MEMORY_MANAGEMENT BSOD when playing older games? (module: nt_wrong_symbols.sys)

[SoulOfDerp]

TLDR: I got BSOD when I play older games, Dark Souls 1 and Xcom 1 EU. Stop Codes being SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (only happened once) and MEMORY_MANAGEMENT (like 10 times already). Mini DMP files here.

In case the longer story helps, this only happens on games that are moded? or older? Which is Dark Souls 1 (which I do item randomizer mod), xcom 1 EU (with Long War mod), and Xcom 2 (with quite a lot of random mods). Xcom 2 or any other game never Blue Screen without mods. So I dont know if its mods or games being older. I played and streamed Subnautica, Overwatch or some newer games (without mods tough) and never had BSOD.


WhoCrashed report shows (older DMP files was gone for some reason):

On Sat 17/3/2018 12:15:43 AM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\Minidump\031718-6359-01.dmp
This was probably caused by the following module: hardware.sys (hardware)
Bugcheck code: 0x1A (0x41792, 0xFFFFFE005D249000, 0x2, 0x0)
Error: MEMORY_MANAGEMENT
Bug check description: This indicates that a severe memory management error occurred. A corrupted PTE has been detected.
This might be a case of memory corruption. This may be because of a hardware issue such as faulty RAM, overheating (thermal issue) or because of a buggy driver. This problem might also be caused because of overheating (thermal issue).
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: hardware.sys .
Google query: hardware.sys MEMORY_MANAGEMENT

On Fri 16/3/2018 9:46:42 PM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\Minidump\031618-6296-01.dmp
This was probably caused by the following module: nt_wrong_symbols.sys (nt_wrong_symbols)
Bugcheck code: 0x1A (0x41793, 0xFFFFAB0000028000, 0x1, 0x0)
Error: MEMORY_MANAGEMENT
Bug check description: This indicates that a severe memory management error occurred.
This might be a case of memory corruption. This may be because of a hardware issue such as faulty RAM, overheating (thermal issue) or because of a buggy driver. This problem might also be caused because of overheating (thermal issue).
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: nt_wrong_symbols.sys .
Google query: nt_wrong_symbols.sys MEMORY_MANAGEMENT

What I have tried:
- Using Display Driver uninstaller to uninstall and reinstall the newest Display Driver
- Revert to older Display Driver
- Windows update
- BIOS updated to newest version
- Memtest shows nothing wrong
- Pulling my hairs out


So what gives? My spec is here:

WD Blue WD10EZEX 1TB 7200rpm 64MB 3.5 Inch HDD
Samsung 960 EVO Series - 250GB PCIe NVMe - M.2 SSD
Antec NeoEco II Series NEO-ECO2-550 80Plus Bronze 550W PSU
MSI GeForce® GTX 1070 GAMING X 8GB GDDR5
Corsair VENGEANCE® LED 16GB (2 x 8GB) DDR4 3000MHz C15 - White LED
AMD RYZEN R7 1700 3.7GHz 16M L3 8 Core 16 Thread 65W AM4
Gigabyte GA-AB350M-Gaming 3 AM4 M.ATX
WIN10




EDIT: it seems to be harddrive related. It stopped happening when I move every steam game and every game out of a suspected hard disc.

 

[Colif]

OK, he did look at all dumps, including the oldest which are fixed now. I don't know how his program works so its possible it got system info from the oldest dump before you upgraded bios.

if you bsod again, give us a new dump and I will get it checked.

 

[SoulOfDerp]

OK, he did look at all dumps, including the oldest which are fixed now. I don't know how his program works so its possible it got system info from the oldest dump before you upgraded bios.

if you bsod again, give us a new dump and I will get it checked.

I managed to update ScpVBus.sys by... well installing and uninstalling the SCP stuff a few times, so now the 2013 version become 2016 version in Drivers.

BIOS updated (I think I was not paying attention that I download the wrong version last time).

Display driver has another update, did it.

Still have no idea how to remove Intel Extreme Turning bullcrap.

LAN driver also updated? (it only gave me the option to repair, but it did said its installing new version)

Let see if you see me post again in a few days.

 

[johnbl]

download autoruns from https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns
run it as an admin, find the drivers tab and list the drivers. if you can find the driver name you can uncheck the checkbox to prevent it from loading and reboot. This will do a selective loading of the drivers (good for testing)
or you can just delete the entry and reboot the system.

OK, he did look at all dumps, including the oldest which are fixed now. I don't know how his program works so its possible it got system info from the oldest dump before you upgraded bios.

if you bsod again, give us a new dump and I will get it checked.

I managed to update ScpVBus.sys by... well installing and uninstalling the SCP stuff a few times, so now the 2013 version become 2016 version in Drivers.

BIOS updated (I think I was not paying attention that I download the wrong version last time).

Display driver has another update, did it.

Still have no idea how to remove Intel Extreme Turning bullcrap.

LAN driver also updated? (it only gave me the option to repair, but it did said its installing new version)

Let see if you see me post again in a few days.

 

[SoulOfDerp]

download autoruns from https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns
run it as an admin, find the drivers tab and list the drivers. if you can find the driver name you can uncheck the checkbox to prevent it from loading and reboot. This will do a selective loading of the drivers (good for testing)
or you can just delete the entry and reboot the system.

OK, he did look at all dumps, including the oldest which are fixed now. I don't know how his program works so its possible it got system info from the oldest dump before you upgraded bios.

if you bsod again, give us a new dump and I will get it checked.

I managed to update ScpVBus.sys by... well installing and uninstalling the SCP stuff a few times, so now the 2013 version become 2016 version in Drivers.

BIOS updated (I think I was not paying attention that I download the wrong version last time).

Display driver has another update, did it.

Still have no idea how to remove Intel Extreme Turning bullcrap.

LAN driver also updated? (it only gave me the option to repair, but it did said its installing new version)

Let see if you see me post again in a few days.

Got another BSOD before I see this. Minidump here.

Now I am going to install the autoruns.

 

[gardenman]

I cannot remove Intel Extreme Tuning Utility since its not "installed" in my system and the only thing I can do is disable that in "service".

I'm sorry, I should have real the full thread beforehand. If I remember correctly, I manually removed Intel Extreme Tuning from my system a year or so back, it was a nightmare.

johnbl took my answer, try AutoRuns. If it doesn't work, there is also DriverStore Explorer.

Full text on just the latest dump file: https://pste.eu/p/Lheg.html

File: 033018-6562-01.dmp (Mar 29 2018 - 12:08:40)
BugCheck: [SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007E)]
Probably caused by: memory_corruption (Process: SearchFilterHost.exe)
Uptime: 0 Day(s), 1 Hour(s), 43 Min(s), and 30 Sec(s)

It does appear you now have BIOS vF22 installed.

 

[SoulOfDerp]

I cannot remove Intel Extreme Tuning Utility since its not "installed" in my system and the only thing I can do is disable that in "service".

I'm sorry, I should have real the full thread beforehand. If I remember correctly, I manually removed Intel Extreme Tuning from my system a year or so back, it was a nightmare.

johnbl took my answer, try AutoRuns. If it doesn't work, there is also DriverStore Explorer.

Full text on just the latest dump file: https://pste.eu/p/Lheg.html

File: 033018-6562-01.dmp (Mar 29 2018 - 12:08:40)
BugCheck: [SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007E)]
Probably caused by: memory_corruption (Process: SearchFilterHost.exe)
Uptime: 0 Day(s), 1 Hour(s), 43 Min(s), and 30 Sec(s)

It does appear you now have BIOS vF22 installed.

I unchecked iocbios2.sys in autorun, should I delete the Intel Extreme Tuning folder next time I reboot or just leave it there? Since I have no idea what 90% of the drivers does, I am not touching them at this point.

 

[gardenman]

I would just leave it there for the time being. Removing it could cause (minor) problems. It shouldn't hurt anything and maybe one day you will want to re-enable it for some reason.

Do a search in AutoRuns (use the Filter box at the top) and search for the word Extreme. If you find anything else listed in the search, let us know here. Don't automatically disable it.

Otherwise, wait for additional answers from others.

 

[Colif]

still curious why its even there... its really out of place... but if its not running it can't do any damage.

I sent lost soul a pm too.

I won't get in John's way

 

[SoulOfDerp]

Extreme doesnt seems to find anything even if I do it in the "everything" tab. So seems like its the only intel extreme tuning related stuff.

 

[SoulOfDerp]

I would just leave it there for the time being. Removing it could cause (minor) problems. It shouldn't hurt anything and maybe one day you will want to re-enable it for some reason.

Do a search in AutoRuns (use the Filter box at the top) and search for the word Extreme. If you find anything else listed in the search, let us know here. Don't automatically disable it.

Otherwise, wait for additional answers from others.

So SearchFilterHost.exe blue screened 2 times, is this process have problem or ...?

Also it seems MEMORY_MANAGEMENT doesnt appears anymore, why the stop code changed? Could it be possible that I fixed one blue screen and caused another?

 

[Colif]

Searchfilterhost is part of windows, has been since windows XP

A look at netmon reveals that this process has some network activity where it contacts Microsoft and downloads data. The data transmitted is not personal, it is related to queries for help topics within Windows built-in help system and goes directly to Microsoft.

https://www.groovypost.com/reviews/searchfilterhost-exe-windows-process-explained/

Its part of SearchIndexer which as name suggests, is the indexing feature in Windows that searches all your files and creates a way to search what you have installed.

why its effected is a good question though. It could be the sata drivers but I believe those are part of chipset drivers. I don't know if it could be the ssd/hdd themselves, I would run chkdsk on both and check them out.

 

[SoulOfDerp]

Searchfilterhost is part of windows, has been since windows XP

A look at netmon reveals that this process has some network activity where it contacts Microsoft and downloads data. The data transmitted is not personal, it is related to queries for help topics within Windows built-in help system and goes directly to Microsoft.

https://www.groovypost.com/reviews/searchfilterhost-exe-windows-process-explained/

Its part of SearchIndexer which as name suggests, is the indexing feature in Windows that searches all your files and creates a way to search what you have installed.

why its effected is a good question though. It could be the sata drivers but I believe those are part of chipset drivers. I don't know if it could be the ssd/hdd themselves, I would run chkdsk on both and check them out.

It doesnt seems to have error? Or it cant check if stuff is in use? At this point I just hope for god that its just the intel extreme tuning. (but why does it suddenly cause problems? I used this PC for like 10 months without BSOD)


C:\WINDOWS\system32>chkdsk C:
The type of the file system is NTFS.

WARNING! /F parameter not specified.
Running CHKDSK in read-only mode.

Stage 1: Examining basic file system structure ...
433920 file records processed.
File verification completed.
13502 large file records processed.
0 bad file records processed.

Stage 2: Examining file name linkage ...
499 reparse records processed.
534418 index entries processed.
Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered to lost and found.
499 reparse records processed.

Stage 3: Examining security descriptors ...
Security descriptor verification completed.
50250 data files processed.
CHKDSK is verifying Usn Journal...
38155336 USN bytes processed.
Usn Journal verification completed.

Windows has scanned the file system and found no problems.
No further action is required.

243617791 KB total disk space.
111448556 KB in 238186 files.
171712 KB in 50251 indexes.
0 KB in bad sectors.
551347 KB in use by the system.
65536 KB occupied by the log file.
131446176 KB available on disk.

4096 bytes in each allocation unit.
60904447 total allocation units on disk.
32861544 allocation units available on disk.

C:\WINDOWS\system32>chkdsk D:
The type of the file system is NTFS.

WARNING! /F parameter not specified.
Running CHKDSK in read-only mode.

Stage 1: Examining basic file system structure ...
99584 file records processed.
File verification completed.
1 large file records processed.
0 bad file records processed.

Stage 2: Examining file name linkage ...
905 reparse records processed.
102290 index entries processed.
Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered to lost and found.
905 reparse records processed.

Stage 3: Examining security descriptors ...
Security descriptor verification completed.
1354 data files processed.
CHKDSK is verifying Usn Journal...
41278472 USN bytes processed.
Usn Journal verification completed.

Windows has scanned the file system and found no problems.
No further action is required.

976760831 KB total disk space.
589638792 KB in 96035 files.
26448 KB in 1355 indexes.
0 KB in bad sectors.
235871 KB in use by the system.
65536 KB occupied by the log file.
386859720 KB available on disk.

4096 bytes in each allocation unit.
244190207 total allocation units on disk.
96714930 allocation units available on disk.

C:\WINDOWS\system32>chkdsk G:
The type of the file system is NTFS.
Volume label is 新增磁碟區.

WARNING! /F parameter not specified.
Running CHKDSK in read-only mode.

Stage 1: Examining basic file system structure ...
350976 file records processed.
File verification completed.
122 large file records processed.
0 bad file records processed.

Stage 2: Examining file name linkage ...
2430 reparse records processed.
374830 index entries processed.
Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered to lost and found.
2430 reparse records processed.

Stage 3: Examining security descriptors ...
Security descriptor verification completed.
11928 data files processed.
CHKDSK is verifying Usn Journal...
39039664 USN bytes processed.
Usn Journal verification completed.

Windows has scanned the file system and found no problems.
No further action is required.

976656383 KB total disk space.
643009028 KB in 162045 files.
67240 KB in 11929 indexes.
0 KB in bad sectors.
485003 KB in use by the system.
65536 KB occupied by the log file.
333095112 KB available on disk.

4096 bytes in each allocation unit.
244164095 total allocation units on disk.
83273778 allocation units available on disk.

C:\WINDOWS\system32>chkdsk H:
The type of the file system is NTFS.
Volume label is FreeAgent Drive.

WARNING! /F parameter not specified.
Running CHKDSK in read-only mode.

Stage 1: Examining basic file system structure ...
242688 file records processed.
File verification completed.
44 large file records processed.
0 bad file records processed.

Stage 2: Examining file name linkage ...
288 reparse records processed.
253992 index entries processed.
Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered to lost and found.
288 reparse records processed.

Stage 3: Examining security descriptors ...
Security descriptor verification completed.
5653 data files processed.
CHKDSK is verifying Usn Journal...
39428528 USN bytes processed.
Usn Journal verification completed.

Windows has scanned the file system and found no problems.
No further action is required.

488383999 KB total disk space.
265591540 KB in 72146 files.
30232 KB in 5654 indexes.
0 KB in bad sectors.
362539 KB in use by the system.
65536 KB occupied by the log file.
222399688 KB available on disk.

4096 bytes in each allocation unit.
122095999 total allocation units on disk.
55599922 allocation units available on disk.

 

[johnbl]

windows search index database can get messed up. Normally you would stop the service and go and delete the database from the drive. Then start the service so the database is recreated.

I would google "how to delete windows search index" to find instructions.

 

[Colif]

Try rebuilding the index 1st - https://www.tekrevue.com/tip/how-to-solve-windows-search-issues-index-rebuild/

this shows how to delete the database - https://www.techwalla.com/articles/how-to-delete-a-windows-search-index

 

[SoulOfDerp]

Ok, so its been a few days now, I am not even sure if its fixed not since it only happens on some games and not others, and I finished DOOM and started new game. So far it seems ok, thanks for the help anyway, if I get BSOD again I will post more info, cheers.

 

[SoulOfDerp]

windows search index database can get messed up. Normally you would stop the service and go and delete the database from the drive. Then start the service so the database is recreated.

I would google "how to delete windows search index" to find instructions.

Hmm.... I stopped the Intel Extreme Tuning Utility and did not have BSOF for 2 weeks.... then today when the PC is idle (with Path of Exile running tough while I have lunch), I come back and the PC was restarted, turns out it was a Blue screen when I was away. DUMP file here.

WhoCrashed log:


On Sat 14/4/2018 11:36:59 AM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\Minidump\041418-6421-01.dmp
This was probably caused by the following module: hardware.sys (hardware)
Bugcheck code: 0x1A (0x41792, 0xFFFFFDBFFE8C9000, 0x2, 0x0)
Error: MEMORY_MANAGEMENT
Bug check description: This indicates that a severe memory management error occurred. A corrupted PTE has been detected.
This might be a case of memory corruption. This may be because of a hardware issue such as faulty RAM, overheating (thermal issue) or because of a buggy driver. This problem might also be caused because of overheating (thermal issue).
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: hardware.sys .
Google query: hardware.sys MEMORY_MANAGEMENT



On Sat 14/4/2018 11:36:59 AM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\MEMORY.DMP
This was probably caused by the following module: hardware.sys (hardware)
Bugcheck code: 0x1A (0x41792, 0xFFFFFDBFFE8C9000, 0x2, 0x0)
Error: MEMORY_MANAGEMENT
Bug check description: This indicates that a severe memory management error occurred. A corrupted PTE has been detected.
This might be a case of memory corruption. This may be because of a hardware issue such as faulty RAM, overheating (thermal issue) or because of a buggy driver. This problem might also be caused because of overheating (thermal issue).
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: hardware.sys .
Google query: hardware.sys MEMORY_MANAGEMENT




I am rebuilding the index now (since it took too long and it seemed the problem was fixed..... 🙁)

 

[Colif]

This might help John

Parameter 1 - 041792 - A corrupted PTE has been detected. Parameter 2 contains the address of the PTE. Parameters 3/4 contain the low/high parts of the PTE.
PTE = Page Table Entries (I assume John knows that)

its pointing at hardware when you get memory management linked to Hardware.sys

search cortana for Memory - run the Windows memory diagnostic and see what it finds.

 

[SoulOfDerp]

This might help John

Parameter 1 - 041792 - A corrupted PTE has been detected. Parameter 2 contains the address of the PTE. Parameters 3/4 contain the low/high parts of the PTE.
PTE = Page Table Entries (I assume John knows that)

its pointing at hardware when you get memory management linked to Hardware.sys

search cortana for Memory - run the Windows memory diagnostic and see what it finds.

Windows memory diagnostic found no errors. Then again, it seems to happen a lot more rare at least.

 

[SoulOfDerp]

This might help John

Parameter 1 - 041792 - A corrupted PTE has been detected. Parameter 2 contains the address of the PTE. Parameters 3/4 contain the low/high parts of the PTE.
PTE = Page Table Entries (I assume John knows that)

its pointing at hardware when you get memory management linked to Hardware.sys

search cortana for Memory - run the Windows memory diagnostic and see what it finds.

Guess what? Haha it happen again hahahahaha. More hair got pulled out.......... i am going bald.

DUMP file here.

On Wed 25/4/2018 11:46:55 PM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\Minidump\042518-6546-01.dmp
This was probably caused by the following module: nt_wrong_symbols.sys (nt_wrong_symbols)
Bugcheck code: 0x1A (0x41201, 0xFFFFEDBFFD402000, 0x1, 0xFFFFB204B78ECF70)
Error: MEMORY_MANAGEMENT
Bug check description: This indicates that a severe memory management error occurred.
This might be a case of memory corruption. This may be because of a hardware issue such as faulty RAM, overheating (thermal issue) or because of a buggy driver. This problem might also be caused because of overheating (thermal issue).
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: nt_wrong_symbols.sys .
Google query: nt_wrong_symbols.sys MEMORY_MANAGEMENT



On Wed 25/4/2018 11:46:55 PM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\MEMORY.DMP
This was probably caused by the following module: nt_wrong_symbols.sys (nt_wrong_symbols)
Bugcheck code: 0x1A (0x41201, 0xFFFFEDBFFD402000, 0x1, 0xFFFFB204B78ECF70)
Error: MEMORY_MANAGEMENT
Bug check description: This indicates that a severe memory management error occurred.
This might be a case of memory corruption. This may be because of a hardware issue such as faulty RAM, overheating (thermal issue) or because of a buggy driver. This problem might also be caused because of overheating (thermal issue).
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: nt_wrong_symbols.sys .
Google query: nt_wrong_symbols.sys MEMORY_MANAGEMENT

 

[SoulOfDerp]

This might help John

Parameter 1 - 041792 - A corrupted PTE has been detected. Parameter 2 contains the address of the PTE. Parameters 3/4 contain the low/high parts of the PTE.
PTE = Page Table Entries (I assume John knows that)

its pointing at hardware when you get memory management linked to Hardware.sys

search cortana for Memory - run the Windows memory diagnostic and see what it finds.

I mean at this point I think we are running out of answers...? I even tried to disconnect my portable harddrive and do another clean reinstall of my Anti-Virus (since it was in the blame list before) Anyway it happens again just now so.... yeah, DUMP file here, this time it happens after I close a game and open another game (POE) that never caused the BSOD before.

 

[Lost_Soul]

windows search index database can get messed up. Normally you would stop the service and go and delete the database from the drive. Then start the service so the database is recreated.

I would google "how to delete windows search index" to find instructions.

Is it possible that all theses is caused by stuff like PSU or my HDD being faulty? Or any hardwares ranged from Keyboard and Mouse to Display Card? But why is that MEMORY_MANAGEMENT if that is the case?

I mean If I know what is wrong I will happily buy a new HDD or RAM but so far no test is showing the RAM is having problems and I am not sure HDD can be related (since one of it did had some issues when I first get my hands on this PC and I avoided to use that most of the time). I also unplugged the portable HD and did a clean install of my Bitdefender when the last BSOD happened yesterday.

It also only happens for some games and never on the others despite Overwatch and Subnautica being more demanding then games like Dark Souls 1.

At this point it seems Chrome is causing the most Crashes, is that actually related to Chrome or its something in the background?

Or... would it help if I just add another pair of RAM and get rid of page files entirely?

 

[Colif]

I was hoping John would reply as he knows these things better than I do.

Memory to the PC includes the hdd, so if you suspect it could be the drive, it is worth a look at since drivers aren't showing as cause. And ram tests fine?

 

[SoulOfDerp]

I was hoping John would reply as he knows these things better than I do.

Memory to the PC includes the hdd, so if you suspect it could be the drive, it is worth a look at since drivers aren't showing as cause. And ram tests fine?

Yes, ram tests found no error. I now moved all steam games away from the suspected HDD (since steam did cause a few of them?) but Chrome also seems to caused a few.

I am also logging the temp of the HDD too since I think I saw something about overheat somewhere? But I cant seems to get the temp reading on my RAM sticks.

 

[Colif]

Your board can measure the temps of ram? Most mine offers is system temps apart from obvious GPU, CPU and HDD temps.

How many hdd do you have? I see one is western digital so try running Data life guard for windows on it. Run short and long tests

Samsung ssd can be tested using Samsung Magician which can also update firmware

 

[Lost_Soul]

Your board can measure the temps of ram? Most mine offers is system temps apart from obvious GPU, CPU and HDD temps.

How many hdd do you have? I see one is western digital so try running Data life guard for windows on it. Run short and long tests

Samsung ssd can be tested using Samsung Magician which can also update firmware

I mean RAM reading is the only one I cannot get. So if it is indeed RAM that is overheating I cannot know. I will also check the HDD too, but at the mean time I evacuated every games from the HDD that is having problems.

I never thought memory management BSOD could be caused by PSU or HDD lol.... then again, it could be none of that too.