[Computer BSOD's and restarts when opening programs]

Thank you - she had a good innings - 92 years, but that hardly softens the loss.

Feel free to send the other dump file - it may help.

Please run a few non-security related apps and let me know if BSOD's still occur. If they do I suggest you post the relevant logs in the Malware & Virus Removal forum with a link back to this thread.

The fact that the problem arose at or around the time you changed the memory may or may not be coincidental. Memory problems can arise due to faults in the modules or in the slots into which they fit. I think it unlikely that simply changing the modules would induce such problems given that undue force was not used.

If non-security based apps run without a BSOD then post as I suggested above. If the BSOD's still occur try running a single stick of memory along the lines of my general note on memory testing ....

 

I'm not going to post the entire debug logs for the 4 dumps you sent - just those portions which seem relevant - I have highlighted the 'clues' in red .....

MEMORY dump ....

Use !analyze -v to get detailed debugging information.

BugCheck 8E, {c0000005, 80586a80, b05eeb5c, 0}

Probably caused by : ntoskrnl.exe ( nt!CcPfPrefetchSections+206 )

Followup: MachineOwner
---------

kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED (8e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 80586a80, The address that the exception occurred at
Arg3: b05eeb5c, Trap Frame
Arg4: 00000000

Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx ". The memory could not be "%s "

Minidump 1

Use !analyze -v to get detailed debugging information.

BugCheck 50, {e27d6000, 0, 8056a9fa, 1}


Could not read faulting driver name
Probably caused by : ntoskrnl.exe ( nt!CmpQueryKeyValueData+2d4 )

Followup: MachineOwner
---------

kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: e27d6000, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 8056a9fa, If non-zero, the instruction address which referenced the bad memory address.
Arg4: 00000001, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: e27d6000

FAULTING_IP:
nt!CmpQueryKeyValueData+2d4
8056a9fa f3a5 rep movs dword ptr es:[edi],dword ptr [esi]

MM_INTERNAL_CODE: 1

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

minidump 2

Use !analyze -v to get detailed debugging information.

BugCheck 50, {c1504364, 0, 804e70dd, 0}


Could not read faulting driver name
Probably caused by : memory_corruption ( nt!MiLocateAndReserveWsle+52 )

Followup: MachineOwner
---------

kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: c1504364, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 804e70dd, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------
Could not read faulting driver name

READ_ADDRESS: c1504364


minidump 3


Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 80586a80, b05eeb5c, 0}

Probably caused by : ntoskrnl.exe ( nt!CcPfPrefetchSections+206 )

Followup: MachineOwner
---------

kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 80586a80, The address that the exception occurred at
Arg3: b05eeb5c, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx ". The memory could not be "%s ".
FAULTING_IP:
nt!CcPfPrefetchSections+206
80586a80 8b30 mov esi,dword ptr [eax]

TRAP_FRAME: b05eeb5c -- (.trap ffffffffb05eeb5c)
.trap ffffffffb05eeb5c
Unable to read trap frame at b05eeb5c
.trap

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

With my very limited experience of analysing these logs (some are far more clearcut ) I am still of the opinion that it is a memory problem as outlined in my last post and I suggest you follow the action recommended there.

I would still like to know the outcome of running non-security based apps.

With the time difference I am logging off shortly (11 pm here) and must repeat ....

 

I see you posted while I was posting ......

Some progress -can you try something like Office? What is the result of running say Ad-Aware now? If it BSOD's again we need to check out for malware and I suggest you post in the Malware & Virus removal forum as I posted earlier. Regrettably you will not get an instant response there as the guys are kept extremely busy.

 

Please post your Malware logs in the Malware and Virus Removal forum.

Provide a brief intro & link to this thread.

 

Already done, Arie ....

http://www.windowsbbs.com/malware-v...r-bsod-every-time-i-run-security-program.html