MEMORY_MANAGEMENT BSOD point to ntoskrnl.exe

frienderman · 02 Nov 2013

Hi, I've been having frequent BSODs lately, they have all said MEMORY_MANAGEMENT, and the dump files say ntoskrnl.exe is causing the problems, i attached the SF diagnostic tool's zip file to the thread, so maybe you guys can see what's wrong with everything here. I've already tried reinstalling as well as repairing windows, and so far nothing has fixed it.
Thanks

Arc · 03 Nov 2013

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

If it start showing errors/red lines, stop testing. A single error is enough to determine that something is going bad there.

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41287, 70001096b60, 0, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+454f5 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041287, An illegal page fault occurred while holding working set synchronization.
    Parameter 2 contains the referenced virtual address.
Arg2: 0000070001096b60
Arg3: 0000000000000000
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41287

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  explorer.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88003a646a0 -- (.trap 0xfffff88003a646a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff70001080488 rbx=0000000000000000 rcx=0000058000000000
rdx=00000000ffffffff rsi=0000000000000000 rdi=0000000000000000
rip=fffff80001cf6f61 rsp=fffff88003a64830 rbp=000007fef4ed6000
 r8=0000000fffffffff  r9=0000000000002cdb r10=000007fef4ed6000
r11=fffff70001080000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
nt!MiDeleteVirtualAddresses+0x559:
fffff800`01cf6f61 4a891cf8        mov     qword ptr [rax+r15*8],rbx ds:fffff700`01080488=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80001c5ed2e to fffff80001cc5bc0

STACK_TEXT:  
fffff880`03a64538 fffff800`01c5ed2e : 00000000`0000001a 00000000`00041287 00000700`01096b60 00000000`00000000 : nt!KeBugCheckEx
fffff880`03a64540 fffff800`01cc3cee : 00000000`00000001 00000700`01096b60 00000000`00000000 000007fe`f4ed6008 : nt! ?? ::FNODOBFM::`string'+0x454f5
fffff880`03a646a0 fffff800`01cf6f61 : 00000009`0497266c fffffa80`08b76480 fffff880`03a64948 fffffa80`070ab010 : nt!KiPageFault+0x16e
fffff880`03a64830 fffff800`01cf87d9 : 00000000`00000000 000007fe`f4ee6fff fffffa80`00000000 00000000`00000000 : nt!MiDeleteVirtualAddresses+0x559
fffff880`03a649f0 fffff800`01fde631 : fffffa80`08ceeb70 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0xd9
fffff880`03a64b10 fffff800`01fdea33 : 00000000`00000000 000007fe`f4ec0000 fffffa80`00000001 fffffa80`09620ae0 : nt!MiUnmapViewOfSection+0x1b1
fffff880`03a64bd0 fffff800`01cc4e53 : fffffa80`094de060 fffff880`03a64ca0 fffffa80`08e8f060 fffffa80`0954b350 : nt!NtUnmapViewOfSection+0x5f
fffff880`03a64c20 00000000`76d7155a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0656f338 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76d7155a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+454f5
fffff800`01c5ed2e cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+454f5

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  521ea035

FAILURE_BUCKET_ID:  X64_0x1a_41287_nt!_??_::FNODOBFM::_string_+454f5

BUCKET_ID:  X64_0x1a_41287_nt!_??_::FNODOBFM::_string_+454f5

Followup: MachineOwner
---------

frienderman · 03 Nov 2013

I ran memtest overnight, and it went through 10 passes with no errors. Now when I startup my pc and log in to my account, it blue screens instantly, giving me the same errors.

Arc · 03 Nov 2013

Enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

Tip

If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any.

frienderman · 03 Nov 2013

Ill try my best to get into the computer to enable it, after running memtest I haven't been able to get to my desktop without it blue screening.

Arc · 03 Nov 2013

Boot to System Recovery Options . Try Safe Mode with Command Prompt. In the command prompt .... enter the command ....

start msconfig

It will open the system configuration window, with the "general" tab selected.

Click the "startup" tab. Click "Disable all" > Apply > OK.
Click on "services" tab. Check the "Hide all Microsoft Services"; Click "Disable all" > Apply > OK

Then try to boot again normally. Is it failing still?

If so, boot to System Recovery Options once again. Try Enable Boot Logging. It will create a file named ntbtlog.txt. Collect it and upload it. If you cannot do it within windows, Boot with a live Linux disc and collect it in a USB stick, use the usb stick in another computer and upload it. It is necessary.

frienderman · 03 Nov 2013

I was able to enable driver verifier using the msconfig stuff, so now ill have it running. Where will the dump files go from driver verifier if it does crash?

frienderman · 03 Nov 2013

Here is the dump file that came from the verifier BSOD

Arc · 04 Nov 2013

It indicates that drivers are not causing that issue.

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41287, 70001082f28, 0, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+454f5 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041287, An illegal page fault occurred while holding working set synchronization.
    Parameter 2 contains the referenced virtual address.
Arg2: 0000070001082f28
Arg3: 0000000000000000
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41287

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff880076db6a0 -- (.trap 0xfffff880076db6a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff70001080488 rbx=0000000000000000 rcx=0000058000000000
rdx=00000000ffffffff rsi=0000000000000000 rdi=0000000000000000
rip=fffff800028bff61 rsp=fffff880076db830 rbp=000007fefc0d1000
 r8=0000000fffffffff  r9=0000000000000554 r10=000007fefc0d1000
r11=fffff70001080000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
nt!MiDeleteVirtualAddresses+0x559:
fffff800`028bff61 4a891cf8        mov     qword ptr [rax+r15*8],rbx ds:fffff700`01080488=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002827d2e to fffff8000288ebc0

STACK_TEXT:  
fffff880`076db538 fffff800`02827d2e : 00000000`0000001a 00000000`00041287 00000700`01082f28 00000000`00000000 : nt!KeBugCheckEx
fffff880`076db540 fffff800`0288ccee : 00000000`00000001 00000700`01082f28 00000000`00000000 000007fe`fc0d1008 : nt! ?? ::FNODOBFM::`string'+0x454f5
fffff880`076db6a0 fffff800`028bff61 : 00000000`247216b8 fffffa80`07119950 00000000`00000000 fffff800`02b9c606 : nt!KiPageFault+0x16e
fffff880`076db830 fffff800`028c17d9 : 00000000`00000000 000007fe`fc0ebfff fffffa80`00000000 fffff880`00961001 : nt!MiDeleteVirtualAddresses+0x559
fffff880`076db9f0 fffff800`02ba7631 : fffffa80`07119620 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0xd9
fffff880`076dbb10 fffff800`02ba7a33 : 00000000`00000000 000007fe`fc0c0000 fffffa80`00000001 fffffa80`071196b0 : nt!MiUnmapViewOfSection+0x1b1
fffff880`076dbbd0 fffff800`0288de53 : 00000000`00000000 000007fe`fc0d0578 fffffa80`067c94d0 00000000`00000000 : nt!NtUnmapViewOfSection+0x5f
fffff880`076dbc20 00000000`770f155a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0167f528 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x770f155a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+454f5
fffff800`02827d2e cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+454f5

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  521ea035

FAILURE_BUCKET_ID:  X64_0x1a_41287_VRF_nt!_??_::FNODOBFM::_string_+454f5

BUCKET_ID:  X64_0x1a_41287_VRF_nt!_??_::FNODOBFM::_string_+454f5

Followup: MachineOwner
---------

If you are sure that memory is not the issue, then it is the motherboard that is causing the issues.

frienderman · 04 Nov 2013

I have new ram on the way, because I needed an upgrade anyway, so we'll see how that goes once I get it. Ill update after that, thank you for your help