Random BSODs, not RAM...

[pbingu]

OK, here goes - a while back I finally upgraded my pc (mobo, processor, RAM, gfx), but I kept the hard drive and windows installation from before. A little while after that, I started getting a few BSODs with varying error messages. Now, a few months later, they're happening more and more frequently, to the tune of several per evening when I use it. They seem to be more common with HDD intensive activities, such as when bittorrent is downloading.

After doing the regular tests, I figured it might be the windows install not coping too well with the change of chipset, but then during and on a new windows install on a clean hard drive it blue-screened again, so that apparently was not the problem. Also repaired this windows install several times, no joy.

I've done RAM testing, including memtest86 and the microsoft one as well, both passing fine. Also tried separate RAM sticks in different slots to rule them out, even buying a new stick (now running 3GB!) to try with that...still BSODing a lot. Short of buying a new motherboard to try, I'm pretty much at my wit's end, so here I am with bells on. And minidumps...

Main BSODs are: PAGE_FAULT_IN_UNPAGED_AREA (0x50), IRQL_NOT_LESS_THAN_EQUAL (0xA), and win32k.sys (0x8E and 0xC0000005).

I'm pretty good at most IT stuff, and have fixed pcs before, but don't know much about dump reading or interpretation. Anyone got any ideas?

System spec:
Athlon 64 X2 4200+
ASUS M2N4-SLI rev.A3 (latest BIOS rev.1203)
3 sticks of 1GB Kingston DDR2 5300 ValueRAM
MSI NX8600GT
HIPER 450W PSU (might be more wattage, can't remember)

 

[cpc2004]

Mini012708-01.dmp BugCheck 10000050, {e9e0359c, 0, bf8044e2, 2}
89a62a00 Image: firefox.exe
Probably caused by : win32k.sys ( win32k!DEVLOCKOBJ::vDestructor+1b )

Mini012708-02.dmp BugCheck 10000050, {e5f51000, 0, 8063df82, 1}
Owning Process 89e09a28 Image: EasyClea.exe
Probably caused by : sptd.sys ( sptd+7392 ) <-- daemon tools

Mini012708-03.dmp BugCheck 10000050, {e9e0a59c, 0, bf8044e2, 2}
Owning Process 8ae34990 Image: firefox.exe
Probably caused by : win32k.sys ( win32k!DEVLOCKOBJ::vDestructor+1b )

Mini012708-04.dmp BugCheck 10000050, {8f19091c, 0, 805357e2, 0}
Owning Process 86c45b50 Image: RMSvc.exe
Probably caused by : ntkrpamp.exe ( nt!ExQueryPoolUsage+82 )

Your windows has daemon tools and ZA. They are unstable software. If you believe that it is software error. You had better de-install daemon tools and ZA.

BTW some faulty ram can pass memtest. The 1st and 3rd minidump are crashed at GDI routone (ie win32.sys) and your version of mVidia Display Card is unstabale. Upgrade nVidia Display Card Driver to latest version.

 

[pbingu]

OK thanks cpc2004, I'll try uninstalling those programs and finding a new, certified stable nVidia driver, and see how things go. Still don't know why harddisk intensive activity would increase the rate of faults though with them...

Any idea if it's more likely that my BSODs could be caused by all 3 sticks of RAM being faulty? Or whether its the motherboard or video card themselves causing problems?

Lots of questions, I know, but have been trying to fix this for ages now. I've also attached the latest few dumps from today - lots of new 'probable causes' it looks like!

 

[Route44]

You have errors of 0x50 and 0x7F which have listed as potential faulty memory VRAM can also be faulty), especially the 0x7F. It can be that you do have failing hardware or incompatible software as well. As cpc2004 rightly points out Daemon tools can cause some real headaches. Many people have come here with issues pertaining to this software and it seems to often conflict with security software.

Your last dump was 0xA and it specifiaclly listed memory corruption, but this error mostly points to a faulty driver as the main culprit which is usually the case with this error.

Two questions:

1. How long did you run MemTest?

2. Did you run it on each stick individually?

* Have you run a harddrive diagnostics?

* What is your volt setting on your RAM?

 

[pbingu]

Hmm interesting, perhaps I'll try a different video card if I can find one lying around that actually works...

Anyway, to answer:
1. MemTest was run overnight a few times, last one finished over 30 completions all passing.
2. I don't think I've run it on each stick individually though, can try that.

I've tested the HDD with a few different utilities, no problems usually - though sometimes after a crash chkdsk will find and fix errors. Also in some utilities a partition table error is shown for my windows drive, or a NTFS/HPFS unknown problem, but as others work fine I figured it was basic incompatibility...

At the moment RAM voltage is set to auto, but this evening I've tried it one 1.8, 1.85 and 1.95 (max allowed in BIOS), still crashes. Got a new BSOD this evening too, KERNEL_STACK_INPAGE_ERROR 0x77... more dumps attached!

 

[Route44]

Here is what aumha.org says about an 0x77 error which is in your first dump:

0x00000077: KERNEL_STACK_INPAGE_ERROR

A page of kernel data requested from the pagefile could not be found or read into memory. This message also can indicate disk hardware failure, disk data corruption, or possible virus infection.


The first thing this memory dump cited as the problem was memory corruption.

However, further reading in this minidump particularly stated: There was error with disk hardware.

I read further and then it noted: MakeOut Swapped Page Resident. When I googled this it would take me to virtual memory. It will take some reading and research on this one.

I am wondering if a) you have a virtual memory issue or b) you are infected with an embedded trojan/virus.

 

[pbingu]

Ugh this is getting tricky - was getting excited that it might be as simple as the video card (though I may well have tried that in the past, I certainly hope I did). I'm guessing these latest few crashes are pointing away from that though.

I'm now trying moving virtual memory to another HDD, and am installing AVG 7.5 to replace the ZA Security Suite I uninstalled as advised. Already did a run of the AVG rootkit cleaner, it found & removed one (this was a few days ago though).

Also had another new BSOD message this morning... the even less reassuring-sounding "c0000021a - Unknown Hard Error". S**t. Last 2 logs attached...

Really getting confused as to what all these problems combined point towards though!

 

[Route44]

Here is some information on your 0x21a error from this morning that I think is more telling than the minidumps you supplied. From aumha.org:

0xC000021A: STATUS_SYSTEM_PROCESS_TERMINATED

This occurs when Windows switches into kernel mode and a user-mode subsystem, such as Winlogon or the Client Server Runtime Subsystem (CSRSS), is compromised. Security can no longer be guaranteed. Because Win XP can’t run without Winlogon or CSRSS, this is one of the few situations where the failure of a user-mode service can cause the system to stop responding. This Stop message also can occur as a result of malware infestation or when the computer is restarted after a system administrator has modified permissions so that the SYSTEM account no longer has adequate permissions to access system files and folders.

I highlited the infestation part because I was wondering in my previous post if you had a trojan which AVG just discovered.

I would run chkdsk, another HD diagnostics (I had such a horrible trojan one time that even with a hard format I still had a corrupted disk that I had to use for storage), but first I would sweep again with an antiivirus by using both Kaspersky's and Trend-Micro's online scanners.

Since you were infected it is important to take these steps to make sure of the integrity of your harddrive.

 

[pbingu]

Hmm yeah looks like you might be right - even though the ZA anti-virus I had before never picked anything up AVG has now found a couple of Trojans (SHEUR.APFN and Dialer.RLB), still scanning for more.

Interestingly, I couldn't install AVG before - I was saying it didn't have permission to create its registry entry. I googled that & fixed it with subinacl, and haven't actually crashed since then... Hopefully on to a winner here!

Thanks for the help, very glad I joined up to the forum now hehe. Will post back with an all clear/new dumps depending on how things go (after full AV scans & then HDD diags).

As an aside, which is the recommended best AVG/AS/Firewall suite out there? ZA was obviously not up to task, but I've also heard of people having problems with Kaspersky & others. I'm already behind a router & HW firewall, but other PCs are on it as well and god knows what they download. Also I liked the ZA alert service when apps were trying to do certain actions, helped keep a tight rein on what went on.

 

[Route44]

Believe it or not, the best rated firewalls out there at the moment are free: Comodo 3.0 and Online Armor's free edition (OA isn't quite working with Vista but it will very soon). Seriously, they are getting tremendous reviews.

Both have a very dedidicated community and they are always being improved. I believe Comodo needs to be tweaked more but you seem to have a good knowledge base of PC tech.

As soon as the Sunbelt Firewall subscription runs out this March on my son's older Pentium 3, I am downloading the free OA.

By the way, you wrote:

Interestingly, I couldn't install AVG before - I was saying it didn't have permission to create its registry entry.

That really caught my attention because that information from aumha.org stated:

This Stop message also can occur as a result of malware infestation or when the computer is restarted after a system administrator has modified permissions so that the SYSTEM account no longer has adequate permissions to access system files and folders.

I am wondering if that trojan affected your administration rights as well. My time of worst infestation was marked by the fact that it blocked any attempts on my part to scan for viruses, torjans, etc. from online scanners.

 

[pbingu]

Hehe yeah I was pretty surprised as well how it tied in, didn't even know the registry HAD permissions before! Just checked AVG and its found a few more apparent viruses & trojans...very strange that nothing picked these up before (ZA, had also done online free scan from trend or avg).

Sadly I've got about a terrabyte and a half installed and a lot of archived (and archaic) data, so any scan takes between 3-6 years to complete, but on the bright side no BSOD for quite a few hours now!

Will try the free firewalls, thanks again for the help & now the recommendation as well. As for my knowledge base...this is how I learn - wouldn't even know how to open the case if my pcs hadn't been breaking since the Dawn Of Time. Better I learn how to fix things than send it off to someone else who can charge me again and again. Now I just need to convince everyone I know likewise, so they stop getting me to fix their stuff...

 

[Route44]

but on the bright side no BSOD for quite a few hours now!

Excellent! Here's keeping the fingers crossed. It just goes to show that minidumps are very, very helpful but sometimes it takes many before you get to the root of the problem, even when it seems the information is pointing one way only to go somewhere else.

As for not picking up; even the very best security software is not perfect. The very best online defense, as I have read many, many times is the nature of one's web browsing.

With all that information I would definitely 1) Burn and archive and 2) Invest in a good eternal harddrive like Seagate or Western Digital. You can find great deals on their 500 to 750 GB models.

 

[pbingu]

Just when you thought it was safe to go back in the water... BSODs again. Trouble is I can't be sure that anti-virus are actually finishing their scans before the crash, they take so long!

Last 2 dumps attached - I got the debugging tools to read them, and though it doesn't mean a whole lot to me a recurring problem seems to be with ntoskrnl.exe. Unfortunately I've got sod-all idea (even after extensive googling) what that means regarding fixing the problem...

As for backing up data, I've got enough space around that I could (even considered partition magicking the windows install onto my 2nd HDD to see if that helped) - the problem isn't with data though its settings, installs etc. Would take me years to get everything set up how it is now, not to mention all the things I wouldn't even remember to set up heheh!

 

[Route44]

First Minidump - 0xC5 error. From auhma.org:

0x000000C5: DRIVER_CORRUPTED_EXPOOL
An attempt occurred to touch invalid memory at a process IRQL that is too high. This is almost always caused by drivers that have corrupted the system pool. If you’ve recently installed any new software, check to see if it’s properly installed; and check for updated drivers on the manufacturer’s web site.


Second Minidump - 0x24 error. Also from auhma.org:

0x00000024: NTFS_FILE_SYSTEM

A problem occurred within NTFS.SYS, the driver file that allows the system to read and write to NTFS file system drives. There may be a physical problem with the disk, or an Interrupt Request Packet (IRP) may be corrupted. Other common causes include heavy hard drive fragmentation, heavy file I/O, problems with some types of drive-mirroring software, or some antivirus software. I suggest running ChkDsk or ScanDisk as a first step; then disable all file system filters such as virus scanners, firewall software, or backup utilities. Check the file properties of NTFS.SYS to ensure it matches the current OS or SP version. Update all disk, tape backup, CD-ROM, or removable device drivers to the most current versions.


Hope this helps. You have an awful lot of information. I think those external harddrives are looking better and better.