Software Hardware or Software : Win7 BSOD (x0...01A)

N_Molson

Addon Developer
Addon Developer
Donator
Joined
Mar 5, 2010
Messages
9,271
Reaction score
3,244
Points
203
Location
Toulouse
Hello,

Once again at this period of the year I'm running into computer problems :)compbash2:).

This time, it is a BSOD that triggers from time to time, not at every session of Windows (7), but often enough to be a pain.

I run the 64 bits version of Win7 on a AMD Athlon II X2 245 (64+), so things are rather straightforward there, should be perfectly compatible.

I've searched around the Web and found that my error code (x0...01A) means that a "severe memory error occured". Riiight.

That doesn't seem related to a particular program. Sometimes the BSOD occured right on Windows boot (after the BIOS & "pseudo-MS-DOS" checks).

By "memory" I guess they mean RAM. I have 4GB installed in a "2*2" configuration. DDR3 if I remember well, for what that matters.

I tried to help myself and installed the Windows Debug Tools. Hoping to get an insight on what is going wrong, I tried to open the Crash Dump File and here is what I got :

Code:
Microsoft (R) Windows Debugger Version 6.2.9200.20512 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\081713-16114-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path.           *
* Use .symfix to have the debugger choose a symbol path.                   *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is: 
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.18205.amd64fre.win7sp1_gdr.130708-1532
Machine Name:
Kernel base = 0xfffff800`02e4f000 PsLoadedModuleList = 0xfffff800`030926d0
Debug session time: Sat Aug 17 20:38:55.426 2013 (UTC + 2:00)
System Uptime: 0 days 0:08:06.799
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa8000009510, ffff, 0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
Probably caused by : ntoskrnl.exe ( nt+75b80 )

Followup: MachineOwner
---------
It seems that something is wrong on the debugger itself. :beathead:

So I'm taking advices on :

- 1) what can be wrong on the computer :)crystalball:)

Needless to say, the memory checkup at startup is running perfectly, every byte is present and accounted for. I've read several forums and saw that basic reactions to similar problems were "it must be your RAM chips, try to switch them etc...", but I feel very confident that the problem isn't there. If there was an hardware fault, IMHE (Experience), it would rather come from the Motherboard.

On the software side there is nothing obvious I installed and that could cause that mess.

- 2) how to get that buggy debugger working correctly !

Thank you, any help getting out of that blues would be very much appreciated. :tiphat:
 

Artlav

Aperiodic traveller
Addon Developer
Beta Tester
Joined
Jan 7, 2008
Messages
5,789
Reaction score
778
Points
203
Location
Earth
Website
orbides.org
Preferred Pronouns
she/her
Concerning the debugger, try if this help: http://blogs.technet.com/b/askcore/...l-mode-blue-screen-crashes-for-beginners.aspx

Concerning the crash itself - 1A 41790 means:
A page table page has been corrupted. On a 64 bit version of Windows, parameter 2 contains the address of the PFN for the corrupted page table page. On a 32 bit version of Windows, parameter 2 contains a pointer to the number of used PTEs, and parameter 3 contains the number of used PTEs.

If i had to guess, i'd say some driver have bugs in it, since memory error in a page table is awfully specific for a random RAM failure.
Assuming you always get 41790 there.

If the problem have a definite date-of-start, then try to remember what have changed in hardware or drivers since then - something like a graphics card driver update might be the culprit.
 

dbeachy1

O-F Administrator
Administrator
Orbiter Contributor
Addon Developer
Donator
Beta Tester
Joined
Jan 14, 2008
Messages
9,214
Reaction score
1,560
Points
203
Location
VA
Website
alteaaerospace.com
Preferred Pronouns
he/him
Needless to say, the memory checkup at startup is running perfectly, every byte is present and accounted for. I've read several forums and saw that basic reactions to similar problems were "it must be your RAM chips, try to switch them etc...", but I feel very confident that the problem isn't there. If there was an hardware fault, IMHE (Experience), it would rather come from the Motherboard.

Bugcheck 1A is "MEMORY MANAGEMENT", so it sounds like a faulty RAM stick. The memory test at system boot is extremely simple and usually doesn't detect a problem with a marginal RAM stick.

The first thing I would do is run a real memory test like Memtest86+ overnight and see if it detects any problems. If it fails, repeat the test with only one stick installed to try narrow down the defective stick. If the memory test passes with all the sticks installed it still does not rule out a failing RAM stick: I've had several systems over the years that had BSODs due to bad RAM that passed memory tests -- they only failed in Windows.

If Memtest86+ doesn't detect any memory failures I would swap all of the RAM sticks with another set as a test. If the BSOD still occurs then it sounds like a failing CPU or motherboard or a buggy driver.

For more information on Bugcheck 1A, take a look here: http://answers.microsoft.com/en-us/windows/forum/windows_7-system/bsod-with-error-bugcheck-1a-once-a-day-please-help/99ded9c3-2722-47ba-9637-0335b75c4d81 It could either be bad RAM or a buggy driver, so I would test the RAM first.
 

RacerX

Donator
Donator
Joined
Jan 3, 2012
Messages
303
Reaction score
9
Points
18
Location
in a field
Overheating of Ram could also be a cause. Dust acts like an insulator raising temerature and causing random memory errors. Take stick(s) out of their slots and re-seat them. Then as Dbeachy said run a memtest.
 

Quick_Nick

Passed the Turing Test
Donator
Joined
Oct 20, 2007
Messages
4,088
Reaction score
204
Points
103
Location
Tucson, AZ
Pop out the RAM and stick 'em back in. Sometimes they're just BARELY loose.
 

Linguofreak

Well-known member
Joined
May 10, 2008
Messages
5,017
Reaction score
1,253
Points
188
Location
Dallas, TX
Bugcheck 1A is "MEMORY MANAGEMENT", so it sounds like a faulty RAM stick. The memory test at system boot is extremely simple and usually doesn't detect a problem with a marginal RAM stick.

All that means is that the data the OS uses to keep track of what memory is assigned to what programs, or what parts of the OS, is corrupted. It doesn't tell us anything about what corrupted it. Going on what we've seen, it could just as easily be a buggy driver as a bad RAM stick that's causing the corruption. And, as Artlav said, if it's consistently one error, it's probably *not* bad RAM, which would cause different errors depending on what's stored at the bad location when the corruption happens.
 

orb

O-F Administrator,
News Reporter
Joined
Oct 30, 2009
Messages
14,020
Reaction score
4
Points
0
Going on what we've seen, it could just as easily be a buggy driver as a bad RAM stick that's causing the corruption.
That's why the second paragraph in that post links to Memtest86+, and 3rd paragraph says it can be a device driver if the test was passed successfully.
 

N_Molson

Addon Developer
Addon Developer
Donator
Joined
Mar 5, 2010
Messages
9,271
Reaction score
3,244
Points
203
Location
Toulouse
If the problem have a definite date-of-start, then try to remember what have changed in hardware or drivers since then - something like a graphics card driver update might be the culprit.

That could definitively be it, I updated graphic drivers and got some useless NVIDIA stuff installed. The date is roughly corresponding. Now I'm not sure what I'm supposed to do : de-install the graphic drivers and anything related and revert to an older version (if available ?).
Assuming you always get 41790 there.

Yes, always that one.
Pop out the RAM and stick 'em back in. Sometimes they're just BARELY loose.

They are perfectly and strongly inserted in their sockets and can't move at all.

Overheating of Ram could also be a cause. Dust acts like an insulator raising temerature and causing random memory errors. Take stick(s) out of their slots and re-seat them.

I have enough fans installed and regularly sweep the dust with a cold-air-blowing hairdryer. My recent investment in a portable climatizer unit also rules it out.
 

Artlav

Aperiodic traveller
Addon Developer
Beta Tester
Joined
Jan 7, 2008
Messages
5,789
Reaction score
778
Points
203
Location
Earth
Website
orbides.org
Preferred Pronouns
she/her
Yes, always that one.
That is a strong evidence of a software problem.

That could definitively be it, I updated graphic drivers and got some useless NVIDIA stuff installed. The date is roughly corresponding. Now I'm not sure what I'm supposed to do : de-install the graphic drivers and anything related and revert to an older version (if available ?).
Only thing that can corrupt kernel-level memory are drivers, user-level bloatware is unlikely to be the problem.

You should try rolling back the driver, and see if the problem goes away.
It's a good idea to try in any case - that would isolate the culprit.

Alternatively, look for a more recent version of the driver, or look for fixes in NVidia bug reports.
 

RacerX

Donator
Donator
Joined
Jan 3, 2012
Messages
303
Reaction score
9
Points
18
Location
in a field
I seem to remember a tool that removes all Nvidia drivers and traces from a computer that I used to fix a friends computer after he updated to wrong driver. The nvidia drivers although appeared to be uninstalled they were not. I ran the tool rebooted and then re-installed everything from scratch and that fixed it. But ALL traces have to be removed including registry. A simple uninstall will not do it. If you have a nvidia based chipset on your motherboard though I would not recommend this procedure.
 

N_Molson

Addon Developer
Addon Developer
Donator
Joined
Mar 5, 2010
Messages
9,271
Reaction score
3,244
Points
203
Location
Toulouse
But ALL traces have to be removed including registry

Yeah, that's definitively the pain. I'll go hand-to-hand with the registry if needed... :coffee:

---------- Post added at 06:19 AM ---------- Previous post was at 06:08 AM ----------

Got the debugger working. Definitively points to a driver error, but I was hoping it would give some more clues instead of pointing a core Windows DLL :

Code:
Microsoft (R) Windows Debugger Version 6.2.9200.20512 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\081713-16114-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*
Executable search path is: srv*
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.18205.amd64fre.win7sp1_gdr.130708-1532
Machine Name:
Kernel base = 0xfffff800`02e4f000 PsLoadedModuleList = 0xfffff800`030926d0
Debug session time: Sat Aug 17 20:38:55.426 2013 (UTC + 2:00)
System Uptime: 0 days 0:08:06.799
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa8000009510, ffff, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+35084 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, A page table page has been corrupted. On a 64 bit OS, parameter 2
	contains the address of the PFN for the corrupted page table page.
	On a 32 bit OS, parameter 2 contains a pointer to the number of used
	PTEs, and parameter 3 contains the number of used PTEs.
Arg2: fffffa8000009510
Arg3: 000000000000ffff
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41790

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  taskhost.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002f35d40 to fffff80002ec4b80

STACK_TEXT:  
fffff880`09b81958 fffff800`02f35d40 : 00000000`0000001a 00000000`00041790 fffffa80`00009510 00000000`0000ffff : nt!KeBugCheckEx
fffff880`09b81960 fffff800`02eb13cf : fffffa80`00000000 00000000`2601ffff 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x35084
fffff880`09b81b20 fffff800`02ec3e13 : ffffffff`ffffffff 00000000`02c4f798 00000000`02c4f790 00000000`00008000 : nt!NtFreeVirtualMemory+0x61f
fffff880`09b81c20 00000000`76ee149a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`02c4f758 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76ee149a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+35084
fffff800`02f35d40 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+35084

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  51db806a

FAILURE_BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+35084

BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+35084

Followup: MachineOwner
---------

1: kd> lmvm nt
start             end                 module name
fffff800`02e4f000 fffff800`03435000   nt         (pdb symbols)          F:\Program Files (x86)\Windows Kits\8.0\Debuggers\x86\sym\ntkrnlmp.pdb\DC9628D1EDEC4D779EA56D2438A16F4E2\ntkrnlmp.pdb
    Loaded symbol image file: ntkrnlmp.exe
    Mapped memory image file: F:\Program Files (x86)\Windows Kits\8.0\Debuggers\x86\sym\ntoskrnl.exe\51DB806A5e6000\ntoskrnl.exe
    Image path: ntkrnlmp.exe
    Image name: ntkrnlmp.exe
    Timestamp:        Tue Jul 09 05:15:54 2013 (51DB806A)
    CheckSum:         00556FD9
    ImageSize:        005E6000
    File version:     6.1.7601.18205
    Product version:  6.1.7601.18205
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        1.0 App
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     ntkrnlmp.exe
    OriginalFilename: ntkrnlmp.exe
    ProductVersion:   6.1.7601.18205
    FileVersion:      6.1.7601.18205 (win7sp1_gdr.130708-1532)
    FileDescription:  NT Kernel & System
    LegalCopyright:   © Microsoft Corporation. All rights reserved.

Could I have a corrupted driver or something like that ? I had a virus detection in early July, fixed it but it could have corrupted something... :hmm:

Arg2: fffffa8000009510
Arg3: 000000000000ffff

I don't know what those parameters exactly point to, but all those "ffff" are up to no good there, for sure ! Usually it is the kind of values I get when I forget to declare a variable in an Orbiter module !
 
Last edited:

martinfg

New member
Joined
Nov 21, 2013
Messages
1
Reaction score
0
Points
0
Website
www.muranosoft.com
I also think that the problem is caused by the RAM overheating. Did you manage to resolve it?
 
Last edited:
Top