BSOD MEMORY_MANAGEMENT ntoskrnl.exe

Hi newtoyou.

Uninstall Virtual Clone Drive.

Free up the startup. Windows does not need any other program to auto start with it, but the auto start programs often conflicts and causes various problems including BSODs.

1. Click on the Start button
2. Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window.
3. Select the “Startup” tab.
4. Deselect all items other than the antivirus.
5. Apply > OK
6. Accept then restart.

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

If it start showing errors/red lines, stop testing. A single error is enough to determine that something is going bad there.

If it does not show any error, enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

   Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

   Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

   Tip

• If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
• If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any.
_________________________________________________________________________________________

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa80017ded30, ffff, 0}

Probably caused by : win32k.sys ( win32k!SURFACE::bDeleteSurface+3c8 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, A page table page has been corrupted. On a 64 bit OS, parameter 2
    contains the address of the PFN for the corrupted page table page.
    On a 32 bit OS, parameter 2 contains a pointer to the number of used
    PTEs, and parameter 3 contains the number of used PTEs.
Arg2: fffffa80017ded30
Arg3: 000000000000ffff
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41790

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  chrome.exe

CURRENT_IRQL:  0

ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre

LAST_CONTROL_TRANSFER:  from fffff80003101d50 to fffff80003090bc0

STACK_TEXT:  
fffff880`0c7f91f8 fffff800`03101d50 : 00000000`0000001a 00000000`00041790 fffffa80`017ded30 00000000`0000ffff : nt!KeBugCheckEx
fffff880`0c7f9200 fffff800`0307d3df : fffffa80`00000000 00000000`27372fff 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x35084
fffff880`0c7f93c0 fffff800`0308fe53 : ffffffff`ffffffff fffff880`0c7f9690 fffff880`0c7f96f8 00000000`00008000 : nt!NtFreeVirtualMemory+0x61f
fffff880`0c7f94c0 fffff800`0308c410 : fffff960`001172e4 00000000`00000001 00000000`00000000 fffff900`c0158cc0 : nt!KiSystemServiceCopyEnd+0x13
fffff880`0c7f9658 fffff960`001172e4 : 00000000`00000001 00000000`00000000 fffff900`c0158cc0 00000000`00000001 : nt!KiServiceLinkage
fffff880`0c7f9660 fffff960`0011f599 : 00000000`00000000 fffff880`00000001 fffff900`c0158cc0 fffff900`00000000 : win32k!SURFACE::bDeleteSurface+0x3c8
fffff880`0c7f97b0 fffff960`00116b20 : 00000000`00001b0c fffff880`0c7f9c00 fffff900`c41a5a50 fffff960`00000000 : win32k!NtGdiCloseProcess+0x2c9
fffff880`0c7f9810 fffff960`00116267 : 00000000`00000000 fffff880`0c7f9c20 fffffa80`0fea0060 00000000`00000000 : win32k!GdiProcessCallout+0x200
fffff880`0c7f9890 fffff800`033650c1 : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`0fea0000 : win32k!W32pProcessCallout+0x6b
fffff880`0c7f98c0 fffff800`0334b2ed : 00000000`c0000005 00000000`101f7101 00000000`78457300 fffffa80`0eebeb50 : nt!PspExitThread+0x4d1
fffff880`0c7f99c0 fffff800`030836fa : fffffa80`0c3f07b0 00000000`00000000 60000000`0f795e20 fffff800`033ad301 : nt!PsExitSpecialApc+0x1d
fffff880`0c7f99f0 fffff800`03083a40 : 00000000`14ffe77c fffff880`0c7f9a70 fffff800`0334b260 00000000`00000001 : nt!KiDeliverApc+0x2ca
fffff880`0c7f9a70 fffff800`0308fef7 : fffffa80`0fea0060 fffff880`0c7f9ca0 fffffa80`0fea0060 fffff800`03387ce4 : nt!KiInitiateUserApc+0x70
fffff880`0c7f9bb0 00000000`002201af : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`11efe068 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x2201af


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!SURFACE::bDeleteSurface+3c8
fffff960`001172e4 e9b0010000      jmp     win32k!SURFACE::bDeleteSurface+0x57d (fffff960`00117499)

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  win32k!SURFACE::bDeleteSurface+3c8

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  529478c2

IMAGE_VERSION:  6.1.7601.18327

FAILURE_BUCKET_ID:  X64_0x1a_41790_win32k!SURFACE::bDeleteSurface+3c8

BUCKET_ID:  X64_0x1a_41790_win32k!SURFACE::bDeleteSurface+3c8

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_0x1a_41790_win32k!surface::bdeletesurface+3c8

FAILURE_ID_HASH:  {4b202a94-bff4-b673-28bd-c9545c784c67}

Followup: MachineOwner
---------