Windows 7: Recurring BSOD - Memory_Management (Faulty SSD?)

Claranine · 29 Nov 2012

Hi all, this is my first post on Windows 7 forum's so give me heads up on protocol if anything is missed.

-----------------------------------------------------------------------------------

Short story:

Computer has been giving me BSOD's increasingly at random over the last 3 weeks.
BSOD has always been the same titled "MEMORY_MANAGEMENT" with one sole exception which was titled "BAD_POOL_HEADER" or something along those lines.

BIOS and SSD Firmware are at their latest releases.

Included below are the dump files for the crash.

-----------------------------------------------------------------------------------

Longer version:

My opinion at the moment is my crucial m4 SSD's are failing reads and writes causing the system to crash. I've had spontaneous crashes on steam aswell which is located entirely on a separate 256gb M4 SSD, game files also constantly require validation and often need to be downloaded again.

Plugins in chrome aswell as Skype crash repeatedly then launch and run without a hiccup seemingly at random. Crashes normally occur within a few moments of startup or not for a long time.

BSOD's did not occur for a few days after reformatting and updating SSD Firmware to 10G (From 00F), BIOS for the Z77 was updated at the same time.

System is water cooled however I do not believe this is at all relevant to the crashes since the Sinks have been attached properly and heat readings on all hardware never exceed 30C with the exception of the GPU under load.

I know NAND flash is always going to be more volatile memory than magnetic platters but I'm crossing my fingers I don't have to replace any hardware to fix this......

Any help/insights on PC health in general are greatly appreciated, thanks in advance to those who reply as this issue is almost rendering the machine unusable.

**Arc** · 29 Nov 2012

Your crash dumps are not showing any finite probable cause. In such a situation, it is better to enable Driver Verifier to monitor the drivers.

Driver Verifier - Enable and Disable

Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

Let us know the results, with the subsequent crash dumps, if any.

Edit: Follow what marsmimar said at first.

marsmimar · 29 Nov 2012

Hello Claranine and welcome to Seven Forums.

While I was busy typing, Arc already responded. To add to his excellent suggestion to use Driver Verifier, a couple more things for you to look at. From your last (most recent) dump file two things appear to be problematic: driver ntkrnlmp.exe (which is also related to ntoskrnl.exe) and an ASUS utility called AI Suite II.exe. The nt driver(s) are usually updated through Windows Update. And apparently the ASUS utility has caused some issues for a couple of years. Found this ASUS forum thread. Make sure all Windows Updates are current and you might consider uninstalling the ASUS utility.

ASUSTeK Computer Inc.-Forum- AI Suite II

Code:

BugCheck 1A, {5100, fffff6fc400501c8, 13, 3a}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+aec7 )

Followup: MachineOwner
-------------------------------
BUGCHECK_STR:  0x1a_5100

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  AI Suite II.ex

CURRENT_IRQL:  0

Your first dump file (oldest) indicates a hardware problem and another problem with explorer.exe. If the SSD is the problem as you've suspected and it's not physically damaged, you might check to make sure it's aligned properly. Couple of tutorials to go through.

SSD Alignment

SSD / HDD : Optimize for Windows Reinstallation

The explorer.exe issue may be related to damaged or corrupt system files. Run a system file checker scan from an elevated command prompt (option two.) If problems are found, run the scan 3 times and reboot the computer after each scan.

SFC /SCANNOW Command - System File Checker

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80002e85246, fffff8800b12a100, 0}

Probably caused by : hardware ( nt!KiSystemServiceCopyEnd+6 )

Followup: MachineOwner
---------------------------
CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  explorer.exe

CURRENT_IRQL:  0

Claranine · 30 Nov 2012

Hi Arc and Marsmimar, many thanks for your quick replies!

I followed your suggestions and here are the results so far.

--------------------------------------------------------------------------------------

System File Check Runs:

I ran this utility 5 times, rebooting after each successful Scan. The operation failed twice, once before the first scan and once again before the second at 14% progress with only the following reason cited: "Windows Resource Protection could not perform the requested operation"

The scan did return with corrupted files on all 3 successful sweeps, however, the utility notified me some files were unable to be repaired in the process.

CBS.log from the most recent scan only is listed below (there is a full log file if it would be useful, however it is 23.8MB spanning what I assume would be mostly irrelevant information).

Results for SFC /SCANNOW I assume start at the beginning of this file

In the process of fetching this file Windows explorer crashed on me again however I am not familiar as to where a crash log of this event would be stored (if at all).

--------------------------------------------------------------------------------------

SSD alignment Check:

SSD alignment came back positive, I ran the Diskpart utility and offsets for both System reserved and main partitions came back as multiples of 4kb as expected for proper alignment.

--------------------------------------------------------------------------------------

Driver Verifier:

As recommended I am also running Driver Verifier to test for driver faults, as of yet no crashes (other than a brief and recoverable hiccup with explorer) occurred.

I am running the Driver Verifier utility monitoring all non Microsoft first party drivers, I will run for a full 24 hours and let you know should any results come of it.

--------------------------------------------------------------------------------------

Asus AI Suite II

I uninstalled this using Revo uninstaller+ the built in uninstaller, since removal no fatal system crashes have occurred at all however I feel it is far too soon for me to be calling the system fixed (especially with the minor Explorer hiccup).

--------------------------------------------------------------------------------------

Questions

How do I go about repairing the files that could not be fixed by SFC without a windows repair disk? (I am using a digitally leased version of Windows courtesy of the Microsoft Dreamspark Program) Should I attempt to find an ISO for the repair disk online, burn it and attempt a repair or are there easier ways to go about this?

Is it possible to recover fully from the damage done or is it better for the sake of caution to do another full reformat and re-install of Windows 7?

To guarantee system health is there anything else I can do for both my SSD's and system as a whole that will identify problems before they spread?

--------------------------------------------------------------------------------------

Thank you again for your time on this, I am incredibly keen to have my system stable.

**Arc** · 30 Nov 2012

Quote: Originally Posted by Claranine

As recommended I am also running Driver Verifier to test for driver faults, as of yet no crashes (other than a brief and recoverable hiccup with explorer) occurred.

Not bad as an information.

Are you feeling the system a bit slow and laggy with DV enabled?

marsmimar · 30 Nov 2012

Quote:

Questions

How do I go about repairing the files that could not be fixed by SFC without a windows repair disk? (I am using a digitally leased version of Windows courtesy of the Microsoft Dreamspark Program) Should I attempt to find an ISO for the repair disk online, burn it and attempt a repair or are there easier ways to go about this?

Is it possible to recover fully from the damage done or is it better for the sake of caution to do another full reformat and re-install of Windows 7?

To guarantee system health is there anything else I can do for both my SSD's and system as a whole that will identify problems before they spread?

Just some personal opinion and by no means written in stone.

You can obtain a fully functional and legal installation disk for your version of Windows 7 from Digital River (an official Microsoft download site.) Download the ISO to desktop and then burn to DVD. Many folks recommend using free ImgBurn and burn at no more than 4x speed.

Official Windows 7 SP1 ISO from Digital River « My Digital Life

The Official ImgBurn Website

Once you have your installation disk you can use it to access repair options or perform an actual repair install which should fix your currently installed Windows 7 and preserve your user accounts, data, programs, system drivers, etc. (A lot faster than doing a clean install.) If a repair install fails you could always do a clean install later. But remember, all of this is based on software issues and not hardware issues (failing RAM, CPU, etc.)

Repair Install

A proactive approach to guaranteeing system health could be a double edged sword. For example, there are many utilities available that can stress test hard drives, RAM, graphics cards, etc. But let's say you have a stick of RAM that's almost (but not quite) at the failure point. You run Memtest86+ and it pushes the stick to failure. Rhetorical question: Would you have been better off NOT running the test and not stressing the stick to failure?

There's nothing wrong with monitoring temperatures, keeping cases free from dust and blocked vents, running regularly scheduled anti-malware scans, keeping Windows and other programs updated etc. Many people leave their machines running 24/7 and that's about as proactive as they get.

Just some food for thought and not intended to start a "what's the best maintenance program to use" debate.

What I would very strongly suggest is once you have your machine running at peak/optimum performance, make a system image. Keep it in a safe place (preferably on an external hard drive, not DVDs.) If your computer suffers a catastrophic failure because of malware or a DOA drive, etc you could use that image to restore your machine to the exact condition it was in at the time the image was made. The more often you make a system image the more up to date the restore will be.

Claranine · 01 Dec 2012

Hi again, I've finished running my system for approximately 24 hours with Driver Verifier enabled monitoring all non first party drivers.

My system crashed twice since I last posted citing the same crash description both times

special_pool_detected_memory_corruption

A zip is contained below with the updated collection of files from the diagnostic utility.

At each BSOD the system failed to reboot staying frozen at the crash screen for 10 minutes before I hit the hard reset switch.

Both times I believe physical memory was dumped correctly and crash logs were made.... I'm unsure what failed in the process but if even the BSOD recovery routine is failing surely this is not a good sign.

Driver Verifier is no longer running on my system, I did not notice any slowdown with it running simply two crashes.

I think this is getting closer to what has been continually causing my system to crash.... At this point only hardware and a few drivers have been the constant factor in between 3 clean installs I have made on the system.

Again any help is greatly appreciated, your help so far has brought me a fair way closer to troubleshooting these crashes.

marsmimar · 01 Dec 2012

I'm at work on an XP machine (

) so I don't have the tools available to work on your latest zip file. And I won't be home for about 9 hours. Hopefully Arc will be on board soon and can look at the zip.

Quote:

At each BSOD the system failed to reboot staying frozen at the crash screen for 10 minutes before I hit the hard reset switch.

This is troublesome. Since it appears that the SSD is OK, I believe the next most likely failure is RAM. Especially considering the special_pool_detected_memory_corruption error message. Windows 7 has a built in memory diagnostic tool that's not quite as stressful as Memtest86 (link in my post # 6.)

Memory Diagnostics Tool

Claranine · 01 Dec 2012

Thanks Marsmimar, in the mean time I will run the memory diagnostic and see if that yields any new information.

marsmimar · 01 Dec 2012

The last dump file (most recent) shows memory corruption. That doesn't really come as any surprise. But it also shows something called daemonu.exe as contributing to the problem. From what I could find out, this is a service from NVIDIA providing automatic checks and updates of NVIDIA drivers. I also found an article that goes into more detail.

NVIDIA Update, 3D Vision Controller, New NVIDIA Graphics Driver Components

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C1, {fffff98011d16e10, fffff98011d16540, 1f01f0, 23}

Probably caused by : memory_corruption ( nt!MiCheckSpecialPoolSlop+9a )

Followup: MachineOwner
---------
SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION (c1)
Special pool has detected memory corruption.  Typically the current thread's
stack backtrace will reveal the guilty party.
Arguments:
Arg1: fffff98011d16e10, address trying to free
Arg2: fffff98011d16540, address where bits are corrupted
Arg3: 00000000001f01f0, (reserved)
Arg4: 0000000000000023, caller is freeing an address where nearby bytes within the same page have been corrupted

Debugging Details:
------------------

BUGCHECK_STR:  0xC1_23

SPECIAL_POOL_CORRUPTION_TYPE:  23

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME:  daemonu.exe

CURRENT_IRQL:  1

IRP_ADDRESS:  fffffa800d820a88

LAST_CONTROL_TRANSFER:  from fffff80002f5c36a to fffff80002ed5fc0

STACK_TEXT:  
fffff880`08af4548 fffff800`02f5c36a : 00000000`000000c1 fffff980`11d16e10 fffff980`11d16540 00000000`001f01f0 : nt!KeBugCheckEx
fffff880`08af4550 fffff800`02fd4fb3 : 180126ae`00000000 fffff800`02f7afb1 fffffa80`0d820fd8 fffffa80`0d820b50 : nt!MiCheckSpecialPoolSlop+0x9a
fffff880`08af4590 fffff800`0300093b : fffff800`02e57000 00000000`2b707249 00000000`001437d8 00000000`00000001 : nt!MmFreeSpecialPool+0x1d3
fffff880`08af46d0 fffff800`03377026 : fffffa80`113b3502 fffffa80`113b3560 00000000`00000000 fffff980`11d16e10 : nt!ExDeferredFreePool+0xf33
fffff880`08af4780 fffff800`033775ec : fffff800`02eea85c fffff980`11d16e10 00000000`00000000 00000000`00000000 : nt!VfIoFreeIrp+0xe6
fffff880`08af47b0 fffff800`02eea85c : 00000000`00000000 fffff980`11d16e10 00000000`00000000 00000000`00000000 : nt!IovFreeIrpPrivate+0x5c
fffff880`08af47f0 fffff800`02ec8a37 : fffffa80`0d820b00 00000000`00000000 fffffa80`0d800d00 fffff880`00000000 : nt!IopCompleteRequest+0x54c
fffff880`08af48c0 fffff800`02ecbc3d : fffff880`03167d40 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDeliverApc+0x1c7
fffff880`08af4940 fffff800`02edcd8f : 00000000`000002b0 00000000`7efa7000 fffff880`0000003e 00000000`011def08 : nt!KiCommitThreadWait+0x3dd
fffff880`08af49d0 fffff800`031c7fde : fffff880`08af4b00 fffffa80`00000006 00000000`00000001 fffff8a0`078cd001 : nt!KeWaitForSingleObject+0x19f
fffff880`08af4a70 fffff800`02ed5253 : fffffa80`0d820b50 00000000`00000000 fffff880`08af4ab8 fffffa80`0d815b10 : nt!NtWaitForSingleObject+0xde
fffff880`08af4ae0 00000000`74ac2e09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`011deee8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x74ac2e09


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiCheckSpecialPoolSlop+9a
fffff800`02f5c36a cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiCheckSpecialPoolSlop+9a

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  503f82be

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0xC1_23_VRF_nt!MiCheckSpecialPoolSlop+9a

BUCKET_ID:  X64_0xC1_23_VRF_nt!MiCheckSpecialPoolSlop+9a

Followup: MachineOwner

The dump file from 11/30 shows other driver problems called fltmgr.sys (which is a Microsoft Filesystem Filter Manager) and WerFault.exe (another Microsoft core system file that pertains to Windows Error Reporting.) Both are maintained through Windows Updates.

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 000000000039d976, page frame number
Arg3: 0000000000000003, current page state
Arg4: 00000000003657f2, 0

Debugging Details:
------------------
BUGCHECK_STR:  0x4E_99

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  WerFault.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80002f130ec to fffff80002e8cfc0

STACK_TEXT:  
fffff880`09deb918 fffff800`02f130ec : 00000000`0000004e 00000000`00000099 00000000`0039d976 00000000`00000003 : nt!KeBugCheckEx
fffff880`09deb920 fffff800`02e3d728 : fffff980`0ecbd005 fffffa80`0a3c65f0 00000000`00000000 00000000`00000001 : nt!MiBadShareCount+0x4c
fffff880`09deb960 fffff800`03199819 : fffff980`0ecc0000 fffff8a0`03653430 fffff880`00000000 fffff880`00000000 : nt! ?? ::FNODOBFM::`string'+0x2ba77
fffff880`09debc40 fffff800`02eafa1b : 00000000`00000000 fffffa80`0c731110 00000000`00000000 00000000`00200000 : nt!CcUnmapVacb+0x5d
fffff880`09debc80 fffff800`02e5ac27 : fffffa80`0d019101 fffffa80`11925010 00000000`00000000 00000000`00000000 : nt!CcUnmapVacbArray+0x1bb
fffff880`09debd10 fffff880`016b851b : fffffa80`119290c8 00000000`00000000 fffff8a0`00000000 00000000`00000000 : nt!CcPurgeCacheSection+0x147
fffff880`09debd80 fffff880`016d9033 : fffff880`09dec5f0 fffff8a0`03653b40 fffff8a0`02880140 fffff880`09dec088 : Ntfs!NtfsDeleteFile+0x57b
fffff880`09dec000 fffff880`01647cc9 : 00000000`00000000 fffff880`00000000 fffff880`09dec550 00000000`00006000 : Ntfs!NtfsCommonCleanup+0x1653
fffff880`09dec410 fffff800`02e98c48 : fffff880`09dec550 fffff800`02fb913c fffff800`03012940 00000000`00000000 : Ntfs!NtfsCommonCleanupCallout+0x19
fffff880`09dec440 fffff880`01647d42 : fffff880`01647cb0 00000000`00000000 fffff880`09dec800 00000000`00000000 : nt!KeExpandKernelStackAndCalloutEx+0xd8
fffff880`09dec520 fffff880`016e6a04 : fffff880`09dec5f0 fffff880`09dec5f0 fffff880`09dec5f0 00000000`a0000003 : Ntfs!NtfsCommonCleanupOnNewStack+0x42
fffff880`09dec590 fffff880`0146bbcf : fffff880`09dec5f0 fffffa80`127cb2b0 fffffa80`127cb608 fffffa80`126ee010 : Ntfs!NtfsFsdCleanup+0x144
fffff880`09dec800 fffff880`0146a6df : fffffa80`0f647660 00000000`00000000 fffffa80`0c9fc700 fffffa80`127cb2b0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`09dec890 fffff800`031905ef : fffffa80`127cb2b0 fffffa80`108deb30 00000000`00000000 fffffa80`1192b1f0 : fltmgr!FltpDispatch+0xcf
fffff880`09dec8f0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopCloseFile+0x11f


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiBadShareCount+4c
fffff800`02f130ec cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiBadShareCount+4c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  503f82be

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

Followup: MachineOwner

Have you given any thought to a repair install?

Repair Install

Windows 7: Recurring BSOD - Memory_Management (Faulty SSD?)

Recurring BSOD - Memory_Management (Faulty SSD?) problems?