Question Multiple BSOD and Warning in the eventviewer

[spacemonkex]

Hello everyone!
I need some help because my PC is giving me multiple BSOD with "MEMORY_MANAGEMENT" errors and now, looking at the event viewer, I noticed multiple warning and other errors.
I know the first thing to do is doing a memtest but I know it requires several hours to make a complete "check" and the reason I'm avoiding to do this is because this RAM are brand new, just a couple of months of life. So, before doing a memtest I'm asking to some expert that can help me to test other stuff before going into 8+ hours of memtest.

Can an old HDD i'm using for extra storage (So not where the OS is installed) cause BSOD like this? Idk that's why im asking help of way more than me expert people.

PS: Looking at WHoCrashed tabs I noticed "local drivers" tab and check in, I noticed a driver named "cimfs.sys" with no signature at all and no info too, is a bad thing?
Here a whoscrashed report anyway for the main problem I asked your help:
PPS: Sorry for my bad english btw

On Fri 09/08/2024 01:18:04 your computer crashed or a problem was reported

Crash dump file: C:\Windows\Minidump\080924-23484-01.dmp (Minidump)
Bugcheck code: 0x1A(0x61941, 0x7FFE1144D5E4, 0x1D, 0xFFFFE804F1A45B00)
Bugcheck name: MEMORY_MANAGEMENT
Bug check description: This indicates that a severe memory management error occurred.
Analysis: This is possibly a software problem. This is likely a case of memory corruption.
This bugcheck is often associated with overheating problems. Read this article on memory corruption. Read this article on thermal issues





On Fri 09/08/2024 01:15:07 your computer crashed or a problem was reported

Crash dump file: C:\Windows\Minidump\080924-26171-01.dmp (Minidump)
Bugcheck code: 0x139(0x3, 0xFFFFF60F41595590, 0xFFFFF60F415954E8, 0x0)
Bugcheck name: KERNEL_SECURITY_CHECK_FAILURE
Bug check description: The kernel has detected the corruption of a critical data structure.
Analysis: This particular bugcheck may be caused by malware or a security product that does not follow programming guidelines. This can also be caused by memory corruption. This is possibly a software problem. There is a possibility that this is caused by memory corruption. Memory corruption can be caused by a faulty driver, faulty RAM, overheating and more. Read this article on memory corruption. Read this article on thermal issues





On Fri 09/08/2024 16:38:10 your computer crashed or a problem was reported

Crash dump file: C:\Windows\Minidump\080924-23046-01.dmp (Minidump)
Bugcheck code: 0x4E(0x99, 0x0, 0x0, 0x5)
Bugcheck name: PFN_LIST_CORRUPT
Bug check description: This indicates that the page frame number (PFN) list is corrupted.
Analysis: This is possibly a software problem. This is likely a case of memory corruption.
Memory corruption can be caused by a faulty driver, faulty RAM, overheating and more. Read this article on memory corruption. Read this article on thermal issues





On Fri 09/08/2024 16:38:10 your computer crashed or a problem was reported

Crash dump file: C:\Windows\MEMORY.DMP (Kernel memory dump)
Bugcheck code: 0x4E(0x99, 0x0, 0x0, 0x5)
Bugcheck name: PFN_LIST_CORRUPT
Bug check description: This indicates that the page frame number (PFN) list is corrupted.
Analysis: This is possibly a software problem. This is likely a case of memory corruption.
Memory corruption can be caused by a faulty driver, faulty RAM, overheating and more. Read this article on memory corruption. Read this article on thermal issues





On Fri 09/08/2024 16:16:02 your computer crashed or a problem was reported

Crash dump file: C:\Windows\Minidump\080924-25031-01.dmp (Minidump)
Bugcheck code: 0x1A(0x61941, 0x7FFD9FD0D5E4, 0x1D, 0xFFFFAB0F08B0FB00)
Bugcheck name: MEMORY_MANAGEMENT
Bug check description: This indicates that a severe memory management error occurred.
Analysis: This is possibly a software problem. This is likely a case of memory corruption.
This bugcheck is often associated with overheating problems. Read this article on memory corruption. Read this article on thermal issues





On Thu 08/08/2024 21:18:53 your computer crashed or a problem was reported

Crash dump file: C:\Windows\Minidump\080824-26500-01.dmp (Minidump)
Bugcheck code: 0x4E(0x99, 0x0, 0x0, 0x4)
Bugcheck name: PFN_LIST_CORRUPT
Bug check description: This indicates that the page frame number (PFN) list is corrupted.
Analysis: This is possibly a software problem. This is likely a case of memory corruption.
Memory corruption can be caused by a faulty driver, faulty RAM, overheating and more. Read this article on memory corruption. Read this article on thermal issues


Thanks in advance for any help u'll give me <3

 

[spacemonkex]

EDIT: The "funny" stuff is that BSOD occurs when Im doing normal stuff, but not a single BSOD when im working with huge format on Photoshop or while gaming at max graphical setting, BSOD occurs or when Idle or when browsing on internet/doing normal stuff with the machine not under stress at all

 

[johnbl]

you will want to delete your pagefile.sys and create a new one.
you might google "how to tell windows to delete the pagefile.sys on shutdown" and make the changes

this will not fix your problem but will reduce the number of bugchecks until you find the real fix.

to fix the problem you should be looking for a running 3rd party service that is incorrectly trying to send data to kernel driver and it is corrupting memory. the corrupted memory is being saved to the virtual memory (pagefile.sys) and later the corrupted data is used and the system bugcheck. (most common cause)

you could also run verifier.exe on all the 3rd party drivers and attempt to force a system crash when a driver corrupts another drivers data. This should list the name of the driver doing the corruption.

often, these errors are compounded by windows sleep settings. Sleep cycles tend to expose programming errors in user mode services that talk to device drivers. often programmers assume the code/data does not move in memory over time.
anyway, you should try to update 3rd party drivers, cpu chipset drivers and any disk software as a potential fix.

you might also want to turn off all browser extensions also, (for the case of malware)
deleting the pagefile.sys on reboot can also help dump some types of malware from your system.
(case where malware hacks the pagefile then the system reboots and the hack is loaded from the pagefile to enable further hacks)

you might also run a tool that will read your SMART drive data and check to see if your drive is having problems.
(you can also see the drive firmware version and see if the drive firmware should be updated)
(yes, old drives my show a lot of errors and indicate the drive is at end of life)
tool to use would be like crystaldiskinfo.exe

BIOS updates and chipset drivers may also be required for certain problems

 

[181951]

Please upload the minidump and memory.dump in the file path specified by the system to a service and share them.

C:\Windows\Minidump

C:\Windows\MEMORY.DMP

 

[spacemonkex]

Thanks you all for the help!

you will want to delete your pagefile.sys and create a new one.
you might google "how to tell windows to delete the pagefile.sys on shutdown" and make the changes

this will not fix your problem but will reduce the number of bugchecks until you find the real fix.

to fix the problem you should be looking for a running 3rd party service that is incorrectly trying to send data to kernel driver and it is corrupting memory. the corrupted memory is being saved to the virtual memory (pagefile.sys) and later the corrupted data is used and the system bugcheck. (most common cause)

you could also run verifier.exe on all the 3rd party drivers and attempt to force a system crash when a driver corrupts another drivers data. This should list the name of the driver doing the corruption.

often, these errors are compounded by windows sleep settings. Sleep cycles tend to expose programming errors in user mode services that talk to device drivers. often programmers assume the code/data does not move in memory over time.
anyway, you should try to update 3rd party drivers, cpu chipset drivers and any disk software as a potential fix.

you might also want to turn off all browser extensions also, (for the case of malware)
deleting the pagefile.sys on reboot can also help dump some types of malware from your system.
(case where malware hacks the pagefile then the system reboots and the hack is loaded from the pagefile to enable further hacks)

you might also run a tool that will read your SMART drive data and check to see if your drive is having problems.
(you can also see the drive firmware version and see if the drive firmware should be updated)
(yes, old drives my show a lot of errors and indicate the drive is at end of life)
tool to use would be like crystaldiskinfo.exe

BIOS updates and chipset drivers may also be required for certain problems

Now I'm going to do everything you told me to try hoping to find the cause, I'll tell you if I'll found the problem or not. Thanks a lot for all the tips

Please upload the minidump and memory.dump in the file path specified by the system to a service and share them.

Heres the link for the dump files you asked me I uploaded them on wetransfer hope is okay.
https://we.tl/t-JdVXgBSxp6


Thanks both for the help, I'll keep you updated hoping the fix will be fast to detect

 

[spacemonkex]

you will want to delete your pagefile.sys and create a new one.
you might google "how to tell windows to delete the pagefile.sys on shutdown" and make the changes

this will not fix your problem but will reduce the number of bugchecks until you find the real fix.

to fix the problem you should be looking for a running 3rd party service that is incorrectly trying to send data to kernel driver and it is corrupting memory. the corrupted memory is being saved to the virtual memory (pagefile.sys) and later the corrupted data is used and the system bugcheck. (most common cause)

you could also run verifier.exe on all the 3rd party drivers and attempt to force a system crash when a driver corrupts another drivers data. This should list the name of the driver doing the corruption.

often, these errors are compounded by windows sleep settings. Sleep cycles tend to expose programming errors in user mode services that talk to device drivers. often programmers assume the code/data does not move in memory over time.
anyway, you should try to update 3rd party drivers, cpu chipset drivers and any disk software as a potential fix.

you might also want to turn off all browser extensions also, (for the case of malware)
deleting the pagefile.sys on reboot can also help dump some types of malware from your system.
(case where malware hacks the pagefile then the system reboots and the hack is loaded from the pagefile to enable further hacks)

you might also run a tool that will read your SMART drive data and check to see if your drive is having problems.
(you can also see the drive firmware version and see if the drive firmware should be updated)
(yes, old drives my show a lot of errors and indicate the drive is at end of life)
tool to use would be like crystaldiskinfo.exe

BIOS updates and chipset drivers may also be required for certain problems

I tried to check Crystaldisk for HDD status and even SMART using DiskDrill that have it, both SMART and CD told the HDD are in good status but I don't know if thats true because I don't know how to read those numbers and values. So here's some screen maybe you can't see something I can't.

https://imgur.com/a/kkFmnEJ

View: https://imgur.com/a/kkFmnEJ

 

[181951]

I have checked the smart values and there are no serious problems here.

CRITICAL_PROCESS_DIED (ef)
        A critical system process died
Arguments:
Arg1: ffffa1068dc8f280, Process object or thread object
Arg2: 0000000000000000, If this is 0, a process died. If this is 1, a thread died.
Arg3: 0000000000000000, The process object that initiated the termination.
Arg4: 0000000000000000

Stop 0xEF is usually caused by hardware problems, especially RAM problems. typically a program is loaded into memory but terminates itself because of some unhandled exception. Although your file is a little different, I don't know how much it affects the result.

02 ffff97835590e9e0 fffff806698bfa40 nt!PspTerminateAllThreads+158c1d (perf)
    Parameter[0] = ffffa1068dc8f280
    Parameter[1] = ffffa106891c40c0
    Parameter[2] = 00000000c0000409
    Parameter[3] = 0000000000000000

4: kd> k
 # Child-SP          RetAddr               Call Site
00 ffff9783`5590e938 fffff806`69b0de02     nt!KeBugCheckEx
01 ffff9783`5590e940 fffff806`69a19259     nt!PspCatchCriticalBreak+0x10e
02 ffff9783`5590e9e0 fffff806`698bfa40     nt!PspTerminateAllThreads+0x158c1d
03 ffff9783`5590ea50 fffff806`698bf83c     nt!PspTerminateProcess+0xe0
04 ffff9783`5590ea90 fffff806`69611d08     nt!NtTerminateProcess+0x9c
05 ffff9783`5590eb00 00007ffb`2016dae4     nt!KiSystemServiceCopyEnd+0x28
06 000000a4`f6cce738 00007ffb`2015cab0     ntdll!NtTerminateProcess+0x14
07 000000a4`f6cce740 00007ffb`20162acf     ntdll!_report_gsfailure+0x140
08 000000a4`f6cce7d0 00007ffb`2017292f     ntdll!_GSHandlerCheck+0x13
09 000000a4`f6cce800 00007ffb`20122554     ntdll!RtlpExecuteHandlerForException+0xf
0a 000000a4`f6cce830 00007ffb`2017143e     ntdll!RtlDispatchException+0x244
0b 000000a4`f6ccef40 00007ffb`20100000     ntdll!KiUserExceptionDispatch+0x2e
0c 000000a4`f6ccf658 00000000`00000001     ntdll!LdrGetProcedureAddressForCaller+0x240
0d 000000a4`f6ccf7b8 0000009c`39700fd8     0x1
0e 000000a4`f6ccf7c0 00000000`00000000     0x0000009c`39700fd8

You see the exception the system received, it was a __fastfail exception. This is because the ntdll!_report_gsfailure function is designed to protect against buffer overflows by checking the integrity of the stack.

Unable to load image \SystemRoot\system32\DRIVERS\vlflt.sys, Win32 error 0n2
0f ffff9783`571172a0 fffff806`6c38fe4c     nt!FsRtlQueryInformationFile+0xfd
10 ffff9783`57117310 fffff806`6c4959c1     vlflt+0x3fe4c
11 ffff9783`57117370 fffff806`69890c65     vlflt+0x1459c1
12 ffff9783`57117610 fffff806`6988e39d     nt!PsCallImageNotifyRoutines+0x165
13 ffff9783`57117680 fffff806`69830dfc     nt!MiMapViewOfImageSection+0x74d
14 ffff9783`57117800 fffff806`6982fe29     nt!MiMapViewOfSection+0x3fc
15 ffff9783`57117950 fffff806`69611d08     nt!NtMapViewOfSection+0x159
16 ffff9783`57117a90 00007ffb`2016da64     nt!KiSystemServiceCopyEnd+0x28
17 00000015`b0f7bb18 00000000`00000000     ntdll!NtMapViewOfSection+0x14

There are 3 things I suspect at this point, First, you should remove BitDefender from the system. https://www.bitdefender.com/uninstall/

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 0000000000000000, page frame number
Arg3: 0000000000000000, current page state
Arg4: 0000000000000005, 0

0X4E means that Windows' PFN list is corrupted. One reason for this is that a driver is using shared memory pages incorrectly. There are no drivers in the dump. At this point, it is normal not a driver.

The remaining duımps are 0x139, 0xA and 0x133. 0x139 does not give any information because it crashed during a swap context. Similarly, 0xA crashes when the system is idle. You need a MEMORY.DMP for 0x133, but the MEMORY.DMP you threw was not for 0x133.

Another thing I recommend at this point is to check your RAM sticks.

1. Download Memtest86 (free), use the imageUSB.exe tool extracted from the download to make a bootable USB drive containing Memtest86 (1GB is plenty big enough). Do this on a different PC if you can, because you can't fully trust yours at the moment.
2. Then boot that USB drive on your PC, Memtest86 will start running as soon as it boots.
3. If no errors have been found after the four iterations of the 13 different tests that the free version does, then restart Memtest86 and do another four iterations. Even a single bit error is a failure.