Random BSODS

[jjgrosso]

I have a system running Win 7 getting random BSODS out of the blue. Was working fine up until a few weeks ago. I have ran Memtest 86+ and updated the video card. It will boot fine and run for a bit, then bam...down it goes with a BSOD. Not sure what is causing this as I am no pro at reading minidump files at all. See info from minidumps below. Any help would be great appreciated.

Microsoft ® Windows Debugger Version 6.11.0001.404 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\031312-24460-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image \SystemRoot\system32\ntkrnlpa.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17713.x86fre.win7sp1_gdr.111025-1505
Machine Name:
Kernel base = 0x82a06000 PsLoadedModuleList = 0x82b4f4d0
Debug session time: Tue Mar 13 13:09:44.353 2012 (GMT-7)
System Uptime: 0 days 0:23:01.132
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image \SystemRoot\system32\ntkrnlpa.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
......
0: kd> !analyze -y

Unknown option '-y'
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41284, 26b8001, 795a, c0802000}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Probably caused by : ntkrnlpa.exe ( nt+deef4 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 00041284, A PTE or the working set list is corrupt.
Arg2: 026b8001
Arg3: 0000795a
Arg4: c0802000

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************

ADDITIONAL_DEBUG_TEXT:
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

MODULE_NAME: nt

FAULTING_MODULE: 82a06000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4ea76eb4

BUGCHECK_STR: 0x1a_41284

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 82a6dba8 to 82ae4ef4

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
9e253b34 82a6dba8 0000001a 00041284 026b8001 nt+0xdeef4
9e253b5c 82a6ddfe c0c0aae0 c00135c0 84a89048 nt+0x67ba8
9e253b7c 82aa5b24 026b8000 87745220 0000795a nt+0x67dfe
9e253c84 82ac0acb 02530000 026d8fff ae3963a3 nt+0x9fb24
9e253d1c 82a4421a ffffffff 0227eed4 0227eed0 nt+0xbaacb
9e253d34 77717094 badb0d00 0227edec 00000000 nt+0x3e21a
9e253d38 badb0d00 0227edec 00000000 00000000 0x77717094
9e253d3c 0227edec 00000000 00000000 00000000 0xbadb0d00
9e253d40 00000000 00000000 00000000 00000000 0x227edec


STACK_COMMAND: kb

FOLLOWUP_IP:
nt+deef4
82ae4ef4 cc int 3

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt+deef4

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: ntkrnlpa.exe

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------


_______________________________

Second Minidump


Microsoft ® Windows Debugger Version 6.11.0001.404 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\022512-23571-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image \SystemRoot\system32\ntkrnlpa.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17713.x86fre.win7sp1_gdr.111025-1505
Machine Name:
Kernel base = 0x82a09000 PsLoadedModuleList = 0x82b524d0
Debug session time: Sat Feb 25 09:29:24.002 2012 (GMT-7)
System Uptime: 0 days 1:21:58.781
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image \SystemRoot\system32\ntkrnlpa.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {3fffe8, 2, 1, 82abc8ac}

*** WARNING: Unable to verify timestamp for Ntfs.sys
*** ERROR: Module load completed but symbols could not be loaded for Ntfs.sys
*** WARNING: Unable to verify timestamp for fltmgr.sys
*** ERROR: Module load completed but symbols could not be loaded for fltmgr.sys
***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Probably caused by : ntkrnlpa.exe ( nt+b38ac )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 003fffe8, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 82abc8ac, address which referenced memory

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************

ADDITIONAL_DEBUG_TEXT:
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

MODULE_NAME: nt

FAULTING_MODULE: 82a09000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4ea76eb4

WRITE_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
003fffe8

CURRENT_IRQL: 0

FAULTING_IP:
nt+b38ac
82abc8ac 8906 mov dword ptr [esi],eax

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 82abc8ac to 82a4a5fb

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
8dc1388c 82abc8ac badb0d00 000004c0 b15231a8 nt+0x415fb
8dc13928 82aaf292 04736db6 857e0350 ffffffff nt+0xb38ac
8dc139c8 82c89ef4 85c6fe18 00000001 b0eb8000 nt+0xa6292
8dc139f4 82abe6d5 00a38000 00000000 00004000 nt+0x280ef4
8dc13a34 82c71c13 85c6e4c0 00000001 8dc13aac nt+0xb56d5
8dc13a70 82c6d147 85c6e4c0 00a38000 00000000 nt+0x268c13
8dc13ab0 8bc9e09a 85c6e4c0 85c98ac4 00004000 nt+0x264147
8dc13bd0 8bbb6fec 85c6e4c0 abe409f0 00004000 Ntfs+0x8509a
8dc13c04 8bbb71bb 00000003 00000000 85c98abc fltmgr+0x4fec
8dc13c30 8bbc9c37 00c13c54 8bbc9ad4 00000000 fltmgr+0x51bb
8dc13c74 82c6c024 85c6e4c0 8dc13cb4 00004000 fltmgr+0x17c37
8dc13d08 82a4721a 8627b630 00000000 00000000 nt+0x263024
8dc13d34 777d7094 badb0d00 00d3de30 00000000 nt+0x3e21a
8dc13d38 badb0d00 00d3de30 00000000 00000000 0x777d7094
8dc13d3c 00d3de30 00000000 00000000 00000000 0xbadb0d00
8dc13d40 00000000 00000000 00000000 00000000 0xd3de30


STACK_COMMAND: kb

FOLLOWUP_IP:
nt+b38ac
82abc8ac 8906 mov dword ptr [esi],eax

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt+b38ac

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: ntkrnlpa.exe

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------

 

[alishathomaz]

The most important Blue Screen of Death troubleshooting step you can take is to ask yourself what you just did.

1) Did you just install a new program or a piece of hardware, update a driver, install an update, etc.? If so, there's a very good chance that the change you made caused the BSOD:
Startup using Last Known Good Configuration to undo recent registry and driver changes.
Use System Restore to undo recent system changes.
Roll Back device driver to version prior to your driver update.

2) Scan your computer for viruses. Some viruses can cause a Blue Screen of Death, especially ones that infect the master boot record (MBR) or boot sector.

3) Update drivers for your hardware. Most Blue Screens of Death are hardware or driver related so updated drivers could fix the cause of the STOP error.

4) Return hardware settings to default in Device Manager. Unless you have a specific reason to do so, the system resources that an individual piece of hardware is configured to use in Device Manager should be set to default. Non-default hardware settings have been known to cause a Blue Screen of Death.

5) Return BIOS settings to their default levels. An overclocked or misconfigured BIOS can cause all sorts of random issues, including BSODs.

Hope these guidelines fix BSOD.

 

[gamerk316]

BugCheck 1A

Bug Check 0x1A: MEMORY_MANAGEMENT

This indicates that a severe memory management error occurred.

Run memtest86/Prime95 on each stick of RAM until you find which stick is bad.

 

[price_th]

Wouldn't hurt to run a check on your HDD too.

 

[jjgrosso]

Thanks for the info/advice. I'm pulling the memory modules today and having a buddy who has an actual memory tester device run tests on each. Nothing was done/changed to the tower prior to the BSODS so I not sure what is going on. I'll run some diags on the HD. As previously stated I know video cards are common causes of BSODS when the drivers craps out so I already updated that with the latest from nVidia...still BSODing. Anyone have any ideas based on the minidumps?