Hi,

I was referred to this forum by John Brouwer of Malware Removal --here's a link to our discussion there:

http://www.malwareremoval.com/forum/viewtopic.php?f=11&t=33687&st=0&sk=t&sd=a&start=0

I've been getting BSODs on a regular basis, more and more often, usually when I am using my PC for multi-track recording (apps are Sonar and Adobe Audition), and worked with John long enough to determine that my machine was clean of malware. Then I ran MEMTEST for 18 hours, 17 passes, and got 23 errors, 20 on test 5 and 3 on test 8.

I'm assuming (and hoping) that all my problems stem from bad RAM, and I've already got new RAM on order, but John felt I would benefit from consulting you folks.

I would certainly appreciate any suggestions or comments you might have, and would be happy to post details about my configuration, logs, test results etc. as you see fit.

Thanks much,
Marc

Hi marcle, and Welcome to CC

I see you were working with John B. over at Malware Removal. If he says you are malware-free then I believe him!

I would agree that your problems stem from bad RAM. If you could force another BSOD (or two) then we could confirm that assumption. If you could post the error message(s) (something like DRIVER_IRQL_NOT_LESS_OR_EQUAL) and the Stop Code (something like 0x000000D1) then we can check it refers to memory problems.

Until your RAM is replaced it would be difficult (and perhaps foolhardy) to decide whether there was another fault there as well.

If you could post the error message here it would help us. Or if you get your new RAM installed before that then let us know how it goes.

Hi, thanks for your help in advance!

Three BSOD messages I already noted were:
BAD POOL CALLER
PFN CORRUPT
IRQL NOT LESS OR EQUAL
although I did not note down stop codes at the time.

Probably my new RAM won't be here for a few days at least, I'll see what I can do before then to get my machine to misbehave -- shouldn't be too tough.

Marc

All those error messages could relate to memory problems or, occasionally, hardware problems.

Check in Device Manager (right click My Computer, Properties, Hardware, Device Manager). If you don't see a yellow '!' or a red 'X' then I would bet it's just a RAM problem.

All is well in Device Manager.

Another suspicion I had was that there was some sort of device driver conflict. Do you think these BSOD messages definitely point to hardware?

Those messages usually point to problems in the following areas:

BAD POOL CALLER - memory, driver conflict, cards/cables not seated correctly
PFN CORRUPT - memory, driver conflict
IRQL NOT LESS OR EQUAL - memory, driver conflict

The fact that the problem has been getting worse, coupled with the Memtest results, makes me think that it is a memory problem. Unless you installed new drivers immediately before the BSODs started happening I would not think it a driver problem.

It's possible that one of your cards has come unseated - thermal expansion/contraction as your system heats up and cools down can make cards 'walk' slightly and cause intermittent contact with the slots. It might pay to open the case, remove each card in turn, gently rub the contacts with a soft pencil eraser (blow the dust away afterwards) and reseat. This would certainly do no harm. While you are in there, make sure all the cables are fully seated on their connectors.

Remove the power cable from your system and wait 30 minutes before you do all that to allow the internal voltages to die down. Also, keep touching the case while you work to dissipate any static electricity.

However, I keep coming back to the Memtest results, which are normally a reliable indicator. Any other problems will be masked if the RAM is going bad so that is the first place to start.

Got one! I spent much of the day loading up the machine as much as I could, multiple apps with multiple large files open, and watched the performance graph in Task Manager for Available Physical Memory. I've got 2 gigs of RAM, and it was hard to push it up over 5-600 meg used (1.5 G available). And the darned machine was behaving fine all day, no doubt because it knew it was being watched. But, at one point it got up to about 1.2 G used, and yes! BSOD:

IRQL_NOT_LESS_OR_EQUAL
Stop Code: 0x0000000A

Because I use a specialized audio interface for recording (RME Fireface 800), and specialized software as well (Sonar, Audition, et. al.), while also having other low-level software such as my MP3 player interface and CD ripping utilities, I'm always concerned about possible driver conflicts. So I will still be looking for other possible problems even after the RAM is replaced.

And I will definitely take the opportunity to reseat cards and cables, clean contacts, etc. when I replace the RAM. That's an obvious step which I already knew and should have tried in this case, but didn't...

That may possibly point to a driver issue on top of the memory issue, but I still have a feeling that the new RAM will show a considerable improvement. We can tackle any driver issues then.

Personally, if me, I would have stopped troubleshooting once I determined the RAM was bad. Who knows what is happening to drivers and programs loaded into bad RAM - or what data corruption they may cause with further use.

I agree with making sure the system is free of dust and dirt, and everything is tight and secure. You should also inspect the motherboard for bulging or leaking electrolytic capacitors. These failed or failing capacitors are a common cause of sudden, but seemingly random system lock ups and reboots. The capacitors look like tall soda cans, many of which surround the CPU socket.

All older motherboards, and many of today's less expensive motherboards use electrolytic capacitors containing a liquid electrolyte. Failing (including flawed and/or abused/over-heated) capacitors literally bulge at the seams due to excessive internal pressures. Extreme (and very rare) cases result in a firecracker type explosion that can really stink up a room. Typically, electrolyte just oozes from the pressure relief points stamped in the tops of the capacitor casings (seen as a symbol or letter). The electrolyte can be caustic to motherboards and flesh. Look for white to dark-brown, dried liquid or foam on the tops or bottoms of the capacitors. Bulging capacitors are a sign leakage is about to occur.

A motherboard with bulging or leaky capacitors can be repaired, but often it is more cost effective in the long run to replace the motherboard.

Other than that, put it on shelf and wait for delivery.

If you just can't stand it, pull all unnecessary hardware and USB devices and all but one RAM stick, and run Memtest86+ again, swapping sticks in to determine which is bad. Be sure to take necessary ESD precautions to prevent damage from static discharge.

Do note that a failing or stressed PSU can give all kinds of seemingly unrelated and weird symptoms too. They don't always just stop working. I would swap in a known, good quality spare, of adequate horsepower, if available, or have that one professionally tested.

I keep a FrozenCPU Ultimate PSU Tester in my travel tool bag. It is not as good as a qualified technician testing the power supply unit (PSU) under a "true" (realistic) load with an oscilloscope or power analyzer, but close. The advantage of this model is that it has an LCD readout of the voltage. With an actual voltage readout, you can better detect a "failing" PSU, or one barely within specified tolerances. Lesser models use LEDs to indicate the voltage is just within some "range". These are less informative, considerably cheaper, but still useful for detecting PSUs that have already "failed". Newegg has several testers to choose from. All these testers contain a "dummy load" to fool the PSU into thinking it is connected to a motherboard, and therefore allows the PSU to power on, if able, without being attached to a motherboard - great for testing fans, but again, not a true load.

I do not recommend using a multimeter to test power supplies. To do it properly, that is, under a realistic load, the voltages on the pins must be measured while the PSU is attached to the motherboard and the computer powered on. This then requires poking (with some considerable force) two, hard and sharp, highly conductive, meter probes into the heart of the computer. One tiny slip can destroy the motherboard, and everything plugged into it.

_________________
Bill, AFE7Ret
Freedom is NOT Free!

Thanks for the suggestion about the PSU. I'll probably wait for the new RAM (hopefully due today or tomorrow) before I do any more troubleshooting, and if that doesn't work, I'll either buy the frozencpu tester, or take my PSU to a place in town that can test it for me.

One quick question about what I'm seeing in Task Manager:

I notice that there are numbers for kernel memory, total, paged, and unpaged. However, I've got 2 gigs of RAM, and the main reason I bought that much was because I believed that if there was enough physical memory, there would be no need for paging at all, and the system would be that much quicker. It seems that I've normally got about 75% of my physical RAM available, why am I seeing paged kernel memory? Is there still a swap file being used, and if so, why, when there's so much free RAM?

OK, I've read up on the subject and I'm a lot more knowledgeable now, I realize my previous question was a bit naive.

Here's another question, though: my peak commit charge is a little over half my physical RAM (1.2g/2g). Does that mean it would be smart to specify the smallest possible page file, in hopes of forcing as little paging as possible?

I've got two physical hard drives, but one is the system drive and the other is used heavily for i/o at exactly the same time I want max system performance, so there's no "ideal" drive for a swap file. Would I gain performance from trying to minimize page file usage?

How is your current page file set up? Note that Windows is pretty good at optimizing how to load up RAM so I would stop trying to dink with it. Yes, you want to utilize your RAM, but generally, Windows does not stuff the slow hard drive with things it needs immediately. In those cases, it first utilizes system RAM, and on-die cache.

That said, there are good and better ways to setup a PF.

The best solution is to install a second physical drive (if EIDE, as the Master on the secondary EIDE channel). Divide the second HD into whatever partitions you want, but make the first one about 3Gb or so. Assigned this drive for the PF, and store only the PF on this drive, and let Windows manage it.

If you must store other things on that drive, make the PF the first file, and fixed in size. Using the old 1.5 X RAM rule of thumb is a good starting place, setting the initial and max to that value.

_________________
Bill, AFE7Ret
Freedom is NOT Free!

I've got 2 drives, C: (60 gig) and G: (160 gig). They're each separate physical drives, one partition each. C: is the system drive, also used for storage of documents and other smaller data files. Large data files for audio and graphics go on drive G:. I've got 2 gigs of physical RAM.
After some recent reading up on it, I've set my page file as follows:
C: drive, no page file (in spite of the warning that I can't save a dump that way)
G: drive, custom page file, 2047 k both min and max. This gives me a commit charge limit of 4 gigs, and my commit max seems to be about 1.2 gigs.
The intent is that there will be no resizing, and therefore no fragmenting, of the page file, and that the G: drive is used least. Does that make sense to you?

I like the idea of a whole separate partition for the page file, I'll think about repartioning my secondary drive.

I see that I've been neglecting to log in every time I post -- the posts above marked "guest" are actually me! I'll try to be more careful...