carrona.org/dvrref.html#GEARAspiWDM.sys
http://www.carrona.org/dvrref.html#ASACPI.sys
http://www.carrona.org/dvrref.html#mfefirek.sys
http://www.carrona.org/dvrref.html#mfeapfk.sys
http://www.carrona.org/dvrref.html#cfwids.sys
http://www.carrona.org/dvrref.html#atikmpag.sys
http://www.carrona.org/dvrref.html#atikmdag.sys
http://www.carrona.org/dvrref.html#ASACPI.sys

BSOD BUGCHECK SUMMARY

Built by: 7601.17514.amd64fre.win7sp1_rtm.101119-1850
Debug session time: Sun Apr 17 11:50:46.168 2011 (UTC - 4:00)
System Uptime: 0 days 0:29:22.991
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption
BUGCHECK_STR: 0x109
DEFAULT_BUCKET_ID: CODE_CORRUPTION
PROCESS_NAME: System
FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT
Bugcheck code 00000109
Arguments a3a039d8`9c36d568 b3b7465e`eeb3a4be fffff800`03451480 00000000`00000001
BiosVersion = 1006
BiosReleaseDate = 08/18/2010
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7601.17514.amd64fre.win7sp1_rtm.101119-1850
Debug session time: Sun Apr 17 03:32:41.623 2011 (UTC - 4:00)
System Uptime: 2 days 21:12:00.012
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption
BUGCHECK_STR: 0x109
DEFAULT_BUCKET_ID: CODE_CORRUPTION
PROCESS_NAME: System
FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_STRIDE
Bugcheck code 00000109
Arguments a3a039d8`9fd03abe b3b7465e`f24d0a14 fffff800`03450800 00000000`00000001
BiosVersion = 1006
BiosReleaseDate = 08/18/2010
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7601.17514.amd64fre.win7sp1_rtm.101119-1850
Debug session time: Sun Apr 10 14:04:49.374 2011 (UTC - 4:00)
System Uptime: 0 days 0:11:15.795
*** WARNING: Unable to verify timestamp for ASACPI.sys
*** ERROR: Module load completed but symbols could not be loaded for ASACPI.sys
Probably caused by : ASACPI.sys ( ASACPI+19a0 )
BUGCHECK_STR: 0xc9_22f
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME: System
FAILURE_BUCKET_ID: X64_0xc9_22f_VRFK_ASACPI+19a0
Bugcheck code 000000C9
Arguments 00000000`0000022f fffff880`048689a0 fffff980`738bcc60 00000000`00000000
BiosVersion = 0503
BiosReleaseDate = 09/28/2009

 

[BMXer]

OK ... had to do a system restore ... Looks like a video driver. Doing this fast before it crashes again/

 

[BMXer]

This is getting frustrating ... I added 4 gig ram several week ago ... touched one while looking for a loose usb reader connector. They were almost to hot to touch. 2x Super Talent 2 gig sticks. The other two were warm, but not to hot to touch.

Attached newest BSOD files and the perform file

 

[usasma]

Please update the chipset drivers for your motherboard. One of the unknown devices is a USB controller. Hopefully that'll let us figure out what the other one is.

If the RAM is overheating, then that will cause BSOD's. I'd suggest pointing a house fan at the RAM to keep it cool while testing. More to follow after work....

 

[BMXer]

Will do after work ... still running this morning.

 

[usasma]

After reviewing the uploads, if the RAM is that hot, then I'd suggest running MemTest to see if that's what's causing the issues: Memory Diagnostics (read the details at the link)

If that doesn't pick up anything, then try Prime95 according to these directions:]

Prime95 download site: Free Software - GIMPS
Prime95 Setup:
- extract the contents of the zip file to a location of your choice
- double click on the executable file
- select "Just stress testing"
- select the "Blend" test. If you've already run MemTest overnight please run the "Small FFTs" test instead. (run all 3 if you find a problem and note how long it takes to error out with each)
- "Number of torture test threads to run" should equal the number of CPU's times 2 (if you're using hyperthreading).
The easiest way to figure this out is to go to Task Manager...Performance tab - and see the number of boxes under CPU Usage History
Then run the test for 6 to 24 hours - or until you get errors (whichever comes first).
This won't necessarily crash the system - but check the output in the test window for errors.
The Test selection box and the stress.txt file describes what components that the program stresses.
More details on the use of this test: Torture test your CPU with Prime95

Watch it closely, and if it starts spitting out errors, terminate the test IMMEDIATELY.

 

[BMXer]

Well, looks like it was the memory sticks getting to hot. Everything is good. Updated the Chipset drivers and BIOS and there are no more 'unknown device' errors.

This weekend I'm going to swap the two 2 gig sticks that I have in now with the two I removed, and see what happens. If there are no problems I'm going to try it again, but with some more cooling in that area. The case is a full size one so there could be a dead air space in that area. I'll add another fan and go from there.

More info later .. and thanks for the help and information.

 

[BMXer]

New year and another problem

Had a recent update and getting random BSOD. Seems there is an unknown device again ... how can I fix this grrrr.

Zip file with the latest info is attached. No change of system. Win7 Pro 64 bit with 8 gig Ram.

Thanks in advance for the help.

edit: Looking at my older posts ... I ended up staggering the memory sticks after going over the motherboard documentation. Read the instructions ... who would have guessed After i did that memory temps fine ... barely warm.

 

[usasma]

I really can't remember everything from the previous problem, so I'll just start over fresh here.
We should consider it a new issue anyway - due to the long period that's elapsed since you last posted.

I have no clue as to the make/model of your system. If it's a custom build, we'll need the make/model of the motherboard. Is it a desktop or laptop? Unplug all USB devices and see if the unknown device remains.

You have a TP-LINK 150Mbps Wireless USB Adapter. Using these devices with older drivers is sure to cause BSOD's. DO NOT use these devices if you cannot find Win7 drivers for them - compatibility mode just doesn't work.
Here's my rant about these devices:

I do not recommend using wireless USB devices. Especially in Win7 systems.
These wireless USB devices have many issues with Win7 - and using Vista drivers with them is almost sure to cause a BSOD.
Should you want to keep using these devices, be sure to have Win7 drivers - DO NOT use Vista drivers!!!
An installable wireless PCI/PCIe card that's plugged into your motherboard is much more robust, reliable, and powerful.

MSINFO32 shows that this device is disabled:

Microsoft Virtual WiFi Miniport Adapter #2 {5D624F94-8850-40C3-A3FA-A4FD2080BAF3}\VWIFIMP\6&2FE22C31&2&04 This device is disabled.

Please enable the device and then update the drivers (?Windows Update?). Then either leave it enabled or uninstall it from the system - don't disable it again (for testing purposes).

Memory dumps from Jan 2012 are all STOP 0x109 (details on error here: BSOD Index ) and all blame memory_corruption. This is most likely either a RAM issue, or a driver issue. Please run MemTest and Prime 95 in order to firmly rule out the RAM (links to these programs here: Hardware Diags )

Please post back with the results of the memory tests.

Sometimes Norton will cause memory problems, and not leave any clues that I can find.
Please try this to rule out your Norton:

Anti-Virus Removal:
Please do the following:
- download a free antivirus for testing purposes: Free AntiVirus
- uninstall the Norton from your system (you can reinstall it, if so desired, when we're done troubleshooting)
- remove any remnants of Norton using this free tool: http://us.norton.com/support/kb/web_view.jsp?wv_type=public_web&docurl=20080710133834EN
- IMMEDIATELY install and update the free antivirus, then check to ensure that the Windows Firewall is turned on.
- check to see if this fixes the BSOD's
NOTE: NEVER run more than 1 anti-virus, firewall, Internet Security/Security Center application at the same time.

BSOD BUGCHECK SUMMARY

[font=lucida console]
Loading Dump File [C:\Users\FUBAR\_jcgriff2_\dbug\__Kernel__\010612-24913-01.dmp]
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Debug session time: Fri Jan  6 18:05:49.373 2012 (UTC - 5:00)
System Uptime: 1 days 8:35:14.793
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption
BUGCHECK_STR:  0x109
DEFAULT_BUCKET_ID:  CODE_CORRUPTION
PROCESS_NAME:  System
FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT
Bugcheck code 00000109
Arguments a3a039d8`a1b56721 b3b7465e`f4323677 fffff800`03418790 00000000`00000001
BiosVersion = 1006   
BiosReleaseDate = 08/18/2010
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Loading Dump File [C:\Users\FUBAR\_jcgriff2_\dbug\__Kernel__\010512-26192-01.dmp]
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Debug session time: Thu Jan  5 06:10:19.541 2012 (UTC - 5:00)
System Uptime: 0 days 8:28:06.961
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption
BUGCHECK_STR:  0x109
DEFAULT_BUCKET_ID:  CODE_CORRUPTION
PROCESS_NAME:  System
FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT
Bugcheck code 00000109
Arguments a3a039d8`ab1145e5 b3b7465e`fd8e153b fffff800`034187ff 00000000`00000001
BiosVersion = 1006   
BiosReleaseDate = 08/18/2010
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Loading Dump File [C:\Users\FUBAR\_jcgriff2_\dbug\__Kernel__\010412-23587-01.dmp]
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Debug session time: Wed Jan  4 21:01:28.986 2012 (UTC - 5:00)
System Uptime: 1 days 5:02:51.391
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption
BUGCHECK_STR:  0x109
DEFAULT_BUCKET_ID:  CODE_CORRUPTION
PROCESS_NAME:  System
FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_STRIDE
Bugcheck code 00000109
Arguments a3a039d8`a9ba387c b3b7465e`fc3707d2 fffff800`0341803d 00000000`00000001
BiosVersion = 1006   
BiosReleaseDate = 08/18/2010
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
  
  [/font]

 

[BMXer]

Sorry for the missing information ... yes, its a custom desktop setup.

Mother board is an ASUS M4A786-M
As for the TP-LINK ... thats always been a question for me. Guess I'll break down and get a good PCI/PCIe wireless card. Any suggestions?

Will be removing the Microsoft Virtual WiFi Miniport Adapter. That was not part of the original build, don't know when it was installed. Maybe when I was fiddling with wireless adapters last year.

Will update the rest when completed.

You guys are great, thanks.

 

[usasma]

Just FYI -

Just FYI - a recent poster (early Nov 2011) states that they were advised by Asus to manually set their memory settings/timings/voltages because of issues with the M4 series of motherboards.
You can get the settings/timings/voltages from the website of your RAM manufacturer.

 

[BMXer]

Ok, looking for them but nothing yet ... T800UX2GC4
I removed the Wireless USB and Norton ... BSOD still. Newest file attached

Thanks for the FYI and help.

 

[cluberti]

The dumps all indicate something on the system is modifying kernel-level code and overwriting function areas with different data - as soon as this happens, the checksum and hash of the binary in memory and the one on disk that the file in memory came from don't match - and Windows bugchecks with a 0x109 immediately. In this case, there is indeed an overwrite in non-writable kernel memory for memory regions used by the kernel itself:

0: kd> !chkimg -lo 50 -db !nt
4 errors : !nt (fffff80003418257-fffff80003418de7)
fffff80003418250  49  8b  73  48  49  8b  e3 *61  5f  41  5e  41  5d  41  5c  5f I.sHI..a_A^A]A\_
...
fffff80003418670  fb  7c  7e  49  89  5d  00 *8f  15  97  0a  13  00  48  03  d1 .|~I.].......H..
...
fffff800034188d0  90  90  90  90  90  90  90 *b0  90  90  90  90  90  90  90  90 ................
...
fffff80003418de0  48  83  ec  28  33  d2  8d *4e  03  e8  82  b0  d3  ff  33  c0 H..(3..N......3.

The question is (given some of these are also "off by one" errors), WHEN did this start? This is almost always a hardware problem.