Memory_Management BSOD Win10

[mhdrtofighi]

i get this usually 5-10 mins after windows startup. have used SFC and window memory diagnostics tool running for 12 hours on extended test and 3 pass setting for 12 hours but it found no errors about my hardware. i also changed mobo but it doesn't help. the bsod started when i upgraded my ram from 8(2x4)gb with another 16(8x2) gigabyte and also same time when i installed win10. here's my dump file info:

Microsoft (R) Windows Debugger Version 10.0.15063.468 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Mhdr\Desktop\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.

Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 15063 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 15063.0.amd64fre.rs2_release.170317-1834
Machine Name:
Kernel base = 0xfffff802`4708a000 PsLoadedModuleList = 0xfffff802`473d65c0
Debug session time: Thu Oct 5 00:13:58.896 2017 (UTC + 3:30)
System Uptime: 0 days 3:40:46.528
Loading Kernel Symbols
...............................................................
..Page 110ea1 not present in the dump file. Type ".hh dbgerr004" for details
..............................................................
.................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 00000000`019f2018). Type ".hh dbgerr001" for details
Loading unloaded module list
.........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41793, ffffb7000000f580, b1, b0}

Probably caused by : memory_corruption ( nt!MiDeleteVirtualAddresses+11b666 )

Followup: MachineOwner
---------

6: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041793, The subtype of the bugcheck.
Arg2: ffffb7000000f580
Arg3: 00000000000000b1
Arg4: 00000000000000b0

Debugging Details:
------------------


DUMP_CLASS: 1

DUMP_QUALIFIER: 401

BUILD_VERSION_STRING: 15063.0.amd64fre.rs2_release.170317-1834

SYSTEM_MANUFACTURER: MSI

SYSTEM_PRODUCT_NAME: MS-7758

SYSTEM_SKU: To be filled by O.E.M.

SYSTEM_VERSION: 3.0

BIOS_VENDOR: American Megatrends Inc.

BIOS_VERSION: V17.8

BIOS_DATE: 10/31/2013

BASEBOARD_MANUFACTURER: MSI

BASEBOARD_PRODUCT: B75A-G41 (MS-7758)

BASEBOARD_VERSION: 3.0

DUMP_TYPE: 1

BUGCHECK_P1: 41793

BUGCHECK_P2: ffffb7000000f580

BUGCHECK_P3: b1

BUGCHECK_P4: b0

BUGCHECK_STR: 0x1a_41793

CPU_COUNT: 8

CPU_MHZ: da4

CPU_VENDOR: GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 3a

CPU_STEPPING: 9

CPU_MICROCODE: 6,3a,9,0 (F,M,S,R) SIG: 1B'00000000 (cache) 1B'00000000 (init)

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

PROCESS_NAME: psiphon3.exe

CURRENT_IRQL: 2

ANALYSIS_SESSION_HOST: DESKTOP-QJ0EOIT

ANALYSIS_SESSION_TIME: 10-05-2017 17:34:15.0314

ANALYSIS_VERSION: 10.0.15063.468 amd64fre

LAST_CONTROL_TRANSFER: from fffff80247229e66 to fffff802471f6580

STACK_TEXT:
ffffbb81`004da878 fffff802`47229e66 : 00000000`0000001a 00000000`00041793 ffffb700`0000f580 00000000`000000b1 : nt!KeBugCheckEx
ffffbb81`004da880 fffff802`47109a6d : ffff9403`7480fd88 ffff9403`753e5080 ffff9403`7480fd88 ffff9403`7480f7c0 : nt!MiDeleteVirtualAddresses+0x11b666
ffffbb81`004dab30 fffff802`47176e41 : 00000000`01eb1fff 00000000`01eb1fff 00000000`01df0000 ffff9403`74b12670 : nt!MiDeleteVad+0x3ad
ffffbb81`004dacb0 fffff802`4753fd8a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`01df0000 : nt!MiFreeVadRange+0x4d
ffffbb81`004dacf0 fffff802`47201413 : ffff9403`753e5080 00000000`00000000 00000000`00000000 ffff9403`74574b70 : nt!NtFreeVirtualMemory+0x42a
ffffbb81`004dae40 00007ffa`a80d5764 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`017ecbf8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`a80d5764


STACK_COMMAND: kb

THREAD_SHA1_HASH_MOD_FUNC: 90b87f161d2442349cdd65ca3cc52ea729ca2292

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: d0883dc6919f80efbe59dd88d8534e789f5ffc03

THREAD_SHA1_HASH_MOD: ee8fcf1fb60cb6e3e2f60ddbed2ec02b5748a693

FOLLOWUP_IP:
nt!MiDeleteVirtualAddresses+11b666
fffff802`47229e66 cc int 3

FAULT_INSTR_CODE: 4c8b45cc

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MiDeleteVirtualAddresses+11b666

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 59ae237e

IMAGE_NAME: memory_corruption

BUCKET_ID_FUNC_OFFSET: 11b666

FAILURE_BUCKET_ID: 0x1a_41793_nt!MiDeleteVirtualAddresses

BUCKET_ID: 0x1a_41793_nt!MiDeleteVirtualAddresses

PRIMARY_PROBLEM_CLASS: 0x1a_41793_nt!MiDeleteVirtualAddresses

TARGET_TIME: 2017-10-04T20:43:58.000Z

OSBUILD: 15063

OSSERVICEPACK: 0

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 272

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2017-09-05 08:39:34

BUILDDATESTAMP_STR: 170317-1834

BUILDLAB_STR: rs2_release

BUILDOSVER_STR: 10.0.15063.0.amd64fre.rs2_release.170317-1834

ANALYSIS_SESSION_ELAPSED_TIME: cec

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0x1a_41793_nt!mideletevirtualaddresses

FAILURE_ID_HASH: {0730eb34-d667-1bcc-76fe-94b17390a3ef}

Followup: MachineOwner
---------

6: kd> !thread
THREAD ffff9403753e5080 Cid 1bd8.232c Teb: 00000000019f4000 Win32Thread: ffff940324e18e80 RUNNING on processor 6
Not impersonating
DeviceMap ffffa50258677e60
Owning Process ffff94037480f7c0 Image: psiphon3.exe
Attached Process N/A Image: N/A
Wait Start TickCount 847777 Ticks: 0
Context Switch Count 59000 IdealProcessor: 6
UserTime 00:00:06.531
KernelTime 00:00:00.687
Win32 Start Address 0x000000000173f840
Stack Init ffffbb81004dafd0 Current ffffbb81004daa30
Base ffffbb81004db000 Limit ffffbb81004d5000 Call 0000000000000000
Priority 10 BasePriority 8 PriorityDecrement 0 IoPriority 2 PagePriority 5
Child-SP RetAddr : Args to Child : Call Site
ffffbb81`004da878 fffff802`47229e66 : 00000000`0000001a 00000000`00041793 ffffb700`0000f580 00000000`000000b1 : nt!KeBugCheckEx
ffffbb81`004da880 fffff802`47109a6d : ffff9403`7480fd88 ffff9403`753e5080 ffff9403`7480fd88 ffff9403`7480f7c0 : nt!MiDeleteVirtualAddresses+0x11b666
ffffbb81`004dab30 fffff802`47176e41 : 00000000`01eb1fff 00000000`01eb1fff 00000000`01df0000 ffff9403`74b12670 : nt!MiDeleteVad+0x3ad
ffffbb81`004dacb0 fffff802`4753fd8a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`01df0000 : nt!MiFreeVadRange+0x4d
ffffbb81`004dacf0 fffff802`47201413 : ffff9403`753e5080 00000000`00000000 00000000`00000000 ffff9403`74574b70 : nt!NtFreeVirtualMemory+0x42a
ffffbb81`004dae40 00007ffa`a80d5764 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffbb81`004dae40)
00000000`017ecbf8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`a80d5764

 

[johnbl]

I

owning process that was running was
psiphon3.exe tools like this depend on many other drivers and tend to have bugs.
--------

would turn off the virtual memory reboot and delete the hidden c:\pagefiles.sys
then turn the virtual memory back on.

-you could also update the bios and the motherboard drivers to pick up new sata drivers
- I would also run a Malwarebytes scan
and run powershell as an admin (or cmd.exe as an admin) and run
DISM.EXE /Online /Cleanup-Image /RestoreHealth
(goal is to make sure your storage driver is not infected with a virus)