BSOD - MEMORY_MANAGEMENT and PAGE_FAULT errors (x1A and x5) under load

[MagboneD]

I've been getting these two errors a lot lately. They always appear in the 0xFFFF FF## #### ##### block of memory. Running Memtest did not reveal anything, but that's not always reliable.

Seems more likely to occur when the computer is under load (like when I run Autodesk products) but, really, they will creep up any time.

I have an IT guy, but he's .... limited. I have some IT background myself, so I was hoping to get a little help.

I tried running the Seven Forums diagnostic tool but I ran into unhandled exceptions (see my post on the diag tool here: http://www.sevenforums.com/tutorials/92394-sf-diagnostic-tool-using-troubleshooting-16.html)

So, I ran some of the common diag tools and uploaded them in an attached zip with this post.

Any help is greatly appreciated.

Thanks.

 

[x BlueRobot]

[COLOR="Red"]BugCheck 1A[/COLOR], {41790, fffffa8003607f80, ffff, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+35084 )

Usual causes:  Device driver, memory, kernel

Scan for any missing, modified or corrupted protected Windows files with:

• http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

Remove:

Advanced SystemCare 5	c:\program files (x86)\iobit\advanced systemcare 5\asctray.exe

Windows 7 doesn't require any programs which make changes to the operating system and registry, these programs tend to cause problems by modifying and deleting files.

• http://www.sevenforums.com/performa...registry-cleaner-tests-why-not-use-one-2.html

Remove:

Start Menu\Programs\McAfee

McAfee is well known to cause BSODs with Windows 7, it's best to remove this program using the official McAfee Removal Tool.

Install and perform full scans with:

• Malwarebytes : Free anti-malware download
• Microsoft Security Essentials | Protect against viruses, spyware, and other malware

   Information

Remember to install the free version of Malwarebytes not the free trail; untick the free trial box during installation. MSE is the most lightweight and compatible with the Windows 7 operating system

   Note

Update all programs before scanning

You can also view this thread for a complete free and lightweight security protection combination:

• http://www.sevenforums.com/system-security/206705-good-free-system-security-combination.html

Remove:

Start Menu\Programs\DriverMax

These automatic driver updating programs usually install outdated and unstable drivers. The best method is to install drivers and check for updates from the manufacturer's website of that device.

 

[MagboneD]

Thanks for the help! Still having trouble....

SFC reports that it cannot repair one file (Full log for day of run is attached, excerpt of log shown below).


POQ 148 ends.
2013-04-20 19:25:52, Info CSI 00000357 [SR] Verify complete
2013-04-20 19:25:52, Info CSI 00000358 [SR] Repairing 3 components
2013-04-20 19:25:52, Info CSI 00000359 [SR] Beginning Verify and Repair transaction
2013-04-20 19:25:52, Info CSI 0000035a [SR] Cannot verify component files for da316fac2338731c065cc6a0e8152c83, Version = 6.1.7601.17535, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral, manifest is damaged (FALSE)
2013-04-20 19:25:52, Info CSI 0000035b Hashes for file member \??\C:\Windows\Help\mui\0409\diskmgt.CHM do not match actual file [l:22{11}]"diskmgt.CHM" :
Found: {l:32 b:Nm0jwXDzPg7+0Wb/lPzZrxe6KthUAbkrG2QotxzpUV8=} Expected: {l:32 b:Q04+9HaiDEqXWqWfSz15C0O1lwvdzRKc8OPWAuf17T4=}
2013-04-20 19:25:52, Info CSI 0000035c [SR] Repairing corrupted file [ml:520{260},l:56{28}]"\??\C:\Windows\Help\mui\0409"\[l:22{11}]"diskmgt.CHM" from store
2013-04-20 19:25:52, Info CSI 0000035d WARNING: File [l:22{11}]"diskmgt.CHM" in [l:56{28}]"\??\C:\Windows\Help\mui\0409" switching ownership
Old: Server-Help-CHM.diskm_v.Resources, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture = [l:10{5}]"en-US", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral
New: Server-Help-CHM.diskmgt.Resources, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture = [l:10{5}]"en-US", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral



The weird thing is, this is not a file name, but it looks like part of a Windows Update file name. I did a registry search for the corrupted file and got this key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_da316fac2338731c065cc6a0e8152c83_31bf3856ad364e35_none_7221e87d5886914b

Any idea what is going on here? All malware scans (TDSKiller, Malwarebytes, McAfee, etc) come up clean.

However, one odd thing I noticed is that my CCMEXEC.exe file is constantly trying to shut off McAfee. The version I have it 5.0.7804.1000. Online it appear this file should be around 1MB, but mine is 1.8MB. If this is a virus, why isn't it getting flagged by any malware scanners?

Thanks

 

[MagboneD]

Cbs log upload

Attached

 

[x BlueRobot]

ccmexec.exe and inventory.exe - what are they and what do they do? - Jonathan Hardwick - Site Home - MSDN Blogs

ccmexec.exe is a Windows file for updating software.

Have you tried running the same command again three separate times?

If SFC could not fix something, then run the command again to see if it may be able to the next time. Sometimes it may take running the sfc /scannow command 3 or more times to completely fix everything that it's able to.