BSOD - memory_management, please help

[Gnomicide]

Hello guys,

New to the board, but I just built a brand new PC and am having trouble with a pesky BSOD and cannot seem to locate the problem. That's when I stumbled across this forum.

Windows 7 Home Premium 64-bit
I assembled the system myself from NewEgg and have all the parts listed in my profile.

The relevant Zip documents are attached.

Thanks in advance!

 

[ttran]

Please run the tool in posting instruction as administrator. Otherwise, just simply upload all the content in minidump folder to us because I can't see any minidump files in the one you uploaded
upload the contents of your "\Windows\Minidump" folder. The procedure:

* Copy the contents of \Windows\Minidump to another (temporary) location somewhere on your machine.
* Zip up the copy.
* Start your own thread in the "Crashes and Debugging" section of the forum and attach the ZIP archive to your post using the "paperclip" (file attachments) button.
* Briefly describe the problem history and circumstances in the same post. Somebody will attend to your query as soon as possible.

Windows 7:
Go to Start and type in "sysdm.cpl" (without the quotes) and press Enter
Click on the Advanced tab
Click on the Startup and Recovery Settings button
Ensure that "Automatically restart" is unchecked
Under the Write Debugging Information header select "Small memory dump (64 kB)" in the dropdown box
Ensure that the Small Dump Directory is listed as "%systemroot%\Minidump" (without the quotes)
Click OK twice to exit the dialogs, then reboot for the changes to take effect.

If you are using any program such as CCleaner, they may clean out your minidump folder, please double check that

 

[Gnomicide]

Much apologies. I guess I missed running it as admin.

Here is the new files.

 

[ttran]

Hi and Welcome to SF!

Because it is new PC, it's always good to eliminate hardware cause:
Download a copy of Memtest86 and burn the ISO to a CD using Iso Recorder or another ISO burning program. Boot from the CD, and leave it running for at least 5 or 6 passes. (Exception code c000005)

Please enable driver Verifier:
http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

BUGCHECK SUMMARY:

BugCheck 1A, {41790, fffffa8000c812d0, ffff, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33946 )

Followup: MachineOwner
---------
PROCESS_NAME:  [I][COLOR=Red]MsMpEng.exe[/COLOR][/I]
BugCheck 3B, {c0000005, fffff960000e808f, fffff88003dcafd0, 0}

Probably caused by : win32k.sys ( win32k!xxxDestroyThreadInfo+6e7 )

Followup: MachineOwner
---------

Window Defender was the process running at the time of crash, try to disable it to see if it resolve the problem:
What is msmpeng.exe and how to remove it

Run system file check:

Open an elevated command prompt and enter sfc /scannow.

Let us know if you need help

Tuan

 

[Gnomicide]

Running that memory test right now. Looks like it takes a while to do a few passes.

Is this something I need to keep my eye on or does it save a log somewhere that I can post later?

 

[cluberti]

This crash happened because the system decremented the number of pte's in a page table, but the number was already 0 so there was an underflow to ffff, causing the bugcheck.

Driver verifier should be enabled doing DMA validation, as well as some memory manager changes so that the memory manager checks that a page is still zero before going to use a page from the zeroed list, to catch this:

Key:   HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
Value: PageValidationFrequency
Type:  REG_DWORD
Data:  1

Key:   HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
Value: PageValidationAction
Type:  REG_DWORD
Data:  1

Key:   HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
Value: VerifyMode
Type:  REG_DWORD
Data:  2

Open a command prompt, and type "verifier /flags 0x80 /all", and then reboot.

If you start getting bugchecks after that, post them here - I am pretty certain this is going to be a hardware problem, but a PAGE_NOT_ZERO bugcheck would tell us for certain one way or the other if we can capture it.

 

[Jonathan_King]

Running that memory test right now. Looks like it takes a while to do a few passes.

Is this something I need to keep my eye on or does it save a log somewhere that I can post later?

Don't worry about the SFC log.

Be sure to enable verifier: http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

 

[Gnomicide]

I found one major issue. The USB controller drivers were not correct for my Mobo. Windows installed some bogus drivers. I uninstalled them, and installed the Asus drivers off the website.

Not sure if that was the issue or not or could even cause a BSOD, but it's not fixed. Memtest ran 6 passes without any errors. Now updating a few more drivers.

 

[Gnomicide]

Ok, it started happening again, same one so I'm booting up a bunch of the rest of the suggestions right now.

 

[CarlTR6]

Have you enabled Driver Verifier? It will cause BSOD's when it stresses faulty drivers. Be sure to upload any BSOD's.

 

[Gnomicide]

I just did and my PC got about 3 different BSODs on restart and now is unbootable, so I'm trying to do a system restore.

 

[CarlTR6]

Did you try to boot in the safe mode?

 

[Gnomicide]

I did not, I did a system restore and am now booted in. Was that the incorrect thing to do?

 

[Gnomicide]

I'll enable it again and see if I can boot into safe mode.

 

[Gnomicide]

I enabled it again, but now it allowed me to boot in regular... now what?

 

[ttran]

Now wait for it to crash, then upload the new DMP file to us

 

[CarlTR6]

I did not, I did a system restore and am now booted in. Was that the incorrect thing to do?

No, that was not an incorrect thing to do. It worked and you can use your computer. The restore can negate the information in the uploaded dump files because your system has changed (somewhat); but that is no big deal. It was a good move.

 

[Gnomicide]

Here is the new dumps.

 

[CarlTR6]

There are 11 dumps just from today. This will take a little while; but I will be back.

 

[CarlTR6]

For now, please turn Driver Verifier off.

I have looked at five of the dumps and I will look at the rest. Four of the five dumps blamed Microsoft drivers as the cause. This is highly unlikely. One blamed CI.dll - ci.dll belongs to the software ci.dll or Alcohol 120% by Alcohol Soft Development Team. Uninstall this program using Revo (free) uninstaller.

I find the following out of date drivers:

GEARAspiWDM.sys Mon May 18 08:17:04 2009 - CDRom Class Filter Driver or Filter Driver for 2k and XP or CD/DVD Class Filter Driver or CD DVD Filter or GEAR ASPI Filter Driver belongs to the software GEAR.wrks or GEAR CDRom Filter or GEARAspi or GEARAspiWDM or Norton Ghost or MixMeister Studio Demo or MixMeister Pro or GEAR 32bit Driver Installer or MixMeister CD-R Drivers or Drive Image or Norton Save and Restore or CD DVD Filter or GearDrvs or iTunes or GEAR ASPI Filter Driver or GEAR driver installer for x by GEAR Software Inc (www.gearsoftware.com). I do not think there is an update for this driver. Let this one ride for the time being. If you know what software in this list you have installed, you can try to update the software.

scmndisp.sys Wed Jan 17 02:48:03 2007 - ® Neutral Wireless Solution, Netgear, Inc. This driver is really obsolete. I am not sure what it does. It appears to be a utility driver associated with a Netgear wireless adapater. I could not find an upgrade for the software; but maybe you can. If not, you can uninstall the utility or rename the driver from scmndisp.sys to scmndisp.bak. This way you can simply rename it back to .sys if necessary.

Take care of the above, reboot, and lets see what happens.