locked
BSOD Crash Dump Report, Do I have BAD Memory? RRS feed

  • Question

  • I am looking for someone who knows far more about these things than I, here is what I am getting for my BSOD crash dump.  I have an Intel Phenom II 6x processor on an Asus M4A88T-M motherboard, I am running OCZ 10666 1333ghz ram.  Here is the report, and help would be awesome.

     


    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Windows\MEMORY.DMP]
    Kernel Summary Dump File: Only kernel address space is available

    Symbol search path is: *** Invalid ***
    ****************************************************************************
    * Symbol loading may be unreliable without a symbol search path.           *
    * Use .symfix to have the debugger choose a symbol path.                   *
    * After setting your symbol path, use .reload to refresh symbol locations. *
    ****************************************************************************
    Executable search path is:
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    *                                                                   *
    * The Symbol Path can be set by:                                    *
    *   using the _NT_SYMBOL_PATH environment variable.                 *
    *   using the -y <symbol_path> argument when starting the debugger. *
    *   using .sympath and .sympath+                                    *
    *********************************************************************
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntkrnlmp.exe -
    Windows 7 Kernel Version 7600 MP (6 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7600.20738.amd64fre.win7_ldr.100618-1621
    Machine Name:
    Kernel base = 0xfffff800`0301a000 PsLoadedModuleList = 0xfffff800`0324eeb0
    Debug session time: Wed Jan 26 14:49:47.540 2011 (UTC - 5:00)
    System Uptime: 1 days 17:30:44.882
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    *                                                                   *
    * The Symbol Path can be set by:                                    *
    *   using the _NT_SYMBOL_PATH environment variable.                 *
    *   using the -y <symbol_path> argument when starting the debugger. *
    *   using .sympath and .sympath+                                    *
    *********************************************************************
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntkrnlmp.exe -
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ..............................
    Loading User Symbols

    Loading unloaded module list
    ......
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 50, {fffff8200415fe78, 0, fffff800031b60bf, 5}

    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for fltmgr.sys -
    *** ERROR: Module load completed but symbols could not be loaded for Ntfs.sys
    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.

    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    Probably caused by : Pool_Corruption ( nt!ExFreePool+23f )

    Followup: MachineOwner
    ---------

    2: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced.  This cannot be protected by try-except,
    it must be protected by a Probe.  Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: fffff8200415fe78, memory referenced.
    Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
    Arg3: fffff800031b60bf, If non-zero, the instruction address which referenced the bad memory
        address.
    Arg4: 0000000000000005, (reserved)

    Debugging Details:
    ------------------

    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.

    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************

    ADDITIONAL_DEBUG_TEXT: 
    Use '!findthebuild' command to search for the target build information.
    If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

    FAULTING_MODULE: fffff8000301a000 nt

    DEBUG_FLR_IMAGE_TIMESTAMP:  0

    READ_ADDRESS: unable to get nt!MmSpecialPoolStart
    unable to get nt!MmSpecialPoolEnd
    unable to get nt!MmPoolCodeStart
    unable to get nt!MmPoolCodeEnd
     fffff8200415fe78

    FAULTING_IP:
    nt!ExFreePool+23f
    fffff800`031b60bf 4c395008        cmp     qword ptr [rax+8],r10

    MM_INTERNAL_CODE:  5

    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

    BUGCHECK_STR:  0x50

    CURRENT_IRQL:  0

    LAST_CONTROL_TRANSFER:  from fffff8000309b189 to fffff80003080580

    STACK_TEXT: 
    fffff880`02f76408 fffff800`0309b189 : 00000000`00000050 fffff820`0415fe78 00000000`00000000 fffff880`02f76560 : nt!KeBugCheckEx
    fffff880`02f76410 fffff800`0307e66e : 00000000`00000000 fffff820`0415fe78 00000000`00000000 00000000`00000004 : nt!PsGetCurrentThreadWin32ThreadAndEnterCriticalRegion+0x749
    fffff880`02f76560 fffff800`031b60bf : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`00401802 : nt!KeSynchronizeExecution+0x28de
    fffff880`02f766f0 fffff800`031b74c1 : fffff880`02f76860 fffff8a0`0df88ab0 fffff880`02f767c8 00000000`00000003 : nt!ExFreePool+0x23f
    fffff880`02f76780 fffff880`010f6633 : 00000000`00000705 fffff880`01144763 fffff8a0`73634946 fffff8a0`0df88b20 : nt!ExFreePoolWithTag+0x411
    fffff880`02f76830 fffff880`010fc58b : fffff8a0`0df88ac0 fffff8a0`0df88b20 ffffffff`00000003 fffff8a0`0df88b50 : fltmgr!FltAcquirePushLockExclusive+0x1423
    fffff880`02f76860 fffff880`010fd666 : fffff8a0`0df88ac0 00000000`00000000 ffffffff`ffffffff fffffa80`0a2e9470 : fltmgr!FltReferenceContext+0xab
    fffff880`02f76890 fffff880`0111922d : fffff8a0`0df88ad8 fffff880`010ef000 00000000`00000000 00000000`00000040 : fltmgr!FltAllocateContext+0x246
    fffff880`02f768c0 fffff880`01114bc1 : fffffa80`07b32010 00000000`00000130 fffff8a0`169c7aa0 fffff8a0`169c7aa0 : fltmgr!FltGetVolumeProperties+0x139d
    fffff880`02f768f0 fffff880`01114b7b : fffffa80`07b32010 fffff8a0`169c7d08 fffffa80`07b32010 fffff8a0`1496bb40 : fltmgr!FltFindExtraCreateParameter+0x4c1
    fffff880`02f76920 fffff800`0336f396 : 00000000`00000001 fffff880`012d21a7 fffff8a0`1496bb40 00000000`00000000 : fltmgr!FltFindExtraCreateParameter+0x47b
    fffff880`02f76950 fffff880`012d1bcc : fffff8a0`169c7aa0 fffffa80`06a31680 fffff880`02f76a28 00000000`00000706 : nt!FsRtlTeardownPerStreamContexts+0xe2
    fffff880`02f769a0 fffff880`012d18d5 : 00000000`01010000 00000000`00000000 fffff800`03226600 00000000`00000001 : Ntfs+0x95bcc
    fffff880`02f769e0 fffff880`01244cb4 : fffff8a0`169c79a0 fffff8a0`169c7aa0 fffff800`03226600 fffff880`02f76b52 : Ntfs+0x958d5
    fffff880`02f76a20 fffff880`012cf2dc : fffff8a0`169c7970 fffff800`03226600 fffff880`02f76b52 fffffa80`0988c2c0 : Ntfs+0x8cb4
    fffff880`02f76a50 fffff880`0124d882 : fffffa80`0988c2c0 fffffa80`0988c2c0 fffff8a0`169c7970 00000000`00000000 : Ntfs+0x932dc
    fffff880`02f76ad0 fffff880`012e6813 : fffffa80`0988c2c0 fffff800`03226600 fffff8a0`169c7970 00000000`00000009 : Ntfs+0x11882
    fffff880`02f76b10 fffff880`012c038f : fffffa80`0988c2c0 fffff8a0`169c7aa0 fffff8a0`169c7970 fffffa80`07a24180 : Ntfs+0xaa813
    fffff880`02f76be0 fffff800`0308d981 : 00000000`00000000 fffff880`012c0200 fffffa80`06a31601 00000000`00000002 : Ntfs+0x8438f
    fffff880`02f76cb0 fffff800`03324336 : 00000000`00000000 fffffa80`06a31680 00000000`00000080 fffffa80`06a0b040 : nt!KdPollBreakIn+0x2b1
    fffff880`02f76d40 fffff800`0305d106 : fffff880`02ea4180 fffffa80`06a31680 fffff880`02eaf040 00000000`00000000 : nt!PsCreateSystemThread+0x6da
    fffff880`02f76d80 00000000`00000000 : fffff880`02f77000 fffff880`02f71000 fffff880`02f769f0 00000000`00000000 : nt!KeTestAlertThread+0x94a


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    nt!ExFreePool+23f
    fffff800`031b60bf 4c395008        cmp     qword ptr [rax+8],r10

    SYMBOL_STACK_INDEX:  3

    SYMBOL_NAME:  nt!ExFreePool+23f

    FOLLOWUP_NAME:  MachineOwner

    IMAGE_NAME:  Pool_Corruption

    MODULE_NAME: Pool_Corruption

    BUCKET_ID:  WRONG_SYMBOLS

    Followup: MachineOwner
    ---------

    Thursday, January 27, 2011 12:54 AM

Answers

  • MEMORY_MANAGEMENT (1a)
        # Any other values for parameter 1 must be individually examined.
    Arguments:
    Arg1: 0000000000041790, The subtype of the bugcheck.

    STACK_TEXT: 
    nt!KeBugCheckEx
    nt! ?? ::FNODOBFM::`string'+0x339d6
    nt!NtFreeVirtualMemory +0x5ca
    nt!KiSystemServiceCopyEnd+0x13

    STACK_TEXT: 
    nt!KeBugCheckEx
    nt! ?? ::FNODOBFM::`string'+0x3690c
    nt!MmAccessFault +0x343
    nt!KiPageFault+0x16e

        The 41790 code is part of our an internal memory manager code but the bugcheck in my experience has almost always indicated hardware issues (RAM errors).

        Source:
        http://social.technet.microsoft.com/Forums/en-US/w7itproperf/thread/68407ce1-7491-4aee-bdef-5ff4bbc56d99/#11ce9f45-7906-4652-9619-a3ad457a87e9

    SYSTEM_SERVICE_EXCEPTION (3b)
    An exception happened while executing a system service routine.
    Arguments:
    Arg1: 00000000c0000005,

    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Access violation

    STACK_TEXT: 
    nt!ExAllocatePoolWithTag +0x53d

    Yes, it maybe a RAM issue. Please download memtest86+ [1], burn a new bootable CD (use a CD-RW if possible) from the ISO (download and use ImgBurn [2][3] to do this or make double click on the ISO in Windows 7), reboot your PC and scan your RAM 4-5hours for errors. If it detects errors, replace the faulty RAM.

    If the memtest tells no error, please download CPU-Z [4], look in the memory and SPD tab and verify that the current RAM Speed and the Timings match to the values that you see in the SPD tab. If your RAM run at CR (Command Rate) 1T, change the value into 2T in the BIOS.

    But you still get a NTFS related crash:

    NTFS_FILE_SYSTEM (24) - This indicates a problem occurred in ntfs.sys , the driver file that allows the system to read and write to NTFS drives.

    STACK_TEXT: 
    Ntfs!NtfsTeardownFromLcb+0xf1

    have you run chkdsk? Did it detect any issues?

    Also install all Updates , you still use the RTM ( 7600.16385.amd64fre.win7_rtm.090713-1255)!

    André

    [1] http://www.memtest.org/download/4.20/memtest86+-4.20.iso.zip
    [2] http://www.imgburn.com/index.php?act=download
    [3] http://forum.imgburn.com/index.php?showtopic=61
    [4] http://www.cpuid.com/softwares/cpu-z.html


    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    • Marked as answer by Leo Huang Tuesday, February 1, 2011 8:22 AM
    Sunday, January 30, 2011 12:36 PM

All replies

  • No, I think you have corrupt NTFS filesystem.

    Please start the command prompt (cmd.exe) with admin rights [1] and run sfc [2]:

    chkdsk C: /r /f

    If this doesn't fix it, please start the Windows Explorer and go to the folder C:\Windows\Minidump. Next, copy the dmp files to your desktop, zip all dmp into 1 zip file and upload the zip file to your public Skydrive [2] folder and post a link here. I take a look at the dumps.

    best regards
    André

    [1] http://windows.microsoft.com/en-US/windows7/How-do-I-run-an-application-once-with-a-full-administrator-access-token
    [2] http://social.technet.microsoft.com/Forums/en-US/w7itproui/thread/4fc10639-02db-4665-993a-08d865088d65


    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Thursday, January 27, 2011 1:56 PM
  • I did everything you said, I think it may have only crashed once since then.  Here is a link to my Public Skydrive.  I think I am doing this correctly, not very familiar with the skydrive, but it seems pretty straight fwd.  Thank you so much for you help.

     

    http://cid-4c76f95e5650cf5f.office.live.com/browse.aspx/Public?uc=1

     

    Zach

    Sunday, January 30, 2011 2:29 AM
  • If you suspect is due to bad ram, run memtest or windows memory diagnostic to retify the problem is not due to bad ram
    Sunday, January 30, 2011 8:19 AM
    Answerer
  • MEMORY_MANAGEMENT (1a)
        # Any other values for parameter 1 must be individually examined.
    Arguments:
    Arg1: 0000000000041790, The subtype of the bugcheck.

    STACK_TEXT: 
    nt!KeBugCheckEx
    nt! ?? ::FNODOBFM::`string'+0x339d6
    nt!NtFreeVirtualMemory +0x5ca
    nt!KiSystemServiceCopyEnd+0x13

    STACK_TEXT: 
    nt!KeBugCheckEx
    nt! ?? ::FNODOBFM::`string'+0x3690c
    nt!MmAccessFault +0x343
    nt!KiPageFault+0x16e

        The 41790 code is part of our an internal memory manager code but the bugcheck in my experience has almost always indicated hardware issues (RAM errors).

        Source:
        http://social.technet.microsoft.com/Forums/en-US/w7itproperf/thread/68407ce1-7491-4aee-bdef-5ff4bbc56d99/#11ce9f45-7906-4652-9619-a3ad457a87e9

    SYSTEM_SERVICE_EXCEPTION (3b)
    An exception happened while executing a system service routine.
    Arguments:
    Arg1: 00000000c0000005,

    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Access violation

    STACK_TEXT: 
    nt!ExAllocatePoolWithTag +0x53d

    Yes, it maybe a RAM issue. Please download memtest86+ [1], burn a new bootable CD (use a CD-RW if possible) from the ISO (download and use ImgBurn [2][3] to do this or make double click on the ISO in Windows 7), reboot your PC and scan your RAM 4-5hours for errors. If it detects errors, replace the faulty RAM.

    If the memtest tells no error, please download CPU-Z [4], look in the memory and SPD tab and verify that the current RAM Speed and the Timings match to the values that you see in the SPD tab. If your RAM run at CR (Command Rate) 1T, change the value into 2T in the BIOS.

    But you still get a NTFS related crash:

    NTFS_FILE_SYSTEM (24) - This indicates a problem occurred in ntfs.sys , the driver file that allows the system to read and write to NTFS drives.

    STACK_TEXT: 
    Ntfs!NtfsTeardownFromLcb+0xf1

    have you run chkdsk? Did it detect any issues?

    Also install all Updates , you still use the RTM ( 7600.16385.amd64fre.win7_rtm.090713-1255)!

    André

    [1] http://www.memtest.org/download/4.20/memtest86+-4.20.iso.zip
    [2] http://www.imgburn.com/index.php?act=download
    [3] http://forum.imgburn.com/index.php?showtopic=61
    [4] http://www.cpuid.com/softwares/cpu-z.html


    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    • Marked as answer by Leo Huang Tuesday, February 1, 2011 8:22 AM
    Sunday, January 30, 2011 12:36 PM