BSOD during general system use, error KERNEL_DATA_INPAGE_ERROR

redroar · 08 Feb 2015

Around 6 months ago I replaced my computer hard drives for additional storage and speed. At some point I started getting BSODs with the error message KERNEL_DATA_INPAGE_ERROR. These errors occur whilst gaming, watching video or generally browsing the web. They may have started before the HDD replacement, to be honest I can't remember.

The timing of them seems somewhat random - they can appear after an hour of usage or several days. I frequently run my computer overnight, sometimes for days on end, without receiving a BSOD, only then to get two in a day.

I've tried numerous solutions including removing one of the drives (I've got two, an SSD and a regular), and just using the other, formatting Windows, switching around HDD cables, running virus scans and more. Nothing seems to make a difference.

I've run numerous CHKDSK scans, without finding anything, and I don't think the drives are failing, they are pretty new.

After some research into this error, the two likeliest causes for my problem seems to be either a faulty driver or faulty HDD. I'd rather not deal with the hassle of backing up and returning my HDD's and I'm not sure which driver to update, so I'd appreciate any help in tracking the error down.

I've filled in my system specs and attached the "DM Log Collector" files. Any help in resolving this issue is greatly appreciated.

ICIT2LOL · 08 Feb 2015

Hello and welcome Hugh now mate I am just a beginner at this dump stuff but I do see memory corruption and disk problems so I would suggest you run two tests one for the RAM and one for the drive/

The memtest you will need to make a bootable disk / stick and set the BIOS to boot from the optical and it will take a fair time to run- some leave it overnight. see the attached document.
But one thing is very important you must let the test run for at least 8 passes any less and the findings are no good. Now if errors come up straight away then you can stop it - see my pics. Now if there are errors and you have more than one stick of RAM in then you will need to test each stick ie remove the sticks and replace stick 1 in slot 1 and test no errors do the same in slot 2 with stick 1 no errors then repeat the process with stick 2 - that will show up the faulty stick - the other thing is it could be a faulty slot but most unusual.
It is a very lengthy and tedious process but worth it if you have errors.

The drive is easier to do just use this SeaTools for Windows | Seagate it does not take anywhere near what the memtest does

redroar · 11 Feb 2015

Hi ICIT2LOL, thanks for your reply.

I ran Memtest86 overnight then during the day. It completed 13 passes with no errors. As for SeaTools, which tests should I run? I tried Basic Short Generic on both and they passed fine.

Thanks

ICIT2LOL · 11 Feb 2015

Hmm one last drive test you could run just eliminate a cause there is a surface test with Partition Wizard
MiniTool Free Partition Manager for Window 8/7/vista/xp | Partition Wizard Free Edition see pic for that. It will show up any physical damage or surface imperfections as well as show up any problems with the actuating arms and read / write heads.
It takes a while and is usually clear but I still do them when not sure about physical condition of the drive.

redroar · 11 Feb 2015

Hi ICIT2LOL,

I ran the test on both drives, and both reported no errors.

Thanks

ICIT2LOL · 12 Feb 2015

OK I have done a bit more looking around and most of the hits for that error came up with a problem of access to memory and there being a link to a hard drive issue and these were recommended - I was going to suggest them anyway as matter of elimination
https://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html
https://www.sevenforums.com/tutorials/433-disk-check.html < if necessary include the /f and /r in the command line as per Option2

redroar · 12 Feb 2015

Hi ICIT2LOL,

So as I said in my first post, I've run chkdsk before, found nothing. The other scan did apparently find some corrupt Windows files, although what it repaired I can't tell - the log is like 200MB and almost crashes notepad opening it. Opening it with Notepad++, there's a lot to look through. Here's a section:

POQ 129 ends.
2015-02-12 19:20:10, Info CSI 000004df [SR] Verify complete
2015-02-12 19:20:10, Info CSI 000004e0 [SR] Verifying 100 (0x0000000000000064) components
2015-02-12 19:20:10, Info CSI 000004e1 [SR] Beginning Verify and Repair transaction
2015-02-12 19:20:11, Info CSI 000004e2 Repair results created:
POQ 130 starts:
0: Move File: Source = [l:192{96}]"\SystemRoot\WinSxS\Temp\PendingRenames\06a56eebf846d001523a00004801700b._0000000000000000.cdf-ms", Destination = [l:104{52}]"\SystemRoot\WinSxS\FileMaps\_0000000000000000.cdf-ms"
1: Move File: Source = [l:162{81}]"\SystemRoot\WinSxS\Temp\PendingRenames\16cc6eebf846d001533a00004801700b.$$.cdf-ms", Destination = [l:74{37}]"\SystemRoot\WinSxS\FileMaps\$$.cdf-ms"
2: Move File: Source = [l:224{112}]"\SystemRoot\WinSxS\Temp\PendingRenames\27f36eebf846d001543a00004801700b.$$_microsoft.net_3296b36dbe 4c7fa3.cdf-ms", Destination = [l:136{68}]"\SystemRoot\WinSxS\FileMaps\$$_microsoft.net_3296b36dbe4c7fa3.cdf-ms"
3: Move File: Source = [l:244{122}]"\SystemRoot\WinSxS\Temp\PendingRenames\27f36eebf846d001553a00004801700b.$$_microsoft.net_framework_ 83386eac0379231b.cdf-ms", Destination = [l:156{78}]"\SystemRoot\WinSxS\FileMaps\$$_microsoft.net_framework_83386eac0379231b.cdf-ms"
4: Move File: Source = [l:266{133}]"\SystemRoot\WinSxS\Temp\PendingRenames\48416febf846d001563a00004801700b.$$_microsoft.net_framework_ v2.0.50727_e9368840261e60ee.cdf-ms", Destination = [l:178{89}]"\SystemRoot\WinSxS\FileMaps\$$_microsoft.net_framework_v2.0.50727_e9368840261e60ee.cdf-ms"
5: Move File: Source = [l:288{144}]"\SystemRoot\WinSxS\Temp\PendingRenames\59686febf846d001573a00004801700b.$$_microsoft.net_framework_ v2.0.50727_redistlist_2e6ab8b35e9ef953.cdf-ms", Destination = [l:200{100}]"\SystemRoot\WinSxS\FileMaps\$$_microsoft.net_framework_v2.0.50727_redistlist_2e6ab8b35e9ef953.c df-ms"

POQ 130 ends.
2015-02-12 19:20:11, Info CSI 000004e3 [SR] Verify complete
2015-02-12 19:20:11, Info CSI 000004e4 [SR] Verifying 100 (0x0000000000000064) components
2015-02-12 19:20:11, Info CSI 000004e5 [SR] Beginning Verify and Repair transaction
2015-02-12 19:20:12, Info CSI 000004e6 Repair results created:
POQ 131 starts:

POQ 131 ends.
2015-02-12 19:20:12, Info CSI 000004e7 [SR] Verify complete
2015-02-12 19:20:12, Info CSI 000004e8 [SR] Verifying 100 (0x0000000000000064) components
2015-02-12 19:20:12, Info CSI 000004e9 [SR] Beginning Verify and Repair transaction
2015-02-12 19:20:13, Info CSI 000004ea Repair results created:
POQ 132 starts:

POQ 132 ends.
2015-02-12 19:20:13, Info CSI 000004eb [SR] Verify complete
2015-02-12 19:20:13, Info CSI 000004ec [SR] Verifying 40 (0x0000000000000028) components
2015-02-12 19:20:13, Info CSI 000004ed [SR] Beginning Verify and Repair transaction
2015-02-12 19:20:13, Info CSI 000004ee Repair results created:
POQ 133 starts:

POQ 133 ends.
2015-02-12 19:20:13, Info CSI 000004ef [SR] Verify complete
2015-02-12 19:20:13, Info CSI 000004f0 [SR] Repairing 2 components
2015-02-12 19:20:13, Info CSI 000004f1 [SR] Beginning Verify and Repair transaction
2015-02-12 19:20:13, Info CSI 000004f2 Hashes for file member \??\C:\Windows\System32\Utilman.exe do not match actual file [l:22{11}]"Utilman.exe" :
Found: {l:32 b:PJ/ZYCZLr7R0VkowmSLoDCxfhw80xjIpENVnsHo9Jew=} Expected: {l:32 b:fKkGFuaLyFHxRlijZtgPId23p92KhmBJ5UZRFYeEqeo=}
2015-02-12 19:20:13, Info CSI 000004f3 [SR] Repairing corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:22{11}]"Utilman.exe" from store
2015-02-12 19:20:13, Info CSI 000004f4 Hashes for file member \??\C:\Windows\Branding\Basebrd\basebrd.dll do not match actual file [l:22{11}]"basebrd.dll" :
Found: {l:32 b:Y6uLQT9xn3Tpe0ltc4CxCs7SjYlavclra0kwECNmkzE=} Expected: {l:32 b:1/rvSBIH01hJr4Vx0JqwAqyvKh5qd72PvSzwCL34M4Y=}
2015-02-12 19:20:13, Info CSI 000004f5 [SR] Repairing corrupted file [ml:520{260},l:62{31}]"\??\C:\Windows\Branding\Basebrd"\[l:22{11}]"basebrd.dll" from store
2015-02-12 19:20:13, Info CSI 000004f6 Ignoring duplicate ownership for directory [l:62{31}]"\??\C:\Windows\Branding\Basebrd" in component Microsoft-Windows-Branding-Base-HomePremium, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral

2015-02-12 19:20:13, Info CSI 000004f7 Repair results created:
POQ 134 starts:
0: Move File: Source = [l:192{96}]"\SystemRoot\WinSxS\Temp\PendingRenames\2df5d2ecf846d001483b00004801700b._0000000000000000.cdf-ms", Destination = [l:104{52}]"\SystemRoot\WinSxS\FileMaps\_0000000000000000.cdf-ms"
1: Move File: Source = [l:162{81}]"\SystemRoot\WinSxS\Temp\PendingRenames\2df5d2ecf846d001493b00004801700b.$$.cdf-ms", Destination = [l:74{37}]"\SystemRoot\WinSxS\FileMaps\$$.cdf-ms"
2: Move File: Source = [l:214{107}]"\SystemRoot\WinSxS\Temp\PendingRenames\2fb0d7ecf846d0014a3b00004801700b.$$_system32_21f9a9c4a2f8b51 4.cdf-ms", Destination = [l:126{63}]"\SystemRoot\WinSxS\FileMaps\$$_system32_21f9a9c4a2f8b514.cdf-ms"
3: Hard Link File: Source = [l:232{116}]"\SystemRoot\WinSxS\amd64_microsoft-windows-utilman_31bf3856ad364e35_6.1.7600.16385_none_5e9ea1964aee5579\Utilman.exe", Destination = [l:70{35}]"\??\C:\Windows\System32\Utilman.exe"
4: Move File: Source = [l:214{107}]"\SystemRoot\WinSxS\Temp\PendingRenames\d536d9ecf846d0014b3b00004801700b.$$_branding_1728f5d8b15e526 3.cdf-ms", Destination = [l:126{63}]"\SystemRoot\WinSxS\FileMaps\$$_branding_1728f5d8b15e5263.cdf-ms"
5: Move File: Source = [l:230{115}]"\SystemRoot\WinSxS\Temp\PendingRenames\e55dd9ecf846d0014c3b00004801700b.$$_branding_basebrd_9ee9a17 6c9fadab4.cdf-ms", Destination = [l:142{71}]"\SystemRoot\WinSxS\FileMaps\$$_branding_basebrd_9ee9a176c9fadab4.cdf-ms"
6: Hard Link File: Source = [l:262{131}]"\SystemRoot\WinSxS\amd64_microsoft-windows-b..ng-base-homepremium_31bf3856ad364e35_6.1.7600.16385_none_7de3f055667d5adf\basebrd.dll", Destination = [l:86{43}]"\??\C:\Windows\Branding\Basebrd\basebrd.dll"

POQ 134 ends.
2015-02-12 19:20:13, Info CSI 000004f8 [SR] Repair complete
2015-02-12 19:20:13, Info CSI 000004f9 [SR] Committing transaction
2015-02-12 19:20:13, Info CSI 000004fa Creating NT transaction (seq 2), objectname [6]"(null)"
2015-02-12 19:20:13, Info CSI 000004fb Created NT transaction (seq 2) result 0x00000000, handle @0x19a0
2015-02-12 19:20:13, Info CSI 000004fc@2015/2/12:19:20:13.347 CSI perf trace:
CSIPERF:TXCOMMIT;15557
2015-02-12 19:20:13, Info CSI 000004fd [SR] Verify and Repair Transaction completed. All files and registry keys listed in this transaction have been successfully repaired

ICIT2LOL · 12 Feb 2015

Ok mate now I keep coming up with crss.exe as a possible problem and as you can see in this thread Is csrss.exe a trojan? it is a critical Windows process but also can be malware so lets run these and also that suggestion post # 4 and in post #5 have a look in your system as per that suggestion.

These are ones I usally ask folk to start with if you have doe them already then don't worry
http://www.superantispyware.com/
http://www.malwarebytes.org/products/malwarebytes_free/
http://www.bleepingcomputer.com/download/adwcleaner/
ADW download from bleeping computer delete any rubbish found with the malware scans
(with ADW if you are running Kaspersky it will throw it up as malware just override Kaspersky)

redroar · 13 Feb 2015

Malware Bytes found one unrelated file (which I think is a false positive). Nothing about crss.exe.

ICIT2LOL · 13 Feb 2015

OK Red lets try something else run this an scroll down and see if there are two "csrss.exe" in the listing because everything is pointing to there only having to be one.

Now if there are two it might be a bit sorting out of which is the right one and which is the Trojan I am not thinking there will be just eliminating as we go.
https://technet.microsoft.com/en-us/...rnals/bb896653 < it is ok to go if your security pops up any warnings as it is from a genuine source.