[Capersinc]

Lets hope someone can help me. Here is the situation:

I am Running a Dell Inspiron 1520 Notebook
2 Gigs on Ram
Intel Core 2 Due 1.5Ghz
Windows Vista Home Prem (Sp2)

I am getting the following BSODs:
Iirql_not_less_or_equal
VISTA_DRIVER_FAULT

Sometimes, different ones like Memory_Management as well.

Now, this occurs mainly when playing Farmville on Facebook. Everything the wife plays it, it will Bluescreen. Occasionly playing Mafia Wars, but very rare. Seems EVERYTIME she plays Farmville it will BSOD. I Have not installed any new drivers in recent weeks and its been happing since about July. More frequent now since she plays the game more often. I did all the Windows Updates, no more left to update. According to Dell Drivers, my drivers seem to up to date as well as far as I can tell. (I Can not update from the mfg website like Intel due to Dell using different drivers or different configuration than what intel provides)

I have run windows internal Memory Diag Tool & Memtest 86. Both passed.

I've always tried running IE, Firefox & Google Chrome. All will BSOD using Farmville.

Here is my latest WinDBG Crash:


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*DownstreamStore*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2008/Windows Vista Kernel Version 6002 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6002.18082.x86fre.vistasp2_gdr.090803-2339
Machine Name:
Kernel base = 0x81e1d000 PsLoadedModuleList = 0x81f34c70
Debug session time: Sat Nov 14 00:47:32.839 2009 (GMT-4)
System Uptime: 0 days 0:06:23.666
Loading Kernel Symbols
...............................................................
................................................................
....................................
Loading User Symbols

Loading unloaded module list
.....
*************************************************************************** ****
* *
* Bugcheck Analysis *
* *
*************************************************************************** ****

Use !analyze -v to get detailed debugging information.

BugCheck 19, {22, bb60f000, 1, 0}

Probably caused by : ntkrpamp.exe ( nt!ExpFindAndRemoveTagBigPages+1d5 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*************************************************************************** ****
* *
* Bugcheck Analysis *
* *
*************************************************************************** ****

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 00000022,
Arg2: bb60f000
Arg3: 00000001
Arg4: 00000000

Debugging Details:
------------------


BUGCHECK_STR: 0x19_22

POOL_ADDRESS: bb60f000 Paged pool

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: 2

LAST_CONTROL_TRANSFER: from 81ed2c3c to 81eeab0d

STACK_TEXT:
85575b84 81ed2c3c 00000019 00000022 bb60f000 nt!KeBugCheckEx+0x1e
85575bc0 81f0a14a bb60f000 85575c0c 85575bf0 nt!ExpFindAndRemoveTagBigPages+0x1d5
85575c30 81f95428 bb60f000 00000000 00000002 nt!ExFreePoolWithTag+0x145
85575d1c 81f956d6 00000002 81f1f13c 83eba828 nt!CmpFlushBackupHive+0x284
85575d40 81f9574f 81ec2e22 00000000 00000000 nt!CmpSyncBackupHives+0x90
85575d44 81ec2e22 00000000 00000000 83eba828 nt!CmpFirstBackupFlushWorker+0x8
85575d7c 81ff2c42 00000000 d49e568a 00000000 nt!ExpWorkerThread+0xfd
85575dc0 81e5befe 81ec2d25 00000001 00000000 nt!PspSystemThreadStartup+0x9d
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!ExpFindAndRemoveTagBigPages+1d5
81ed2c3c cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!ExpFindAndRemoveTagBigPages+1d5

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4a77feb3

FAILURE_BUCKET_ID: 0x19_22_VRF_nt!ExpFindAndRemoveTagBigPages+1d5

BUCKET_ID: 0x19_22_VRF_nt!ExpFindAndRemoveTagBigPages+1d5

Followup: MachineOwner
---------



Any Ideas?

[Rollin' Rog]

Considering the circumstances, and especially because this is a notebook, I would be looking for an overheating issue.

However if you have installed a non Windows firewall, I would be suspicious of that as well.

You might try playing in a "Clean Boot" test: http://support.microsoft.com/kb/929135/en-us

Have you tried updating or reinstalling Display drivers?



I can look a little further at the dump files though:

I can run a debugging utility on the dump files if you do this:

1 > create a new folder on the desktop and call it "dumpcheck" or whatever you like
2 > navigate to c:\windows\minidump and copy the last few minidump files to that folder. *this assumes 'c' is your boot drive, if it is not, subsitute accordingly
3 > close the folder and right click on it and select Send to Compressed (zipped) Folder.
4 > use the "manage attachments" in the "advanced" reply window to upload that zip file here as an attachment.

This might point us to a non Microsoft driver causing the error, if one exists for it.

If you do not see any minidumps, be sure you are not using any cache cleaner such as CCleaner. Also run sysdm.cpl and select Advanced > Startup and Recovery. Make sure "small memory dump" is the one chosen under "write debugging information" and the location should be %systemroot%\minidump

[Capersinc]

As for Clean Boot test I did not finish this yet, I did step 1. Now to wait for the wife to come and try and Blue Screen the system playing Farmville to see if it a process. If I do get a Bluescreen we know that its not a service (Unless its a Microsoft Service)

I Have tried updated the Display Drivers. They say they are Up to date. As for Uninstalling them/Reinstalling them I have no idea how to do easily from a Dell Driver Standpoint. Dont really wanna mess anything up and not be able to recover.

However, I have done the Minidump file you wanted. Took the last 5 Minidumps for you. I also did the sysdl thing as well. The listing was under Kernel Memory Dump. Now it is small memory dump.

Thats everythiing in the meantime till the wife tries Farmville again and see if she BSOD

[Rollin' Rog]

Most of these errors are "memory corruption" of one kind or another -- which doesn't tell us much.

One flagged a networking driver, but otherwise the faults are generic "special pool" corruptions.

Audio drivers are prominent in the back trace, so I would update or reinstall those from the Dell support site for your model (use your dell 'tag' to be sure to find the right downloads).

I would also update or reinstall the Network drivers, LAN, and if you are using Wireless (I didn't see any) those as well.

0: kd> kd (display back trace)
*** WARNING: Unable to verify timestamp for iastorv.sys
*** ERROR: Module load completed but symbols could not be loaded for iastorv.sys
*** WARNING: Unable to verify timestamp for iastor.sys
*** ERROR: Module load completed but symbols could not be loaded for iastor.sys
*** WARNING: Unable to verify timestamp for PxHelp20.sys
*** ERROR: Module load completed but symbols could not be loaded for PxHelp20.sys
*** WARNING: Unable to verify timestamp for msrpc.sys
*** ERROR: Module load completed but symbols could not be loaded for msrpc.sys
*** WARNING: Unable to verify timestamp for dump_iaStor.sys
*** ERROR: Module load completed but symbols could not be loaded for dump_iaStor.sys
*** WARNING: Unable to verify timestamp for RimSerial.sys
*** ERROR: Module load completed but symbols could not be loaded for RimSerial.sys
*** ERROR: Module load completed but symbols could not be loaded for spldr.sys
*** WARNING: Unable to verify timestamp for igdkmd32.sys
*** ERROR: Module load completed but symbols could not be loaded for igdkmd32.sys
*** WARNING: Unable to verify timestamp for dxgkrnl.sys
*** ERROR: Module load completed but symbols could not be loaded for dxgkrnl.sys
*** WARNING: Unable to verify timestamp for bcmwl6.sys
*** ERROR: Module load completed but symbols could not be loaded for bcmwl6.sys
*** WARNING: Unable to verify timestamp for bcm4sbxp.sys
*** ERROR: Module load completed but symbols could not be loaded for bcm4sbxp.sys
*** WARNING: Unable to verify timestamp for rimmptsk.sys
*** ERROR: Module load completed but symbols could not be loaded for rimmptsk.sys
*** WARNING: Unable to verify timestamp for rimsptsk.sys
*** ERROR: Module load completed but symbols could not be loaded for rimsptsk.sys
*** WARNING: Unable to verify timestamp for rixdptsk.sys
*** ERROR: Module load completed but symbols could not be loaded for rixdptsk.sys
*** WARNING: Unable to verify timestamp for SynTP.sys
*** ERROR: Module load completed but symbols could not be loaded for SynTP.sys
*** WARNING: Unable to verify timestamp for GEARAspiWDM.sys
*** ERROR: Module load completed but symbols could not be loaded for GEARAspiWDM.sys
*** WARNING: Unable to verify timestamp for stwrt.sys
*** ERROR: Module load completed but symbols could not be loaded for stwrt.sys
*** WARNING: Unable to verify timestamp for drmk.sys
*** ERROR: Module load completed but symbols could not be loaded for drmk.sys
*** WARNING: Unable to verify timestamp for HSXHWAZL.sys
*** ERROR: Module load completed but symbols could not be loaded for HSXHWAZL.sys
*** WARNING: Unable to verify timestamp for Msfs.SYS
*** ERROR: Module load completed but symbols could not be loaded for Msfs.SYS
*** WARNING: Unable to verify timestamp for HSX_DPV.sys
*** ERROR: Module load completed but symbols could not be loaded for HSX_DPV.sys
*** WARNING: Unable to verify timestamp for HSX_CNXT.sys
*** ERROR: Module load completed but symbols could not be loaded for HSX_CNXT.sys
*** WARNING: Unable to verify timestamp for Fs_Rec.SYS
*** ERROR: Module load completed but symbols could not be loaded for Fs_Rec.SYS
*** WARNING: Unable to verify timestamp for Null.SYS
*** ERROR: Module load completed but symbols could not be loaded for Null.SYS
*** WARNING: Unable to verify timestamp for btwavdt.sys
*** ERROR: Module load completed but symbols could not be loaded for btwavdt.sys
*** WARNING: Unable to verify timestamp for btwaudio.sys
*** ERROR: Module load completed but symbols could not be loaded for btwaudio.sys
*** WARNING: Unable to verify timestamp for btwrchid.sys
*** ERROR: Module load completed but symbols could not be loaded for btwrchid.sys
*** WARNING: Unable to verify timestamp for srv2.sys
*** ERROR: Module load completed but symbols could not be loaded for srv2.sys
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
*** WARNING: Unable to verify timestamp for TSDDD.dll
*** ERROR: Module load completed but symbols could not be loaded for TSDDD.dll
*** WARNING: Unable to verify timestamp for cdd.dll
*** ERROR: Module load completed but symbols could not be loaded for cdd.dll
*** WARNING: Unable to verify timestamp for spsys.sys
*** ERROR: Module load completed but symbols could not be loaded for spsys.sys
*** WARNING: Unable to verify timestamp for dsunidrv.sys
*** ERROR: Module load completed but symbols could not be loaded for dsunidrv.sys
*** WARNING: Unable to verify timestamp for mdmxsdk.sys
*** ERROR: Module load completed but symbols could not be loaded for mdmxsdk.sys
*** WARNING: Unable to verify timestamp for secdrv.SYS
*** ERROR: Module load completed but symbols could not be loaded for secdrv.SYS
*** WARNING: Unable to verify timestamp for xaudio.sys
*** ERROR: Module load completed but symbols could not be loaded for xaudio.sys
Couldn't resolve error at 'display back trace)'

[Capersinc]

Update:

As I was searching for updates, another BSOD. Here is the cop of the MiniDump. Also, it says all my drivers are up to date. How would I uninstall and reinstall the Dell Drivers without causing an error or messing things up? Any help on that?

[Rollin' Rog]

Well this one is a bit different, the driver Iastor.sys is a Raid Controller driver from Intel.

BugCheck C1, {be9c2c50, 0, 3b0, 22}

*** WARNING: Unable to verify timestamp for iastor.sys
*** ERROR: Module load completed but symbols could not be loaded for iastor.sys
Probably caused by : iastor.sys ( iastor+29b7 )

Dell may have a fix.

==================

In general when uninstalling and reinstalling drivers it is best to create a system checkpoint (restore point) before proceeding.

Go to the Dell Site for your service tag, and download the setup for your device.

In most cases it is really not necessary to do an uninstall first, as the installer should be able to overinstall or handle the update without your doing that.

But run the setup off the hard drive.

=============================

Here is a Dell issue with Iastor.sys >>

http://support.dell.com/support/topi...808&doclang=en

If your Dell is under warranty, you might want to confer with them first.

There is also the Dell Diagnostics that you can run which I believe will check the drives for basic health issues.

I don't have a recent Dell computer, so I can't quite lead you through the Diagnostics run.

----------------------------------------------

Have you ruled out overheating as an issue? If you have not investigated this, I would do it first.

See if SpeedFan will get you some temps on your Dell Notebook, it does work on mine >>

http://www.majorgeeks.com/download337.html

Look for any temp rise of more than 30 - 35c from a cold boot; if it will also report your hard drive -- use the S.M.A.R.T. tab and select your drive and do the online scan. Read it carefully to see what the maximum temp for your drive should be.

[Capersinc]

Thank you. I was able to do a Flash and Install the new Bios Drivers. My system said that no new drivers were available but the Dell site said there was. Installed that and have not had a BSOD since!

Very thankful for all the help. As far as now goes, we can mark this as solved.

[Rollin' Rog]

Glad to see it sorted, you are most welcome for any help.