[sutty100]

Hi I recently seem to be getting random BSODS and i dont no why! I have attached the two latest mini dumps, Im running windows vista professional

Processor AMD Athlon(tm) 64 X2 Dual Core Processor 5200+

Hardware:
Total amount of system memory 4.00 GB RAM
System type 32-bit operating system
Number of processor cores 2
64-bit capable Yes

Storage
--------------------------------------------------------------------------------

Total size of hard disk(s) 149 GB
Disk partition (C 93 GB Free (149 GB Total)
Media drive (D CD/DVD

Graphics
--------------------------------------------------------------------------------

Display adapter type NVIDIA GeForce 9600 GT
Total available graphics memory 2047 MB
Dedicated graphics memory 512 MB
Dedicated system memory 0 MB
Shared system memory 1535 MB
Display adapter driver version 7.15.11.7516
Primary monitor resolution 1440x900
DirectX version DirectX 10

Network
--------------------------------------------------------------------------------

Network Adapter NVIDIA nForce 10/100 Mbps Ethernet
Network Adapter Belkin F6D4050 Enhanced Wireless USB Adapter
Network Adapter Microsoft Tun Miniport Adapter

Thanks in advance.

 

[sutty100]

Just had another which said driver irql less not equal

 

[Tyree]

You need to read the Error Codes on the BSOD.
BSOD's are generally a hardware problem.

 

[sutty100]

What are the error codes? Is it likely to be RAM? i have one of two sticks out at the moment and am waiting 4 a bsod :-S

 

[usasma]

The first step (IMO) would be to check for malware (due to csrss.exe and the STOP 0x8e error). Here's a link to the malware forums: http://www.techsupportforum.com/f50/

Beyond that, I'd wait for some more input (from others) before proceeding with any further testing.

Here's the analysis' of the memory dumps...
27 May dump file:

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\FUBAR-RC1-Desktop\Downloads\Minidump9\Mini052709-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows Server 2008/Windows Vista Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6001.18226.x86fre.vistasp1_gdr.090302-1506
Machine Name:
Kernel base = 0x81a07000 PsLoadedModuleList = 0x81b1ec70
Debug session time: Wed May 27 10:44:39.711 2009 (GMT-4)
System Uptime: 0 days 0:11:39.454
Loading Kernel Symbols
...............................................................
................................................................
...................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 94b8317f, 8d42fc68, 0}

Probably caused by : win32k.sys ( win32k!TimersProc+80 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 94b8317f, The address that the exception occurred at
Arg3: 8d42fc68, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
win32k!TimersProc+80
94b8317f 0fba762803      btr     dword ptr [esi+28h],3

TRAP_FRAME:  8d42fc68 -- (.trap 0xffffffff8d42fc68)
ErrCode = 00000003
eax=00000000 ebx=00000000 ecx=00005c68 edx=00005c68 esi=0067a8c8 edi=0067a8d4
eip=94b8317f esp=8d42fcdc ebp=8d42fcf8 iopl=0         nv up ei pl zr na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
win32k!TimersProc+0x80:
94b8317f 0fba762803      btr     dword ptr [esi+28h],3 ds:0023:0067a8f0=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x8E

PROCESS_NAME:  csrss.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 94abe847 to 94b8317f

STACK_TEXT:  
8d42fcf8 94abe847 00000004 017bfe78 94b81fd7 win32k!TimersProc+0x80
8d42fd34 94abee1e 00000004 00000002 97a5c450 win32k!RawInputThread+0x615
8d42fd48 94b81ff2 00000004 017bfe78 8d42fd64 win32k!xxxCreateSystemThreads+0x4a
8d42fd58 81a5ea1a 00000004 017bfeb8 76e79a94 win32k!NtUserCallNoParam+0x1b
8d42fd58 76e79a94 00000004 017bfeb8 76e79a94 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
017bfeb8 00000000 00000000 00000000 00000000 0x76e79a94


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!TimersProc+80
94b8317f 0fba762803      btr     dword ptr [esi+28h],3

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  win32k!TimersProc+80

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  498f9e9d

FAILURE_BUCKET_ID:  0x8E_win32k!TimersProc+80

BUCKET_ID:  0x8E_win32k!TimersProc+80

Followup: MachineOwner
---------

1: kd> !thread
GetPointerFromAddress: unable to read from 81b3e86c
THREAD 88204c58  Cid 026c.0300  Teb: 7ffd9000 Win32Thread: ffaaacb8 RUNNING on processor 1
IRP List:
    Unable to read nt!_IRP @ 84ced008
Not impersonating
GetUlongFromAddress: unable to read from 81b16394
Owning Process            87c755d8       Image:         csrss.exe
Attached Process          N/A            Image:         N/A
ffdf0000: Unable to get shared data
Wait Start TickCount      44765        
Context Switch Count      173766             
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime                  00:00:00.000
KernelTime                00:00:00.000
Win32 Start Address 0x75579a30
Stack Init 8d430000 Current 8d42f678 Base 8d430000 Limit 8d42d000 Call 0
Priority 15 BasePriority 13 PriorityDecrement 0 IoPriority 2 PagePriority 5
ChildEBP RetAddr  Args to Child              
8d42fcf8 94abe847 00000004 017bfe78 94b81fd7 win32k!TimersProc+0x80 (FPO: [0,4,4])
8d42fd34 94abee1e 00000004 00000002 97a5c450 win32k!RawInputThread+0x615 (FPO: [1,10,0])
8d42fd48 94b81ff2 00000004 017bfe78 8d42fd64 win32k!xxxCreateSystemThreads+0x4a (FPO: [0,2,0])
8d42fd58 81a5ea1a 00000004 017bfeb8 76e79a94 win32k!NtUserCallNoParam+0x1b (FPO: [1,0,0])
8d42fd58 76e79a94 00000004 017bfeb8 76e79a94 nt!KiFastCallEntry+0x12a (FPO: [0,3] TrapFrame @ 8d42fd64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
017bfeb8 00000000 00000000 00000000 00000000 0x76e79a94

26 May dump file:

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\FUBAR-RC1-Desktop\Downloads\Minidump9\Mini052609-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows Server 2008/Windows Vista Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6001.18063.x86fre.vistasp1_gdr.080425-1930
Machine Name:
Kernel base = 0x81803000 PsLoadedModuleList = 0x8191ac70
Debug session time: Tue May 26 11:55:53.487 2009 (GMT-4)
System Uptime: 0 days 0:16:28.175
Loading Kernel Symbols
...............................................................
................................................................
...........
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck FC, {747aca, d748d847, 818f8af8, 0}

Probably caused by : ntkrpamp.exe ( nt!KiTrap0E+dc )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
An attempt was made to execute non-executable memory.  The guilty driver
is on the stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: 00747aca, Virtual address for the attempted execute.
Arg2: d748d847, PTE contents.
Arg3: 818f8af8, (reserved)
Arg4: 00000000, (reserved)

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xFC

PROCESS_NAME:  System

CURRENT_IRQL:  2

TRAP_FRAME:  818f8af8 -- (.trap 0xffffffff818f8af8)
ErrCode = 00000011
eax=818f8cd8 ebx=00ea6300 ecx=85736e14 edx=00000000 esi=84ea6418 edi=818f8ba0
eip=00747aca esp=818f8b6c ebp=818f8c88 iopl=0         nv up ei pl zr na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
00747aca ??              ???
Resetting default scope

LAST_CONTROL_TRANSFER:  from 8185dbb4 to 818a8155

STACK_TEXT:  
818f8ae0 8185dbb4 00000008 00747aca 00000000 nt!MmAccessFault+0x10a
818f8ae0 00747aca 00000008 00747aca 00000000 nt!KiTrap0E+0xdc
WARNING: Frame IP not in any known module. Following frames may be wrong.
818f8b68 818b9d00 84ea63f8 84ea6030 72e4a36e 0x747aca
818f8c88 818b9936 818f8cd0 00000002 818f8cd8 nt!KiTimerListExpire+0x367
818f8ce8 818b9483 00000000 00000000 0000f70a nt!KiTimerExpiration+0x2a0
818f8d50 818b7f9d 00000000 0000000e 00000000 nt!KiRetireDpcList+0xba
818f8d54 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x49


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiTrap0E+dc
8185dbb4 85c0            test    eax,eax

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!KiTrap0E+dc

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4812bd71

FAILURE_BUCKET_ID:  0xFC_nt!KiTrap0E+dc

BUCKET_ID:  0xFC_nt!KiTrap0E+dc

Followup: MachineOwner
---------

0: kd> !thread
GetPointerFromAddress: unable to read from 8193a86c
THREAD 818ff640  Cid 0000.0000  Teb: 00000000 Win32Thread: 00000000 RUNNING on processor 0
Not impersonating
GetUlongFromAddress: unable to read from 81912394
Owning Process            818ff900       Image:         <Unknown>
Attached Process          840c9490       Image:         System
ffdf0000: Unable to get shared data
Wait Start TickCount      0            
Context Switch Count      594490             
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime                  00:00:00.000
KernelTime                00:00:00.000
Win32 Start Address nt!KiIdleLoop (0x818b7f54)
Stack Init 818f9000 Current 818f8d4c Base 818f9000 Limit 818f6000 Call 0
Priority 0 BasePriority 0 PriorityDecrement 0 IoPriority 0 PagePriority 0
ChildEBP RetAddr  Args to Child              
818f8ae0 8185dbb4 00000008 00747aca 00000000 nt!MmAccessFault+0x10a
818f8ae0 00747aca 00000008 00747aca 00000000 nt!KiTrap0E+0xdc (FPO: [0,0] TrapFrame @ 818f8af8)
WARNING: Frame IP not in any known module. Following frames may be wrong.
818f8b68 818b9d00 84ea63f8 84ea6030 72e4a36e 0x747aca
818f8c88 818b9936 818f8cd0 00000002 818f8cd8 nt!KiTimerListExpire+0x367
818f8ce8 818b9483 00000000 00000000 0000f70a nt!KiTimerExpiration+0x2a0
818f8d50 818b7f9d 00000000 0000000e 00000000 nt!KiRetireDpcList+0xba
818f8d54 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x49 (FPO: [0,0,0])

 

[sutty100]

the system runs fine with 1 stick of 2GB RAM in, with 2 2GB sticks it becomes unstable, this is true with either stick in.

 

[usasma]

Just guessing here, but try running this free memory diagnostic ( http://www.memtest86.com/ ) for at least 3 passes on each slot (with only 1 stick of RAM).

Start with the first slot and test each stick (individually) there. Then take one of the sticks that passed, and test it in each slot (individually). This'll tell you if there's any bad sticks or slots.

Check your BIOS to see what version you have, then check the website of the manufacturer of your motherboard to see if any BIOS updates have been released. Check the changelog to see if they relate to memory issues. If they do, you'll have to update your BIOS.

BIOS updating (aka "flashing") is dangerous, so proceed with care and triple check everything that you do.
- Make sure you get the right update for your motherboard - the wrong one can turn your BIOS/motherboard into an expensive paperweight
- Print out the instructions on how to do the update and keep them handy. Follow them exactly - and don't get antsy fingers by pushing keys when nothing seems to be going on. Don't have any cats or kids around when doing this in case they get the sudden urge to pounce on your keyboard.
- Don't let the power be interrupted while performing the flash - that'll turn it into a brick also.

Good luck!

 

[sutty100]

Thanks usasma but I have already flashed the bios and run memtest. memtest came back fine after alot of passes and the bios flash didnt help. It is most annoying that I payed for a system with 4GB RAM but can only use 2GB!