"MEMORY_CORRUPTION_LARGE" Event Tracing Fatal Error BSOD?

[Delaney_3]

Hello all! To start, I have an
ASUS G20CB
with...
Intel Core i7-6700k
16 GB of laptop DDR4 RAM
ASUS GTX 970
Wish I could provide the motherboard, but as far as I know my computer uses some sort of standard ASUS laptop motherboard due to its very slim design.

Lately, randomly occuring after sleep mode, I will get an Event Tracing Fatal Error or Kernel Security Check Failure. Sometimes, it happens 10 seconds after I log in. Sometimes, I do not have time to log in and it blue screens before I can do anything. It is apparently random, and has never occurred when restarting the PC in any modes, when gaming, etc -- it seems to happen only when waking up from sleep mode. I would like to fix this.

I'm floored! I have no idea what is wrong. WinDbg reports MEMORY_CORRUPTION_LARGE as the cause. I am unsure how to fix this, and to be honest, do not understand the issue as my RAM reports as being totally OK.

If someone shows me how to attach the file of a crash dump, I am more than willing to oblige.

Thank you!

 

[Colif]

Can you follow option one here: http://www.tenforums.com/tutorials/5560-bsod-minidump-configure-create-windows-10-a.html
and then do this step below: Small memory dumps - Have Windows Create a Small Memory Dump (Minidump) on BSOD

that creates a file in c/windows/minidump
copy that file to documents
upload the copy from documents to a cloud server and share the link here and someone with right software to read them will help you fix it

 

[Delaney_3]

https://www.dropbox.com/pri/get/040317-31578-01.dmp?_subject_uid=660432751&w=AAD_jIACihDChyVZW4lvtANBYpt1blXOxH3T5LZirwRWow

https://www.dropbox.com/pri/get/040217-29453-01.dmp?_subject_uid=660432751&w=AAC2Zcf-0EiSZEX7TB_QFOhetHpuYPNGt8SoBzJrV48Yog

Here you go

 

[Colif]

I think the problem is likely to be a driver so, In case no one looks at this for a while, you can try running driver verifer, just read the instructions carefully. It is part of win 10 designed to find misbehaving drivers. It will cause BSOD, that is its job since it tests drivers.

if you get stuck in a boot loop, use a win 10 installer to get into cmd and use the command they mention to turn verifer off (I only seen it boot loop once so far but i give warning regardless). You can download Windows 10 media creation tool and use it to make a win 10 installer on USB << if you don't have one now.

you can use windbg to analyse dumps or download and run who crashed - it will give us a glimpse of the errors you getting and might help us solve them

Copy/paste summary in here and I see what I can do

I can't read dumps but can help with who crashed unless it blames ntoskrnl

 

[Delaney_3]

Here you go my WinDbg file thank you for the suggestion

Microsoft (R) Windows Debugger Version 10.0.14321.1024 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.



Well, in WhoCrashed, all of them say ntoskrnl or ntkrnlmp so rest in pieces. 8(


Loading Dump File [C:\Windows\Minidump\040317-31578-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 14393 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 14393.953.amd64fre.rs1_release_inmarket.170303-1614
Machine Name:
Kernel base = 0xfffff800`c1e8f000 PsLoadedModuleList = 0xfffff800`c218e000
Debug session time: Mon Apr 3 08:54:47.618 2017 (UTC - 4:00)
System Uptime: 0 days 5:06:57.323
Loading Kernel Symbols
...............................................................
................................................................
................................................................
............
Loading User Symbols
Loading unloaded module list
...................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 11D, {3, ffffb107dad74f00, 40, 0}

*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption

Followup: memory_corruption
---------

5: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

EVENT_TRACING_FATAL_ERROR (11d)
Event Tracing subsystem has encountered an unexpected fatal error. First parameter indicates
the type of failure.
Arguments:
Arg1: 0000000000000003, Kernel mode registration corruption.
Arg2: ffffb107dad74f00
Arg3: 0000000000000040
Arg4: 0000000000000000

Debugging Details:
------------------


DUMP_CLASS: 1

DUMP_QUALIFIER: 400

BUILD_VERSION_STRING: 10.0.14393.953 (rs1_release_inmarket.170303-1614)

SYSTEM_MANUFACTURER: ASUSTeK COMPUTER INC.

SYSTEM_PRODUCT_NAME: G20CB

SYSTEM_SKU: SKU

SYSTEM_VERSION: System Version

BIOS_VENDOR: American Megatrends Inc.

BIOS_VERSION: 1301

BIOS_DATE: 02/18/2016

BASEBOARD_MANUFACTURER: ASUSTeK COMPUTER INC.

BASEBOARD_PRODUCT: G20CB

BASEBOARD_VERSION: Rev 1.xx

DUMP_TYPE: 2

BUGCHECK_P1: 3

BUGCHECK_P2: ffffb107dad74f00

BUGCHECK_P3: 40

BUGCHECK_P4: 0

CPU_COUNT: 8

CPU_MHZ: d50

CPU_VENDOR: GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 5e

CPU_STEPPING: 3

CPU_MICROCODE: 6,5e,3,0 (F,M,S,R) SIG: 74'00000000 (cache) 74'00000000 (init)

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: CODE_CORRUPTION

BUGCHECK_STR: 0x11D

PROCESS_NAME: HxTsr.e

CURRENT_IRQL: 0

ANALYSIS_SESSION_HOST: CUDDLES

ANALYSIS_SESSION_TIME: 04-03-2017 09:06:42.0571

ANALYSIS_VERSION: 10.0.14321.1024 amd64fre

LAST_CONTROL_TRANSFER: from fffff800c24110f0 to fffff800c1fdd7c0

STACK_TEXT:
ffffde80`ee4472e8 fffff800`c24110f0 : 00000000`0000011d 00000000`00000003 ffffb107`dad74f00 00000000`00000040 : nt!KeBugCheckEx
ffffde80`ee4472f0 fffff800`c22972e8 : ffffb107`dad74ed0 ffffb107`dad74ed0 00000000`00000000 ffffb107`cc078a50 : nt! ?? ::NNGAKEGL::`string'+0xde50
ffffde80`ee447390 fffff800`c1f01326 : 00000000`00000000 00000000`00000000 ffffb107`dad74ed0 ffffb107`dad74f00 : nt!ObpRemoveObjectRoutine+0x78
ffffde80`ee4473f0 fffff800`c22b235b : 00000000`00000000 ffffb107`dad74e00 ffffb107`dad74ed0 ffffb107`dad74ee0 : nt!ObfDereferenceObjectWithTag+0xc6
ffffde80`ee447430 fffff800`c232d935 : ffffb107`e2adc080 ffffc88f`5b2e6560 ffffc88f`50db05d8 ffffb107`dcf7f700 : nt!ObCloseHandleTableEntry+0x28b
ffffde80`ee447570 fffff800`c2278c1d : 00000000`00000000 ffffb107`e2adc080 ffffb107`e2adc080 00000000`00040001 : nt!ExSweepHandleTable+0xc5
ffffde80`ee447620 fffff800`c22755b7 : 00000000`00040000 00000000`00000001 ffffffff`00000000 ffffffff`ffffffff : nt!ObKillProcess+0x35
ffffde80`ee447650 fffff800`c22fd62c : ffffb107`e2adc080 ffffc88f`64b99960 ffffde80`ee447740 00000000`00000000 : nt!PspRundownSingleProcess+0x10f
ffffde80`ee4476d0 fffff800`c23453c6 : ffffb107`00000001 ffffb107`cc936080 ffffde80`ee447a80 ffffb107`cc936128 : nt!PspExitThread+0x508
ffffde80`ee447810 fffff800`c1ecb012 : 000001cb`72d0d700 00007ffe`00000001 ffffde80`ee447874 ffffb107`cc355ca0 : nt!KiSchedulerApcTerminate+0x2e
ffffde80`ee447840 fffff800`c1fe0e40 : 000001cb`72d0da80 ffffb107`d8ffb680 ffffb107`cc936080 00000000`00000000 : nt!KiDeliverApc+0x2f2
ffffde80`ee4478d0 fffff800`c1fe853a : ffffdc6e`370fffc0 ffffdc6e`371b87f8 ffffdfe7`3774739d fffff800`c22a355f : nt!KiInitiateUserApc+0x70
ffffde80`ee447a10 00007ffe`085b98a4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9f
0000005b`14eff578 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffe`085b98a4


STACK_COMMAND: kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
fffff800c20d7387-fffff800c20d7389 3 bytes - nt!ExFreePoolWithTag+387
[ 40 fb f6:00 6e dc ]
3 errors : !nt (fffff800c20d7387-fffff800c20d7389)

MODULE_NAME: memory_corruption

IMAGE_NAME: memory_corruption

FOLLOWUP_NAME: memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MEMORY_CORRUPTOR: LARGE

FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE

BUCKET_ID: MEMORY_CORRUPTION_LARGE

PRIMARY_PROBLEM_CLASS: MEMORY_CORRUPTION_LARGE

TARGET_TIME: 2017-04-03T12:54:47.000Z

OSBUILD: 14393

OSSERVICEPACK: 953

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 784

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS Personal

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2017-03-04 01:09:56

BUILDDATESTAMP_STR: 170303-1614

BUILDLAB_STR: rs1_release_inmarket

BUILDOSVER_STR: 10.0.14393.953

ANALYSIS_SESSION_ELAPSED_TIME: fb9

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:memory_corruption_large

FAILURE_ID_HASH: {e29154ac-69a4-0eb8-172a-a860f73c0a3c}

Followup: memory_corruption
---------

 

[Paul NZ]

You have to register to get those files. If you have to give permission to others enable it

 

[johnbl]

Ever since then new memory compression windbg tends to report bogus memory corruption errors.

 

[Delaney_3]

Here you go Paul NZ.
https://www.dropbox.com/s/8x3fdwxcm7p3szy/040217-29453-01.dmp?dl=0
https://www.dropbox.com/s/p4z399q1khgj5mu/040317-31578-01.dmp?dl=0

Thank you.
And I'm sorry John BL.

 

[Paul NZ]

Uninstall Aicharger, it's a known cause of crashes

Update this ElbyCDIO.sys Virtual clonedrive, the drivers are 3 yrs old

I would uninstal malwarebytes

See if there are updated drivers for this Scarlet.Crush Productions Scp Dual Shock 3 Virtual Bus Driver theyre 4 yrs old

There are suss / unknown files on your hdd

YSDD2R0.sys, YSDDR0.sys. It looks like YSDrv.sys is a PUP (adware), and YSR0.sys

I would do a scan with adwcleaner. Run it click on scan wait for it to finish then clean

https://toolslib.net/downloads/viewdownload/1-adwcleaner/

 

[Delaney_3]

Hi Paul, I was able to uninstall Virtual Clonedrive.
I am unable to uninstall Aicharger, I don't know where it is, it is not in task manager, nor is it in Program Files, and it isn't in Remove Programs and Features.

 

[Delaney_3]

Hi Paul, I found AICharger sys. It is in C:\Windows\SYSWOW64\drivers. Can I delete it and run CCleaner? I checked the internet and apparently many people have problems that when they remove AICharger it causes BSODs until the registry keys associated are removed manually. I do not know what that means, but another person said that running CCleaner before restarting the computer will fix that. Should I delete it?

 

[Paul NZ]

Well I dont know why its doesnt show anywhere. Ive never installed it myself. So, it'll either make it worse or maybe fix something if you delete the file

 

[Colif]

AI Charger is made by Asus, its likely to be in one of the Asus utilities since PC is made by Asus - nice looking box. I can't see what it might be part of looking at utilities but its function is to boost the power of a USB slot to power up mobile phones. it might be part of Asus Manager

its possibly a left over as looking at what came with your PC, shows this list of software that came with PC.

Anti-Virus Trial
Aegis II
ASUS WebStorage
ASUS Command
Ai Charger ll

http://cplonline.com.au/asus-g20cb-au006t-rog-core-i7-gaming-pc.html

 

[Delaney_3]

Thanks for the compliment on the box. It is unfortunately not the best due to the slim design... it's part laptop, ultimate downfall there.

Hmm, I never had an anti-virus trial. I do have AEGIS II. I use it to show temperatures since other programs are radically off, and to change the lights on my RGB strip. I don't think it would come with AI charger.

I do not have a 950 as in the link you described but a 970. Not sure if that changes anything. I noticed ASUS website for the G20CB says 970/1050/1060/1070" which must be so confusing. Sorry about that.

Thank you for your replies.

https://i.gyazo.com/97896e677649ed054ea30f8ff1d6a325.png

These are my programs that are ASUS related, or at least, some of them.

I didn't install AEGIS II yesterday, every time I open it I found out it changes the installed on date. That is just extremely weird. I also didn't install the app box and the others on 3/8, but that is when I updated my Windows. I don't know if that means anything.

I don't see AI charger, just AI power manager and AI booting. Not sure what either of those do.

 

[Colif]

AI Charger is 1st screen in AI Power manager - there is what you don't need. Not sure what its power management modes do, they same as AI Suite that comes with motherboards. If you don't use it, remove it as Asus software can cause errors.

 

[Delaney_3]

My god, the horror! Install shield, haven't seen that in ages. I can definitely see why this 2 year old software could cause issues on Windows 10. How disrespectful of ASUS... I will report back today and put my computer to sleep and wake it up a few times to see if the problem goes away.