Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Memory-Related BSODs


  • Please log in to reply
9 replies to this topic

#1 dpitch40

dpitch40

  • Members
  • 37 posts
  • OFFLINE
  •  
  • Local time:06:52 PM

Posted 13 May 2011 - 08:45 PM

I installed Windows 7 Ultimate on my desktop computer late last year and it's been working well. But starting about a month ago, I've been getting sporadic BSODs--I just had my third. I finally got around to the overly complicated debugging process and read the dump files. I was expecting it to be the same error every time, but actually all three were caused by different errors. But they all seem related to memory/disk access and I'm wondering if one underlying problem could be causing them all. They seem to be essentially random; I wasn't doing anything unusual that could have caused this most recent one.

From 4/15/2011:

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 0000000000025b22, page frame number
Arg3: 0000000000000002, current page state
Arg4: 0000000000025b17, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_99

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  mscorsvw.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80002d4b38c to fffff80002cbb740

STACK_TEXT:  
fffff880`09bb6108 fffff800`02d4b38c : 00000000`0000004e 00000000`00000099 00000000`00025b22 00000000`00000002 : nt!KeBugCheckEx
fffff880`09bb6110 fffff800`02d2d9e5 : 00000000`00000000 fffff680`00327ba8 7c400000`24c61025 00000000`00000001 : nt!MiBadShareCount+0x4c
fffff880`09bb6150 fffff800`02c8fc13 : fffffa80`040e9750 fffff700`000017c6 0000007f`fffffff8 fffff8a0`013edf98 : nt! ?? ::FNODOBFM::`string'+0x3222c
fffff880`09bb61e0 fffff800`02c8e67a : fffffa80`040e9750 fffffa80`00000006 fffff8a0`00000568 00000000`00000000 : nt!MiDeleteAddressesInWorkingSet+0x307
fffff880`09bb6a90 fffff800`02f9eabf : fffff8a0`00785c50 00000000`00000001 00000000`00000000 fffffa80`047b5060 : nt!MmCleanProcessAddressSpace+0x96
fffff880`09bb6ae0 fffff800`02f7795b : 00000000`80131506 00000000`00000001 00000000`fffdb000 00000000`00000000 : nt!PspExitThread+0x92f
fffff880`09bb6ba0 fffff800`02cba993 : fffffa80`040e9750 fffff880`80131506 00000000`00000000 fffffa80`047b5060 : nt!NtTerminateProcess+0x25b
fffff880`09bb6c20 00000000`7709f97a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0010db48 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7709f97a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiBadShareCount+4c
fffff800`02d4b38c cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiBadShareCount+4c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4cc791bd

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

Followup: MachineOwner

From 4/28/2011:
2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa923b28d81b, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80002ca353b, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000005, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS:  fffffa923b28d81b 

FAULTING_IP: 
nt!MiAgeWorkingSet+41b
fffff800`02ca353b 410fb65f1b      movzx   ebx,byte ptr [r15+1Bh]

MM_INTERNAL_CODE:  5

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  System

CURRENT_IRQL:  0

TRAP_FRAME:  fffff880033167a0 -- (.trap 0xfffff880033167a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000058000000000 rbx=0000000000000000 rcx=fffff6fcc001e248
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ca353b rsp=fffff88003316930 rbp=007ffffcc001e248
 r8=0000000000000001  r9=fffff80002e1be00 r10=0000000000000005
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!MiAgeWorkingSet+0x41b:
fffff800`02ca353b 410fb65f1b      movzx   ebx,byte ptr [r15+1Bh] ds:c670:00000000`0000001b=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002d0e8c1 to fffff80002c8f740

STACK_TEXT:  
fffff880`03316638 fffff800`02d0e8c1 : 00000000`00000050 fffffa92`3b28d81b 00000000`00000000 fffff880`033167a0 : nt!KeBugCheckEx
fffff880`03316640 fffff800`02c8d82e : 00000000`00000000 f8a00613`b8480400 00000000`00001000 fffff800`02dc3bfe : nt! ?? ::FNODOBFM::`string'+0x40e8b
fffff880`033167a0 fffff800`02ca353b : 00000000`150ce000 53200000`4fb2f963 00000000`00000000 00000000`0000dd32 : nt!KiPageFault+0x16e
fffff880`03316930 fffff800`02d11a5e : fffff800`02e1be00 fffff880`00000001 00000000`00000001 fffff880`03316bb0 : nt!MiAgeWorkingSet+0x41b
fffff880`03316ae0 fffff800`02ca3ee2 : 00000000`000000ff 00000000`00000000 fffffa80`00000000 00000000`00000004 : nt! ?? ::FNODOBFM::`string'+0x496d6
fffff880`03316b80 fffff800`02ca4173 : 00000000`00000008 fffff880`03316c10 00000000`00000001 fffffa80`00000000 : nt!MmWorkingSetManager+0x6e
fffff880`03316bd0 fffff800`02f327c6 : fffffa80`039f7040 00000000`00000080 fffffa80`039ae890 00000000`00000001 : nt!KeBalanceSetManager+0x1c3
fffff880`03316d40 fffff800`02c6dc26 : fffff880`02f63180 fffffa80`039f7040 fffff880`02f6dfc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`03316d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiAgeWorkingSet+41b
fffff800`02ca353b 410fb65f1b      movzx   ebx,byte ptr [r15+1Bh]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!MiAgeWorkingSet+41b

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4cc791bd

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x50_nt!MiAgeWorkingSet+41b

BUCKET_ID:  X64_0x50_nt!MiAgeWorkingSet+41b

Followup: MachineOwner

From 5/13/2011:
2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

POOL_CORRUPTION_IN_FILE_AREA (de)
A driver corrupted pool memory used for holding pages destined for disk.
This was discovered by the memory manager when dereferencing the file.
Arguments:
Arg1: 0000000000000002
Arg2: fffff8a00e5a2e20
Arg3: fffff8a00e5f7621
Arg4: 0000000023a6d8c0

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xDE

PROCESS_NAME:  iTunes.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80002c1c403 to fffff80002c77700

STACK_TEXT:  
fffff880`08ba9538 fffff800`02c1c403 : 00000000`000000de 00000000`00000002 fffff8a0`0e5a2e20 fffff8a0`0e5f7621 : nt!KeBugCheckEx
fffff880`08ba9540 fffff800`02c5cb72 : 00000000`00000000 fffffa80`04587a00 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x2d220
fffff880`08ba9630 fffff880`012c9def : fffffa80`040d11c8 00000000`00000000 fffff8a0`00000000 00000000`00000000 : nt!CcPurgeCacheSection+0x172
fffff880`08ba96a0 fffff880`012e2cea : fffff880`06b2e730 fffff8a0`0e520b40 fffff8a0`0259c140 fffff880`08ba999c : Ntfs!NtfsDeleteFile+0x57b
fffff880`08ba9920 fffff880`01253829 : fffffa80`04406e40 fffffa80`0424ec10 fffff880`06b2e690 fffffa80`03ae7b60 : Ntfs!NtfsCommonCleanup+0x15da
fffff880`08ba9d30 fffff800`02c6f587 : fffff880`06b2e690 00000000`00000000 00000000`7ef6b000 00000000`0e8ffc4c : Ntfs!NtfsCommonCleanupCallout+0x19
fffff880`08ba9d60 fffff800`02c6f541 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KySwitchKernelStackCallout+0x27
fffff880`06b2e560 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwitchKernelStackContinue


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+2d220
fffff800`02c1c403 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+2d220

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4d9fdd34

FAILURE_BUCKET_ID:  X64_0xDE_nt!_??_::FNODOBFM::_string_+2d220

BUCKET_ID:  X64_0xDE_nt!_??_::FNODOBFM::_string_+2d220

Followup: MachineOwner

I'm not entirely sure how to read these--if someone more experienced could help me interpret them and look for a pattern, I would be most grateful.

BC AdBot (Login to Remove)

 


#2 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:11:52 PM

Posted 13 May 2011 - 08:55 PM

We need to know more about your BSODs...

Download BlueScreenView (in Zip file)

No installation required.

Unzip downloaded file and double click on BlueScreenView.exe file to run the program and When scanning is done, go to Edit > Select All.

Then go to File > Save Selected Items, and save the report as BSOD.txt.

Open BSOD.txt in Notepad, copy all content, and paste it into your next reply.

Compliments of Broni

#3 dpitch40

dpitch40
  • Topic Starter

  • Members
  • 37 posts
  • OFFLINE
  •  
  • Local time:06:52 PM

Posted 13 May 2011 - 09:10 PM

==================================================
Dump File         : 051311-47330-01.dmp
Crash Time        : 5/13/2011 7:56:13 PM
Bug Check String  : POOL_CORRUPTION_IN_FILE_AREA
Bug Check Code    : 0x000000de
Parameter 1       : 00000000`00000002
Parameter 2       : fffff8a0`0e5a2e20
Parameter 3       : fffff8a0`0e5f7621
Parameter 4       : 00000000`23a6d8c0
Caused By Driver  : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+70700
File Description  : NT Kernel & System
Product Name      : Microsoft® Windows® Operating System
Company           : Microsoft Corporation
File Version      : 6.1.7600.16792 (win7_gdr.110408-1633)
Processor         : x64
Computer Name     : 
Full Path         : C:\Windows\Minidump\051311-47330-01.dmp
Processors Count  : 4
Major Version     : 15
Minor Version     : 7600
Dump File Size    : 287,032
==================================================

==================================================
Dump File         : 042811-50232-01.dmp
Crash Time        : 4/28/2011 6:22:01 PM
Bug Check String  : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code    : 0x00000050
Parameter 1       : fffffa92`3b28d81b
Parameter 2       : 00000000`00000000
Parameter 3       : fffff800`02ca353b
Parameter 4       : 00000000`00000005
Caused By Driver  : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+70740
File Description  : NT Kernel & System
Product Name      : Microsoft® Windows® Operating System
Company           : Microsoft Corporation
File Version      : 6.1.7600.16792 (win7_gdr.110408-1633)
Processor         : x64
Computer Name     : 
Full Path         : C:\Windows\Minidump\042811-50232-01.dmp
Processors Count  : 4
Major Version     : 15
Minor Version     : 7600
Dump File Size    : 286,992
==================================================

==================================================
Dump File         : 041511-49343-01.dmp
Crash Time        : 4/15/2011 10:55:12 PM
Bug Check String  : PFN_LIST_CORRUPT
Bug Check Code    : 0x0000004e
Parameter 1       : 00000000`00000099
Parameter 2       : 00000000`00025b22
Parameter 3       : 00000000`00000002
Parameter 4       : 00000000`00025b17
Caused By Driver  : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+70740
File Description  : NT Kernel & System
Product Name      : Microsoft® Windows® Operating System
Company           : Microsoft Corporation
File Version      : 6.1.7600.16792 (win7_gdr.110408-1633)
Processor         : x64
Computer Name     : 
Full Path         : C:\Windows\Minidump\041511-49343-01.dmp
Processors Count  : 4
Major Version     : 15
Minor Version     : 7600
Dump File Size    : 285,440
==================================================

Thanks for pointing me to that handy utility, by the way.

#4 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:11:52 PM

Posted 13 May 2011 - 10:09 PM

How to Test your RAM



Guide Overview

The purpose of this guide is to teach you how to check whether your system's RAM (Ramdom Access Memory) is working properly. Bad RAM can lead to a whole host of problems, often which do not appear to have a single cause -- appearing as systemwide glitches, blue screens, and other system trouble. MemTest86+ provides a very good detection mechanism for failed RAM, and is about as good a test you get short of actually replacing the module itself.

Tools Needed
Please perform these steps from a separate, working, machine.Perform these steps on the problem machine.
  • Put your CD in the drive and configure your machine to boot to the CD. This is different on all machines, but it's usually by pressing F12 or F10 as your system boots, and selecting either "CDROM" or your cdrom drive. If you are unable to force a CDRom boot, reply with the make and model of your machine and I should be able to get you exact instructions.
  • If you've done it correctly, MemTest86+ will start to run automaticly, as shown below:
    Posted Image
  • If you want to be reasonably your RAM is OK, then allow MemTest to run until you see this message:
    Posted Image

    On the other hand, if you want to be completely sure your RAM is OK, allow MemTest to run overnight. Memtest will run forever until power is pulled on the machine.
  • Check the MemTest screen for any reported errors. Errors will appear as RED warnings at the bottom of the screen, similar to the following screenshot:
    Posted Image
  • Hard-Reset the machine, removing the MemTest disk in the process.
If you didn't get an error screen, Congratulations! :)

Compliments of Billy O'Neal.

#5 dpitch40

dpitch40
  • Topic Starter

  • Members
  • 37 posts
  • OFFLINE
  •  
  • Local time:06:52 PM

Posted 14 May 2011 - 12:00 AM

If my computer fails, do I need to replace one or both of my memory cards?

#6 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:11:52 PM

Posted 14 May 2011 - 12:04 AM

It would depend on the extent of the failure.

Test one stick at a time if you see failures in the first run.

#7 hamluis

hamluis

    Moderator


  • Moderator
  • 55,411 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:06:52 PM

Posted 14 May 2011 - 10:22 AM

FWIW: Memtest86+ Guide-How To's - Overclockers Forums - http://www.overclockers.com/forums/showthread.php?t=409152

Louis

#8 dpitch40

dpitch40
  • Topic Starter

  • Members
  • 37 posts
  • OFFLINE
  •  
  • Local time:06:52 PM

Posted 22 May 2011 - 05:48 PM

Thank you. Memtest86+ has been instrumental in diagnosing and fixing this problem the last few days. I isolated the problem to one of my memory sticks having gone bad. I got a three-pack of (what I believed to be) the exact same 2GB memory sticks. After installing them, I had problems installing a game, got a BSOD while restarting, then got another one while attempting to diagnose the first one. I ran Memtest86+ on the new sticks and all three failed within minutes. Turns out that the sticks I got were triple-channel (hence the three-pack) and only work with triple-channel-compatible boards and processors, which mine are not. I replaced them with some Kingston dual-channel sticks (which had better work). I was unaware of this dual and triple-channel compatibility issue and the sources I've consulted seem to say that all I should get is a performance hit, but the stucks should still function correctly. Can anyone elaborate on what happened?

#9 Layback Bear

Layback Bear

  • Members
  • 1,880 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Northern Ohio
  • Local time:06:52 PM

Posted 22 May 2011 - 06:34 PM

Triple or dual channel ram is all decided by the mother board and it's bios. It doesn't care how you bought it. Two stick packages or 3 stick packages or a box car full. Your mother board manual will show you where to install the ram for your motherboard. You must load them as per the manual or they will not work properly and most likely if done wrong will not boot. Example: my mother board is triple channel with 6 ram slots. If I install 3 sticks of ram in slots 1,3,5 it will not boot. If I remove them and install them in slots 2,4,6 I have got triple channel that boots. I can't give you answers why, but I can say when done as per manual it has always worked for me.

#10 dpitch40

dpitch40
  • Topic Starter

  • Members
  • 37 posts
  • OFFLINE
  •  
  • Local time:06:52 PM

Posted 22 May 2011 - 07:29 PM

I'm not sure Memtest86+ works the same as a normal OS. I'm supposed to be able to test any stick in any slot, and I was able to do so. When I had the four memory sticks in each of my board's slots, it did boot, but I got near-constant BSODs. These were all supposedly the exact same memory sticks, except one is marketed as "Triple-channel" and said to be optimized for the Intel i7 processor. My previous sticks The failed sticks




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users