BSOD memory management issues caused by ntoskrnel.exe

Toggle sidebar Toggle sidebar
S

shmigglebap

Commendable
Apr 27, 2016
7
0
1,510
Long time reader, first time poster. I'm hoping to get a little more insight into what is causing my pc to crash and bsod. I have recently started using whocrashed to get a little more info and have found that the most common offender is ntoskrnl.exe

On Wed 4/27/2016 7:54:25 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\042716-40154-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x7FD00)
Bugcheck code: 0x1A (0x41790, 0xFFFFFA800883F9B0, 0xFFFF, 0x0)
Error: MEMORY_MANAGEMENT
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a severe memory management error occurred.
This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Wed 4/27/2016 7:54:25 PM GMT your computer crashed
crash dump file: C:\Windows\memory.dmp
This was probably caused by the following module: ntkrnlmp.exe (nt!KeBugCheckEx+0x0)
Bugcheck code: 0x1A (0x41790, 0xFFFFFA800883F9B0, 0xFFFF, 0x0)
Error: MEMORY_MANAGEMENT
Bug check description: This indicates that a severe memory management error occurred.
This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Wed 4/27/2016 7:11:46 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\042716-44912-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x7FD00)
Bugcheck code: 0xC2 (0x7, 0x109B, 0x0, 0xFFFFF8A0123F2230)
Error: BAD_POOL_CALLER
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that the current thread is making a bad pool request.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

I know whocrashed isnt exactly the best for in depth troubleshooting so ive included my minidump folder at http://www.megafileupload.com/noaD/Minidump.rar

hoping to get a little guidance on what steps i should be taking to start fixing whats wrong
 
Sort by date Sort by votes
update the BIOS to the current version BIOS 1703
https://www.asus.com/us/Motherboards/CROSSHAIR_V_FORMULA/HelpDesk_Download/

update any of the drivers that the motherboard vendor supplies. (focus on the USB drivers)

remove your overclocking utility for now:
C:\Program Files (x86)\MSI Afterburner\RTCore64.sys Fri Apr 24 00:01:47 2015
update your Ralink RT2870 series USB802.11n Wireless Adapter Driver (you may have a different manufacturer)
\SystemRoot\system32\DRIVERS\netr28ux.sys Thu Nov 21 06:06:13 2013
(this driver is hard to find, since the company was sold to mediatek)
I would think it would work on a usb 2 port if the BIOS was updated and the Chip set drivers were updated.
(usb 2.x tends to work after some time in 2012, lots of bios bugs in 2011)

anyway you would also want to run a malwarebytes scan because of the keyserver installed may indicate hacked software.


you might also run memtest86 if you have not already done so.

to find a driver that is doing a double free of a memory address you can run verifier.exe and turn on debugging flags.
(google verifier.exe /standard /all to figure out how to run it. It will bugcheck the system and name the driver so make sure you know how to get in safe mode to turn off verifier.exe via verifier.exe /reset)




--------------
second bugcheck, looks like you have the service pack installed.
basically the bug is driver is trying to use a memory block after it has been released to the system.
IE it does not own it anymore. This can modify the memory that another driver actually owns.

the bugcheck was in the nt files system driver.


looks like you have some USB problems with tsusbflt.sys
Remote Desktop USB Hub Filter Driver messing up.
looks like you also have a key server installed.

machine info:
BIOS Release Date 12/27/2011
BIOS Version 1102
Manufacturer ASUSTeK COMPUTER INC.
Product Crosshair V Formula
Processor ID 430f1000fffb8b17
Processor Version AMD Phenom(tm) II X4 975 Processor
Processor Voltage 8eh - 1.4V
External Clock 200MHz
Max Speed 3600MHz
Current Speed 3600MHz









-----------------
I looked at the most current bugcheck, but you have windows 7 RTM.
you have to update to windows 7 service pack 1 + updates
there are just too many bugs in the old windows code.

I was also unable to read the BIOS info, you may want to update the BIOS and remove your overclocking utility.
Then do a system update. Be sure to reboot your system before and after you update a GPU driver (due to update issues)


-------------
first two are corrupted page tables. (the mapping between memory and your pagefile.sys)
the last on was a driver trying to use memory it does not own. (it could be due to its memory being corrupted)

I will take a quick look at the minidumps
 
Upvote 0 Downvote


Thats quite the list of things to wade through! I have actually done memtest before and my ram comes up fine so im fairly certain they're ok. Im working out the details with the bios updating and malwarebytes and will post back once i have the chance or something goes horribly wrong.
 
Upvote 0 Downvote
So my current status is ive updated with the drivers from asus for my board, updated the ralink wireless drivers, run malware and are currently running with verifier to see if i can get the system to crash. The only other issue im having is windows update is staying stuck looking for updates. Will post back if/when i get the system to crash
 
Upvote 0 Downvote
if you have a hacked version of windows, often the hack will block windows updates to prevent the hack from being detected and removed. On windows 8 and above you can run
dism.exe /online /cleanup-image /restorehealth
and get a clean copy of the core files from microsoft update server. Note: on hacked versions the hack is exposed and the activation timer goes off.

there are also some bugs that result in windows update not working, in these case you have to delete the software distribution folder. Maybe google for it or look here:
https://social.technet.microsoft.com/Forums/windowsserver/en-US/f5744a18-d4ca-4631-8324-878b9225251d/windowssoftwaredistribution-folder-cleanup-automation?forum=winserverwsus





 
Upvote 0 Downvote
there was a single bit corruption in special pool used by some device driver.


you have 2 banks of 8 gb RAM at 1600Mhz, part number and manufacture is not listed.

I would run memtest and confirm your memory is working ok and not getting single bit errors. If it works ok, swap the RAM between slots and run the memtest again.

also, in when you run verifier.exe you should change the memory dump type to kernel memory dump so that the extra debugging info is not stripped out to the memory .dmp file.

Malwarebytes Web Access Control was running right before the freepool call that accessed violated. Not that really tells you much when you have single bit corruptions you would normally blame the hardware and run memtest on its own boot image to prove it is not a windows problem.

if memtest works as expected, IE no errors you would then suspect low level hardware drivers like the BIOS, firmware, chipset drivers, bugs in the CPU microcode, check to see if you have the Windows cpu microcode patches installed (you do not, you are using microcode patches from 2009)

but start with the memtest test run.

 
Upvote 0 Downvote
Had trouble configuring memtest last night but have been running it since this late morning. Had errors appear with both sticks tested at once but currently testing one at a time with no issues so far. Going to test the other slots with each stick so it'll be a while before i have a better idea of whats what.

The ram im using for the board are PNY XLR8 sticks. Couldn't find the right kind listed on the manufacturer site but http://www.amazon.com/dp/B00D1IUEHW/ref=twister_B00SSTHX46?_encoding=UTF8&psc=1 has them listed.

I'll post back once everything is done running
 
Upvote 0 Downvote


Hi shmiggle, the RAM is the problem here, test each stick individually overnight until you can nail which stick it is. Hopefully it isn't both.
 
Upvote 0 Downvote
After much testing and retesting over the last few days I have found that one stick tends to have issues no matter what slot i put it into. Always scores an error on test 7 and the errors pile up when tested with its counterpart, so looks like i may have to replace.

Additionally, since I cant seem to get windows to update, and since im not sure if my version is legitimate, is there an easier way to piece together which updates I should be looking for?
 
Upvote 0 Downvote
You must log in or register to reply here.

TRENDING THREADS

Latest posts

Moderators online

Share this page

COMPANY
RESOURCES
FOLLOW
Top Bottom