Solved Random BSODs, MEMORY_MANAGEMENT, ntoskrnl.exe

[jonnyb]

Hello,

I was hoping someone could help me with a recurring BSOD issue. There doesn't seem to be any pattern as to when they occur; sometimes it will be a month in between instances, othertimes a day or a week. I've followed the instructions here:

http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html

and have attached a zip folder with all requested details. Please let me know if there is more information that would be helpful.

-Win7 64bit OEM
-Hardware and OS new in 9/2010

 

[JMH]

These crashes were caused by memory management, probably by Broker.exe {AmiBroker for Win32 is a process file from company AmiBroker.com}

Please run these two tests to verify your memory and find which driver is causing the problem.

If you are overclocking anything reset to default before running these tests.
In other words STOP!!!


1-Memtest.

*Download a copy of Memtest86 and burn the ISO to a CD using Iso Recorder or another ISO burning program. Memtest86+ - Advanced Memory Diagnostic Tool

*Boot from the CD, and leave it running for at least 5 or 6 passes.

Just remember, any time Memtest reports errors, it can be either bad RAM or a bad motherboard slot.

Test the sticks individually, and if you find a good one, test it in all slots.

Any errors are indicative of a memory problem.

If a known good stick fails in a motherboard slot it is probably the slot.

http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html



2-Driver verifier

I'd suggest that you first backup your data and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Win7 Startup Repair feature).

In Windows 7 you can make a Startup Repair disk by going to Start....All Programs...Maintenance...Create a System Repair Disc - with Windows Vista you'll have to use your installation disk or the "Repair your computer" option at the top of the Safe Mode menu .

Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out. If it doesn't crash for you, then let it run for at least 36 hours of continuous operation (an estimate on my part).

If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.

http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html


Further Reading
Using Driver Verifier to identify issues with Windows drivers for advanced users


Note Avast was also involved.
Avast is sometimes a contributing cause of BSOD'S .
Please remove and replace it with Microsoft Security Essentials AT LEAST TO TEST

http://files.avast.com/files/eng/aswclear5.exe

Microsoft Security Essentials - Free Antivirus for Windows

 

[jonnyb]

Thanks very much for the help JMH. One question on the memtest...I've run already memtest86+ for 49 hours without error, however, I didn't use one stick at a time (I kept all of them in there). Do you think it needs to be re-run with one stick at a time or am I okay?

 

[JMH]

jonnyb,
No need to re run Memtest...
That is enough.

Just noted you have AVG.
AVG is sometimes a contributing cause of BSOD'S.
Please remove and replace with Microsoft Security Essentials AT LEAST TO TEST

Download tools and utilities | AVG Worldwide

Microsoft Security Essentials - Free Antivirus for Windows

 

[winstontj]

jonnyb,
No need to re run Memtest...
That is enough.

Just noted you have AVG.
AVG is sometimes a contributing cause of BSOD'S.
Please remove and replace with Microsoft Security Essentials AT LEAST TO TEST

Download tools and utilities | AVG Worldwide

Microsoft Security Essentials - Free Antivirus for Windows

+1 to MSE

 

[jonnyb]

Thanks guys for the MSE recommendations. I had removed AVG months ago and had just replaced Avast with MSE minutes before posting here last night. MSE only now.

I followed the Driver Verifier instruction you posted JMH, and got a BSOD as the computer was restarting. I'm using the machine now, so it hasn't happened a second time...but I figured that attaching a new set of dump files was what you would recommend. Please let me know if that's not the case, or if there's anything I should be doing?

 

[zigzag3143]

Thanks guys for the MSE recommendations. I had removed AVG months ago and had just replaced Avast with MSE minutes before posting here last night. MSE only now.

I followed the Driver Verifier instruction you posted JMH, and got a BSOD as the computer was restarting. I'm using the machine now, so it hasn't happened a second time...but I figured that attaching a new set of dump files was what you would recommend. Please let me know if that's not the case, or if there's anything I should be doing?

driver verified and Related to RTKVHD64.sys NVIDIA GeForce 9500M GS.


EDIT: AS POINTED OUT THIS IS NOT AN NVIDIA DRIVER BUT REALTEK. Thanks to Perigrine for the heads up.



The driver is of course a realtek audio driver and should be re-installed.

 

[jonnyb]

Thanks Zigzag.

After using Driver Sweeper, is there a recommended source/method to download the new driver, or do I just let Windows take care of it? I currently have Windows set to automatically update my drivers - will it just reinstall the same faulty driver again?

 

[Peregrine]

driver verified and Related to RTKVHD64.sys NVIDIA GeForce 9500M GS.

Pardon the interruption, I've been watching this thread as part of my own desire to learn more about debugging and crash analysis. My question is: Isn't this the Realtec sound driver? Or is it related back to the video driver because it includes HDMI output?

Thanks.

 

[zigzag3143]

driver verified and Related to RTKVHD64.sys NVIDIA GeForce 9500M GS.

Pardon the interruption, I've been watching this thread as part of my own desire to learn more about debugging and crash analysis. My question is: Isn't this the Realtec sound driver? Or is it related back to the video driver because it includes HDMI output?

Thanks.

You are absolutely correct and thank you for pointing it out. Thats what happens when you get too little sleep and rely on a database. It always pays to have a second set of eyes.


+ Rep

 

[jonnyb]

driver verified and Related to RTKVHD64.sys NVIDIA GeForce 9500M GS. Re-install using these instructions

Apologies if I'm overlooking it Zigzag, but I can't seem to find the instructions for re-installing??

 

[GianniDPC]

driver verified and Related to RTKVHD64.sys NVIDIA GeForce 9500M GS. Re-install using these instructions

Apologies if I'm overlooking it Zigzag, but I can't seem to find the instructions for re-installing??

If it is your realtek driver just update it: Download Realtek High Definition Audio 2.67 Vista 64 - FileHippo.com (maybe the bsod goes away )

 

[zigzag3143]

driver verified and Related to RTKVHD64.sys NVIDIA GeForce 9500M GS. Re-install using these instructions

Apologies if I'm overlooking it Zigzag, but I can't seem to find the instructions for re-installing??

Again my apologies. The instructions were for a graphic driver re-install where you need to remove all of it it before installing the new one.


With your audio driver simply download and install it.

 

[jonnyb]

Again my apologies. The instructions were for a graphic driver re-install where you need to remove all of it it before installing the new one.


With your audio driver simply download and install it.

I see Gianni posted the link (thank you), but my question (for future reference) was aimed at how to properly determine which exact driver/version/etc. that I need and where to go to download it from? I had Windows do it automatically, but how do I know that it got it right?

 

[zigzag3143]

Again my apologies. The instructions were for a graphic driver re-install where you need to remove all of it it before installing the new one.


With your audio driver simply download and install it.

I see Gianni posted the link (thank you), but my question (for future reference) was aimed at how to properly determine which exact driver/version/etc. that I need and where to go to download it from? I had Windows do it automatically, but how do I know that it got it right?

Generally speaking drivers should have a date of July 13, 2009 or later (win 7 release date) or be installed in compatibility mode.

We dont recommend you have win 7 doing it for you as the driver in its store may not be the newest and have the most recent bug fixes.


How To Find Drivers:

- search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- visit the web site of the manufacturer of the hardware/program to get the latest drivers (DON'T use Windows Update or the Update driver function of Device Manager).
- if there are difficulties in locating them, post back with questions and someone will try and help you locate the appropriate program.

- - The most common drivers are listed on this page: Driver Reference Driver Reference
- - Driver manufacturer links are on this page: Drivers and Downloads

 

[jonnyb]

I updated the realtek driver but unfortunately the BSOD came back tonight. New files are attached. Should I run driver verifier again or is it possible to tell from these files what caused it?

 

[Dave76]

Can you fill in your system specs?
Look for "My System Specs" in the lower left corner of any of your posts.
You can use these tools to find your system details.
System Info - See Your System Specs
Or you can download this free utility and find your system information: Speccy Free System information Utility


Seems that you have 24GB RAM, I'll need more information to look at this.

When you run memtest86+ you are looking for bad RAM cards, bad motherboard slots, so you need to follow the testing procedure in the tutorial.
Sometimes errors from these tests can be corrected by adjusting the settings.
RAM - Test with Memtest86+

Can you download CPUZ and post a snip of the CPU, Mainboard, Memory, and SPD tabs.
For posting the information , enter 'Snipping tool' in the Start button > Search box, hit enter. Select the area you want to post and save to a convenient place.
How to Post a Screenshot in Seven Forums

Have you been checking your temperatures?
Use Real Temp , to check the CPU temps when at idle, under load and/or testing.
Let us know the minimum and maximum temps you get.
Go to your BIOS and tell us what the CPU, RAM and the CPU integrated memory controller voltages are.
These voltages are very important, will need this information to continue.


Your last BSoD is 0x0000001A: MEMORY_MANAGEMENT
Usual causes: Device driver, memory, kernel
This indicates that a severe memory management error occurred.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041284, A PTE or the working set list is corrupt.
Arg2: 0000000330f78001
Arg3: 00000000001b74e8
Arg4: fffff70001080000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41284

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  Broker.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002d285a7 to fffff80002cd0c40

STACK_TEXT:  
fffff880`0a334918 fffff800`02d285a7 : 00000000`0000001a 00000000`00041284 00000003`30f78001 00000000`001b74e8 : nt!KeBugCheckEx
fffff880`0a334920 fffff800`02d02c80 : fffff700`01080000 ce800003`ab166867 c6c00004`a6161c66 00000000`000006f8 : nt! ?? ::FNODOBFM::`string'+0x4ac3
fffff880`0a334960 fffff800`02cbe0ff : fffffa80`00000000 00000003`3386bfff 00000003`00000000 00000000`00000000 : nt!MiDeleteVirtualAddresses+0x4e8
fffff880`0a334b20 fffff800`02ccfed3 : ffffffff`ffffffff 00000000`0022f690 00000000`0022f658 00000000`00008000 : nt!NtFreeVirtualMemory+0x61f
fffff880`0a334c20 00000000`770914fa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0022f5c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x770914fa


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+4ac3
fffff800`02d285a7 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+4ac3

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0x1a_41284_nt!_??_::FNODOBFM::_string_+4ac3

BUCKET_ID:  X64_0x1a_41284_nt!_??_::FNODOBFM::_string_+4ac3

Followup: MachineOwner
---------

Out of date drivers, Find new driver versions for these drivers.

lmimirr.sys  Wed Apr 11 06:32:45 2007 (461C108D)
LMIRfsDriver.sys Tue Jul 15 00:26:56 2008
RaInfo.sys   Sat Jan 05 02:57:14 2008

lmimirr.sys
RemotelyAnywhere Mirror Miniport Driver or LogMeIn Mirror Miniport Driver
https://secure.logmein.com/US/home.aspx

LMIRfsDriver.sys
RemotelyAnywhere Mirror Miniport Driver or LogMeIn Mirror Miniport Driver
https://secure.logmein.com/US/home.aspx

RaInfo.sys
LogMeIn/RemotelyAnywhere Kernel Information Provider
http://www.remotelyanywhere.com/template.asp?page=documentation

System event log information.
Have you installed all of the MS updates?

Event[3085]:
  Log Name: System
  Source: Microsoft Antimalware
  Date: 2011-12-22T18:53:37.000
  Event ID: 3002
  Task: N/A
  Level: Error
  Opcode: Info
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: Benjamin-PC
  Description: 
Microsoft Antimalware Real-Time Protection feature has encountered an error and failed.
 	Feature: Behavior Monitoring
 	Error Code: 0x80004005
 	Error description: Unspecified error 
 	Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.

Update The MS Essentials definition base from MS update.

Event[3143]:
  Log Name: System
  Source: Microsoft-Windows-WER-SystemErrorReporting
  Date: 2011-12-22T18:53:17.000
  Event ID: 1001
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: Benjamin-PC
  Description: 
The computer has rebooted from a bugcheck.  The bugcheck was: 0x000000d5 (0xfffff9800b9e4d60, 0x0000000000000000, 0xfffff8800731275a, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 122211-17082-01.

STOP 0x000000D5: DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL
Usual causes: Device driver
Update the old drivers listed above, or uninstall the program for testing.


Application event logs:

Event[53]:
  Log Name: Application
  Source: SideBySide
  Date: 2011-12-26T00:30:41.000
  Event ID: 72
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: Benjamin-PC
  Description: 
Activation context generation failed for "c:\program files\microsoft security client\MSESysprep.dll".Error in manifest or policy file "c:\program files\microsoft security client\MSESysprep.dll" on line 10. The element imaging appears as a child of element urn:schemas-microsoft-com:asm.v1^assembly which is not supported by this version of Windows.

 

[jonnyb]

Dave- Thanks for taking the time with that post, much appreciated. Unfortunately my hotmail account was hacked and I spent the day the dealing with that. I am going to follow everything you laid out and provide the information requested tomorrow. In the meantime, I thought I'd ask what feels like an obviously stupid question: Is there anything in the zip files that I'm posting here that could be jeopardizing my security? Just thought I'd ask since I've never had any kind of virus/hacking issues before.

Again, really appreciate everyone's help thus far.

 

[Dave76]

There is a lot of system info and logs but, no user information or passwords in the zip file.

So, no that kind of information wouldn't be coming from those files.

Post back with the information when you have the time.

 

[jonnyb]

Okay, I think I've made some progress:

1. System specs are updated - please let me know if anything else would be useful to you.

2. Memtest86+: After an earlier BS (approx 1 month ago), I ran this for 49 hours straight with no errors (although as mentioned earlier in the thread, I had all RAM sticks in at once).

3. CPU-z: CPU, Mainboard, Memory, and SPD snips are attached

4. RealTemp: I've downloaded the program but from a quick look at the docs it seems that there is a bit of a learning curve to this one. I will read through the documentation and figure out how to create idle, under load, and testing environments and then report the numbers.

5. Voltages from BIOS:

Main Screen:
-VCore: 1.248V
-DRAM Voltage: 1.520V

Advanced Voltage Settings (all set to Standard or Auto):
-CPU VCore: 1.28125V
-QPI/Vtt Voltage: 1.175V
-CPU PLL: 1.800V
-PCIE: 1.500V
-QPI PLL: 1.100V
-IOH Core: 1.100V
-ICH I/O: 1.500V
-ICH Core: 1.100V
-DRAM Voltage: 1.500V
-DRAM Termination: 0.750V
-Ch-A Data VRef: 0.750V
-Ch-B Data VRef: 0.750V
-Ch-C Data VRef: 0.750V
-Ch-A Address VRef: 0.750V
-Ch-B Address VRef: 0.750V
-Ch-C Address VRef: 0.750V

6. Out of date drivers: These are all related to the LogMeIn service. I spoke to their tech rep and was told that I could delete lmimirr.sys (which I did). He also told me that I have the most up to date versions of the other two as they come along with the LogMeIn installation/updates and my LogMeIn version is only 3 weeks old. Any more I should do here?

7. All MS and MSE updates should be installed.