Several BSOD's, memory problem? 0x109 - Windows 7 x64

Draggoth · Jan 17, 2013

A few days ago I started getting random BSOD's while browsing or playing games, without an apparent pattern. I'm uploading all the files from the jcgriff2 BSOD File Collection app and the System Health Report with this post, also all my system specs are right next to my posts under my name. The errors I've got so far are:

Code:

BCS                         BCC         Driver
IRQL_NOT_LESS_OR_EQUAL      0x0000000a  ntoskrnl.exe
KMODE_EXCEPTION_NOT_HANDLED 0x0000001e  ntoskrnl.exe
PAGE_FAULT_IN_NONPAGED_AREA 0x00000050  HTTP.sys
PAGE_FAULT_IN_NONPAGED_AREA 0x00000050  ntoskrnl.exe
                            0x00000109  ntoskrnl.exe
                            0x00000109  ntoskrnl.exe
                            0x00000109  ndis.sys

Besides keeping Windows updated I haven't installed or modified anything in at least 2 months and never had this kind of trouble before. I'm not overclocking and my temps are pretty good.

I checked the minidumps with BlueScreenView and did some research, all the BCC's seem to be related to memory problems of some sort. After the first couple of crashes I ran CHKDSK on both of my disks just in case but the results came clean, I didn't see anything wrong with them. (You can see the results in my uploaded Application log - $evtx_app_dump.txt)

So, while I did some more research I tested my RAM with Memtest86+, let it run for 25 hours straight (21 passes) without errors. Then I started to get worried about my GPU/graphic drivers being the problem or that my card could get damaged with all the crashes so I uninstalled the drivers, took it out of the case and switched to the integrated graphics on the motherboard. After doing that I still got a couple of more crashes so at least my GPU seems to be safe.

The last thing I did was to check my CPU temps with a torture test using Prime95, using the In-place large FFTs option. My CPU never got over 68ºC but I got another BCC 0x109 crash after 4 hours.

I really hope you can help me to figure this out, any help would be greatly apreciated. While I get a response I'm gonna start looking for updated drivers for all my hardware, I'll just download them and wait for your response before installing anything.

usasma · Jan 17, 2013

68ºC is a bit warm for an i5 IMO - but I wouldn't expect it to cause BSOD's. Have a look at your cooling solution to see if you can make it a bit more effective.

TeamViewer is disabled - please remove it from your system. If needed you can install a fresh copy later on.
PCI Simple Communications driver isn't installed, please install the Intel Management Engine Interface for your system. Either get it at the PC Manufacturer's website - or get it from Intel Download Center

Other than this, there's nothing specific. That, in itself, is sometimes suggestive of a hardware problem. Please run these free hardware diagnostics: Hardware Diagnostics

Analysis:
The following is for informational purposes only.

Code:

**************************Wed Jan 16 10:24:35.852 2013 (UTC - 5:00)**************************
Loading Dump File [C:\Users\John\_jcgriff2_\dbug\__Kernel__\011613-12495-01.dmp]
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
System Uptime:0 days 13:14:00.007
Probably caused by :ndis.sys ( ndis!ndisMRestoreFilterSettings+0 )
BugCheck 109, {a3a039d89c642609, b3b7465eeee2040f, fffff880014dcf80, 1}
BugCheck Info: CRITICAL_STRUCTURE_CORRUPTION (109)
Arguments: 
Arg1: a3a039d89c642609, Reserved
Arg2: b3b7465eeee2040f, Reserved
Arg3: fffff880014dcf80, Failure type dependent information
Arg4: 0000000000000001, Type of corrupted region, can be
	0 : A generic data region
	1 : Modification of a function or .pdata
	2 : A processor IDT
	3 : A processor GDT
	4 : Type 1 process list corruption
	5 : Type 2 process list corruption
	6 : Debug routine modification
	7 : Critical MSR modification
BUGCHECK_STR:  0x109
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
PROCESS_NAME: System
FAILURE_BUCKET_ID: X64_0x109_1_ndis!ndisMRestoreFilterSettings+0
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Sun Jan 13 02:38:48.802 2013 (UTC - 5:00)**************************
Loading Dump File [C:\Users\John\_jcgriff2_\dbug\__Kernel__\011313-16894-01.dmp]
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
System Uptime:0 days 0:35:24.989
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by :memory_corruption
BugCheck 50, {fffff880046ce3e0, 0, fffff80003391595, 1}
BugCheck Info: PAGE_FAULT_IN_NONPAGED_AREA (50)
Arguments: 
Arg1: fffff880046ce3e0, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80003391595, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000001, (reserved)
BUGCHECK_STR:  0x50
DEFAULT_BUCKET_ID:  CODE_CORRUPTION
PROCESS_NAME: svchost.exe
FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT
CPUID:        "Intel(R) Core(TM) i5-2500K CPU @ 3.30GHz"
MaxSpeed:     3300
CurrentSpeed: 3300
  BIOS Version                  0801
  BIOS Release Date             08/15/2011
  Manufacturer                  System manufacturer
  Product Name                  System Product Name
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Fri Jan 11 19:13:21.151 2013 (UTC - 5:00)**************************
Loading Dump File [C:\Users\John\_jcgriff2_\dbug\__Kernel__\011113-18111-01.dmp]
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
System Uptime:0 days 1:30:46.963
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by :memory_corruption
BugCheck A, {0, 2, 1, fffff800030a15e9}
BugCheck Info: IRQL_NOT_LESS_OR_EQUAL (a)
Arguments: 
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff800030a15e9, address which referenced memory
BUGCHECK_STR:  0xA
DEFAULT_BUCKET_ID:  CODE_CORRUPTION
PROCESS_NAME: System
FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT
CPUID:        "Intel(R) Core(TM) i5-2500K CPU @ 3.30GHz"
MaxSpeed:     3300
CurrentSpeed: 3300
  BIOS Version                  0801
  BIOS Release Date             08/15/2011
  Manufacturer                  System manufacturer
  Product Name                  System Product Name
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Fri Jan 11 15:48:00.211 2013 (UTC - 5:00)**************************
Loading Dump File [C:\Users\John\_jcgriff2_\dbug\__Kernel__\011113-19266-01.dmp]
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
System Uptime:0 days 1:07:20.397
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by :memory_corruption
BugCheck 50, {fffffa807b1195ac, 1, fffff8800156c598, 5}
BugCheck Info: PAGE_FAULT_IN_NONPAGED_AREA (50)
Arguments: 
Arg1: fffffa807b1195ac, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff8800156c598, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000005, (reserved)
BUGCHECK_STR:  0x50
DEFAULT_BUCKET_ID:  CODE_CORRUPTION
PROCESS_NAME: GoogleUpdate.e
FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT
CPUID:        "Intel(R) Core(TM) i5-2500K CPU @ 3.30GHz"
MaxSpeed:     3300
CurrentSpeed: 3300
  BIOS Version                  0801
  BIOS Release Date             08/15/2011
  Manufacturer                  System manufacturer
  Product Name                  System Product Name
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Fri Jan 11 07:37:08.813 2013 (UTC - 5:00)**************************
Loading Dump File [C:\Users\John\_jcgriff2_\dbug\__Kernel__\011113-14726-01.dmp]
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
System Uptime:0 days 1:38:00.000
Probably caused by :memory_corruption ( nt!MiFindContiguousPages+0 )
BugCheck 109, {a3a039d8993fc5e5, b3b7465eebbc953b, fffff800031b0b40, 1}
BugCheck Info: CRITICAL_STRUCTURE_CORRUPTION (109)
Arguments: 
Arg1: a3a039d8993fc5e5, Reserved
Arg2: b3b7465eebbc953b, Reserved
Arg3: fffff800031b0b40, Failure type dependent information
Arg4: 0000000000000001, Type of corrupted region, can be
	0 : A generic data region
	1 : Modification of a function or .pdata
	2 : A processor IDT
	3 : A processor GDT
	4 : Type 1 process list corruption
	5 : Type 2 process list corruption
	6 : Debug routine modification
	7 : Critical MSR modification
BUGCHECK_STR:  0x109
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
PROCESS_NAME: System
FAILURE_BUCKET_ID: X64_0x109_1_nt!MiFindContiguousPages+0
CPUID:        "Intel(R) Core(TM) i5-2500K CPU @ 3.30GHz"
MaxSpeed:     3300
CurrentSpeed: 3300
  BIOS Version                  0801
  BIOS Release Date             08/15/2011
  Manufacturer                  System manufacturer
  Product Name                  System Product Name
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Fri Jan 11 02:54:53.265 2013 (UTC - 5:00)**************************
Loading Dump File [C:\Users\John\_jcgriff2_\dbug\__Kernel__\011113-24024-01.dmp]
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
System Uptime:0 days 0:02:56.781
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by :memory_corruption
BugCheck 1E, {ffffffffc0000005, fffff80002281599, 0, ffffffffffffffff}
BugCheck Info: KMODE_EXCEPTION_NOT_HANDLED (1e)
Arguments: 
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002281599, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception
BUGCHECK_STR:  0x1E_c0000005_R
PROCESS_NAME: mmc.exe
FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT
CPUID:        "Intel(R) Core(TM) i5-2500K CPU @ 3.30GHz"
MaxSpeed:     3300
CurrentSpeed: 3300
  BIOS Version                  0801
  BIOS Release Date             08/15/2011
  Manufacturer                  System manufacturer
  Product Name                  System Product Name
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Fri Jan 11 02:50:51.899 2013 (UTC - 5:00)**************************
Loading Dump File [C:\Users\John\_jcgriff2_\dbug\__Kernel__\011113-26707-01.dmp]
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
System Uptime:0 days 2:13:27.085
Probably caused by :ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+3d222 )
BugCheck 109, {a3a039d89c7465c0, b3b7465eeef13516, fffff8000306cae8, 1}
BugCheck Info: CRITICAL_STRUCTURE_CORRUPTION (109)
Arguments: 
Arg1: a3a039d89c7465c0, Reserved
Arg2: b3b7465eeef13516, Reserved
Arg3: fffff8000306cae8, Failure type dependent information
Arg4: 0000000000000001, Type of corrupted region, can be
	0 : A generic data region
	1 : Modification of a function or .pdata
	2 : A processor IDT
	3 : A processor GDT
	4 : Type 1 process list corruption
	5 : Type 2 process list corruption
	6 : Debug routine modification
	7 : Critical MSR modification
BUGCHECK_STR:  0x109
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
PROCESS_NAME: System
FAILURE_BUCKET_ID: X64_0x109_1_nt!_??_::FNODOBFM::_string_+3d222
CPUID:        "Intel(R) Core(TM) i5-2500K CPU @ 3.30GHz"
MaxSpeed:     3300
CurrentSpeed: 3300
  BIOS Version                  0801
  BIOS Release Date             08/15/2011
  Manufacturer                  System manufacturer
  Product Name                  System Product Name
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``

3rd Party Drivers:
The following is for information purposes only.
Any drivers in red should be updated or removed from your system. And should have been discussed in the body of my post.

Code:

**************************Wed Jan 16 10:24:35.852 2013 (UTC - 5:00)**************************
intelppm.sys                Mon Jul 13 19:19:25 2009 (4A5BC0FD)
amdxata.sys                 Fri Mar 19 12:18:18 2010 (4BA3A3CA)
asmtxhci.sys                Wed Feb 23 21:25:47 2011 (4D65C1AB)
asmthub3.sys                Wed Feb 23 21:25:56 2011 (4D65C1B4)
RsFx0151.sys                Fri Jun 17 04:28:58 2011 (4DFB104A)
e1c62x64.sys                Wed Jul 20 12:37:53 2011 (4E270461)
RTKVHD64.sys                Tue Oct 18 07:48:20 2011 (4E9D6784)
IntcDAud.sys                Tue Jun 19 10:40:51 2012 (4FE08F73)
MpFilter.sys                Thu Aug 23 19:03:14 2012 (5036B6B2)
VBoxUSBMon.sys              Fri Oct 26 12:59:41 2012 (508AC17D)
VBoxNetFlt.sys              Fri Oct 26 12:59:41 2012 (508AC17D)
VBoxNetAdp.sys              Fri Oct 26 12:59:42 2012 (508AC17E)
VBoxDrv.sys                 Fri Oct 26 13:00:50 2012 (508AC1C2)
cpuz136_x64.sys             Sat Oct 27 13:24:41 2012 (508C18D9)
igdkmd64.sys                Wed Dec 12 19:42:26 2012 (50C92472)
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Sun Jan 13 02:38:48.802 2013 (UTC - 5:00)**************************
AtihdW76.sys                Fri May 11 04:25:40 2012 (4FACCD04)
atikmpag.sys                Thu Sep 27 21:12:52 2012 (5064F994)
atikmdag.sys                Thu Sep 27 22:14:57 2012 (50650821)
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Fri Jan 11 02:50:51.899 2013 (UTC - 5:00)**************************
atikmpag.sys                Fri Jul 27 21:14:47 2012 (50133D07)
atikmdag.sys                Fri Jul 27 21:48:09 2012 (501344D9)

Draggoth · Jan 18, 2013

Thanks for the quick reply!

I already uninstalled TeamViewer as you suggested and also installed the drivers for Intel MEI. However I got a new crash after restarting my system, while Windows was starting:

Code:

STOP 0x0000007E: (0xC0000005, 0xsomething, 0xsomething, 0xsomething)

I looked it up and the first parameter seems to mean 0xC0000005: STATUS_ACCESS_VIOLATION indicates a memory access violation occurred. I don't have a minidump for this crash, I guess because it happened while Windows was still loading.

I'm gonna let Memtest86+ run overnight again and then check my HDs tomorrow morning with the tests you recommend. About my CPU temps, I used Prime95 to push all the cores to 100% for about 15~20 mins before getting over 65º and the max temp during the 3 hour run was just 68º, so I guess it could be lower, but it's no bad. I'll check what I can do to cool everything down a little bit more.

Vir Gnarus · Jan 18, 2013

It says a memory access violation, but that's only because it involves, well, accessing memory. It doesn't necessarily mean that the memory region was corrupted by hardware means. It could be that a software bug scrubbed it up bad, or a bad pointer was pointing to the wrong address. A lot of things could cause a C0000005 error, so it's up to analyzing whether the address pointed too is legit or not, and if it is, what was supposed to be there and what is in there now, and how.

The only consistent pattern I'm seeing is that it's usually involving some net-based activity. It doesn't appear Prime95 was involved in the 0x109 crash.

I'd like to look at the 0x109 especially. But to do so, I need the original file copy of the file who's memory image got corrupted. Can you go into C:/Windows/System32/drivers and then zip up a copy of the ndis.sys file in there and then send it over.

In the meantime, turn on Driver Verifier and provide us any crashdumps produced from the crashes it may cause. Thanks.

Draggoth · Jan 19, 2013

I'm attaching to this post the ndis.sys and http.sys files related to my crashes, also I'm gonna set up Driver Verifier and run my system with it for a while. If some of my system files have gone bad should I try running sfc /scannow (after I'm done with Driver Verifier of course) ?

Last night I checked my RAM again with Memtest86+, I started it at 3:30 and let it run. When I checked on it in the morning at 11:30, the test showed no errors but the timer had stop at 4 hrs 40 min (it should've been at 8+ hrs) and the progress on the tests wasn't moving. Also I couldn't restart by pressing ESC or go into the settings, so I think Memtest86+ somehow bugged out, I had to reset my computer with the case button. After that I ran Memtest86+ again, but this time it went for 10 hrs (9 passes) no problem. Do you think this points to a hardware failure or maybe it was Memtest86+ acting out?

Off-topic note: The RsFx0151.sys file seems to be related to MS SQL Server.

mmkarimi · Jan 19, 2013

what about your PSU, how much is its power?
what do you usually doing while getting BSOD?
have yo tried to clean up your cpu fan?

also clean up your startup programs with msconfig-->startup prog & services

Vir Gnarus · Jan 22, 2013

Came back from analyzing the 0x109 crashdump. The modules match up just fine, which stumps me pretty bad. Most likely what I think happened is that while the instruction passed to the CPU for operation was in itself ok, the CPU itself scrubbed the instruction when it was held in its internal instruction cache. Either way, this seriously looks likes a hardware issue, no doubt about it, in which case crashdumps will do little to tell us what it is. PSU/CPU/Mobo are the three items I suspect most.

Analysts:

I did a !chkimg on the module using the baked-in symbols in the ndis.sys file provided by the user, directing Windbg to use it instead of the ones provided by Windows symbol server. Either version, however, are identical, and it matches up with both. Therefore if something did scrub this instruction to cause it to do something bad, it was transitory, as the corruption of the code was not retained in the crashdump. Again, I suspect hardware at play here.

Wrench97 · Jan 22, 2013

Lets get a look at the temps and voltages under load to see if that will reveal anything.

D/L and run Hardware Monitor do something intense like a virus scan or gaming for a bit, Alt+Tab back to HWM expand all the trees and use the Win7 snipping tool to grab a screen shot of the HWM window, post the screen shot using the insert image button and uploading it from your PC.

A couple of other things to look at.
The Intel(R) Management Engine Interface is listed in problem devices as the drivers are not installed.
The Bios is dated from Aug. of 2011 what motherboard is in the system as there may be some updates for it?

Search

Search

Several BSOD's, memory problem? 0x109 - Windows 7 x64

Draggoth

New member

usasma

Retired Admin

Draggoth

New member

Vir Gnarus

BSOD Kernel Dump Expert

Draggoth

New member

Attachments

mmkarimi

Registered Member

Vir Gnarus

BSOD Kernel Dump Expert

Wrench97

Administrator, Hardware Expert