Solved Memory Management BSOD while surfing the internet - Win 7 64bit

[stg07]

Encountered memory management BSOD while surfing the internet yesterday.

According to the mini-dump file, the BSOD is caused by ntoskrnl.exe. All important Windows 7 updates have been installed (SP1 and all post-SP1 updates). My present HDD is a new one bought about 2 days ago, so this is my first BSOD for this HDD. A chkdsk repair was done today, but there seemed to be no reported errors.

 

[x BlueRobot]

Welcome to the forums stg07,

[COLOR="Red"]BugCheck 1A[/COLOR], {[COLOR="Blue"]41790[/COLOR], fffffa80008fa0f0, ffff, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+35084 )

Usual causes:  Device driver, memory, kernel

This bugcheck indicates that a serve memory management error has occurred, by looking at the first parameter, we can see that a page table page has become corrupt. The page table is used to store mappings between virtual and physical memory addresses.

Run Driver Verifier to scan for any corrupted drivers which may be causing problems, this program works by running various stress tests on drivers, in order to produce a BSOD which will locate the driver; run for least 24 hours:

• http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

   Information

Additional Help - http://www.sevenforums.com/crash-lo...-driver-verifier-identify-issues-drivers.html

• http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

Run Memtest86+ for least 9-10 passes, and preferably overnight as it can take a while to fully complete.

Test each RAM stick individually, if an error is found then move the same RAM stick into the next DIMM slot and test again, if errors are found for the same RAM stick in every available slot then you have a faulty RAM module. On the other hand, if no errors are found in the next slot or the other slots for the same RAM module, then you have a faulty DIMM slot.

Test each RAM stick and every motherboard DIMM slot available.

test|Slot1|Slot2
RAM1| Error | Error
RAM2|Good|Good

It is a RAM, a bad RAM.

But if you have got a result like that:

test|Slot1|Slot2
RAM1| Error |Good
RAM2| Error |Good

It is a motherboard issue. The particular slot is bad.

 

[stg07]

Hi x BlueRobot, thanks for the welcome and the easy to understand troubleshooting instructions.

Will go about doing the steps now. Get back to you later.

 

[stg07]

Hi, I got this BSOD right after enabling the driver verifier and rebooting the system.

"A driver has over-run a stack-based buffer. This over-run could potentially allow a malicious user to gain control of this machine"

After rebooting into Windows, I disabled driver verifier and zipped up the memory dump file. I will now go on to test the Ram sticks.

 

[x BlueRobot]

That's great, thanks for uploading the dump file, and here's the analysis:

[COLOR="Red"]BugCheck F7[/COLOR], {158, f880023318d8, ffff077ffdcce727, 0}

Probably caused by : [COLOR="Red"]lvrs64.sys[/COLOR] ( lvrs64+1972e )

Usual causes:  Device driver, Malware

The driver has written beyond the allocation for the stack buffer, and started to overwrite other memory addresses.

3: kd> [COLOR="SeaGreen"]lmvm lvrs64[/COLOR]
start             end                 module name
fffff880`022eb000 fffff880`0233f000   lvrs64   T (no symbols)           
    Loaded symbol image file: lvrs64.sys
    Image path: \SystemRoot\system32\DRIVERS\lvrs64.sys
    Image name: lvrs64.sys
    Timestamp:        [COLOR="red"]Fri Sep 21 20:02:17 2012 [/COLOR](505CB9B9)
    CheckSum:         000612AC
    ImageSize:        00054000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Your Logitech Camera driver seems to be causing the problem, please update the from driver from here - Logitech Support - Downloads, Manuals, FAQs & More

 

[stg07]

That's great, thanks for uploading the dump file, and here's the analysis:

Your Logitech Camera driver seems to be causing the problem, please update the from driver from here - Logitech Support - Downloads, Manuals, FAQs & More

According to the support website (and its OS auto-detection function), the latest driver available for Windows 7 is version 2.51 and that is what I've installed. Does this mean I need to uninstall?

By the way, there are no errors detected for all available ram sticks and memory slots after running Memtest+ for at least 10 passes.

There is one strange thing that I've noticed. For Slot 2, the ram setting for both ram sticks is detected as 200MHZ, DDR 400 whereas in Slot 1, the ram setting for both ram sticks is detected as 666MHZ, DDR 1333. Is this normal?

 

[x BlueRobot]

Are both RAM sticks the exact same?

Unfortunately, you will need to remove the driver for the device, unless there is a available driver to roll back to?

 

[stg07]

Are both RAM sticks the exact same?

Unfortunately, you will need to remove the driver for the device, unless there is a available driver to roll back to?

Sorry for the newbie question, by 'exact same', you are referring to? All I know is that each ram stick is 2gb in memory capacity.

Doesn't seem to have any available driver to roll back to according to Device Manager.

 

[x BlueRobot]

Check the Logitech website for any older drivers for the camera, if no other drivers are available, then you will need to remove the driver completely.

Are the clock frequencies and timings on the RAM the exact same? They should be written on the RAM sticks.

Download CPU-z and then post the two screenshots for your system, for the SPD tab, post both DIMM slots. Here's how to upload the screenshots - http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html

Here's my system as an example -

View attachment 275346

View attachment 275347

 

[stg07]

Here are the CPU-Z screenshots of my system:

Slot 1
View attachment 275644

Slot 2
View attachment 275645

 

[x BlueRobot]

The timings look fine, and it's normal for the clock frequencies to be detected as half the amount printed on the RAM stick.

 

[stg07]

The timings look fine, and it's normal for the clock frequencies to be detected as half the amount printed on the RAM stick.

I see. At least now I don't have to worry that there is anything wrong with my Ram sticks. It makes me wonder what it was really that caused the memory management BSOD.

 

[x BlueRobot]

The driver started writing into memory address spaces which wasn't allocated to it, and therefore corrupted the number of PTEs within the page table.

Looking back over the first dump file, we can see that the reference count for the number of used PTEs has dropped below zero:

0: kd> [COLOR=SeaGreen]dt nt!_MMPFN fffffa80008fa0f0[/COLOR]
   +0x000 u1               : <unnamed-tag>
   +0x008 u2               : <unnamed-tag>
   +0x010 PteAddress       : 0xfffff6fb`40000bc8 _MMPTE
   +0x010 VolatilePteAddress : 0xfffff6fb`40000bc8 Void
   +0x010 Lock             : 0n1073744840
   +0x010 PteLong          : 0xfffff6fb`40000bc8
   +0x018 u3               : <unnamed-tag>
   [COLOR=Red]+0x01c UsedPageTableEntries : 0xffff[/COLOR] <-- Parameter 3
   +0x01e VaType           : 0 ''
   +0x01f ViewCount        : 0 ''
   +0x020 OriginalPte      : _MMPTE
   +0x020 AweReferenceCount : 0n128
   +0x028 u4               : <unnamed-tag>

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, A page table page has been corrupted. On a 64 bit OS, parameter 2
    contains the address of the PFN for the corrupted page table page.
    On a 32 bit OS, parameter 2 contains a pointer to the number of used
    PTEs, and parameter 3 contains the number of used PTEs.
Arg2: fffffa80008fa0f0
Arg3: 000000000000ffff
Arg4: 0000000000000000

 

[stg07]

Thanks for the patient explanation. I'm in a dilemma as to whether to uninstall the logitech driver since I don't have any alternative driver to fall back on. So far the PC doesn't give me any BSOD after that. Will Windows 7 provide a suitable driver for this if I were to uninstall the logitech driver?

 

[x BlueRobot]

I doubt it would, but you could try it and see if it auto-configures a generic Windows driver.

 

[stg07]

Straight after I uninstalled the Logitech webcam driver, Windows automatically installed drivers for it and the webcam is shown as 'USB composite device' under Devices and Printers.

 

[x BlueRobot]

That's good, does the webcam still work?

 

[stg07]

Sorry for the late reply. Seemed that the webcam is working fine.

 

[x BlueRobot]

That's great, have you had any other issues? Otherwise, you may mark this thread as solved

 

[stg07]

Hi, I'm back here again because I have just got a memory management BSOD after the first one seemed to be somehow solved (as such I am now marking it as unsolved). The culprit seems to be the same - ntoskrnl.exe. If there is a need for me to start a new thread, please let me know.