1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

MEMORY_MANAGEMENT; win32k.sys BSOD

Discussion in 'Windows 7' started by tmcribbs, Jan 21, 2017.

Thread Status:
Not open for further replies.
Advertisement
  1. tmcribbs

    tmcribbs Thread Starter

    Joined:
    Jan 21, 2017
    Messages:
    6
    Environment:
    MSI X58M MoBo
    16Gb Corsair 1333 RAM (4x 4Gb) populated as such 11-01-01 (6 slots)
    Intel i7 960 3.2 Ghz Quad Core
    Chrome (up to date) with no extensions enabled


    Built in 2011 by me.

    Hello, I've been experiencing random bsod's the past few months. Initially it began when I upgraded to Windows 10 about 9 months ago(?). They were primarily memory management BSODs, so hypothesized my MoBo wasn't compatible with Win10 (they offered no Win10 drivers). So I rolled back about 2 months ago to Windows 7 (I prefer 7 anyway). Then the memory issues continued, among others. Windows memory check always showed no issues with my RAM. Then I tried MemTest86 and identified 2 bad RAM sticks (I had 24Gb). So I removed the 2 bad ones and the remaining 16Gb has showed no errors after several follow on tests. After a couple PFN BSOD's, I blew out my pagefile and let windows rebuild it after the memory downgrade. The BSODs are less frequent now and don't happen during my son's Minecraft sessions anymore. Today it was just me surfing the web.

    Dump attached.

    Thanks in advance.

    Tim
     

    Attached Files:

  2. Sponsor

  3. Macboatmaster

    Macboatmaster Trusted Advisor

    Joined:
    Jan 14, 2010
    Messages:
    18,186
    It is either a hardware problem or a driver problem I tend to suspect the latter
    However lets assure ourselves that it is not a hard drive problem
    Run a chkdsk /r on the Windows drive usually lettered C

    Cmd prompt with admin rights
    at C prompt type

    chkdsk /r
    press enter
    agree to run on restart by typing Y
    if first reply asks if you wish to force dismount type N
    second response should be do you wish to run on restart

    DO so and then on completion go control panel admin tools event viewer
    expand windows logs left pane
    application log
    click find right pane
    type
    wininit

    click find next
    check it is the recently run chkdsk log
    copy to clipboard
    paste to reply please
     
  4. tmcribbs

    tmcribbs Thread Starter

    Joined:
    Jan 21, 2017
    Messages:
    6

    Thanks... here's that chkdsk log:

    Checking file system on C:
    The type of the file system is NTFS.

    A disk check has been scheduled.
    Windows will now check the disk.

    CHKDSK is verifying files (stage 1 of 5)...
    Cleaning up instance tags for file 0xe860.
    279808 file records processed. File verification completed.
    1920 large file records processed. 0 bad file records processed. 2 EA records processed. 63 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)...
    360472 index entries processed. Index verification completed.
    0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)...
    279808 file SDs/SIDs processed. Cleaning up 995 unused index entries from index $SII of file 0x9.
    Cleaning up 995 unused index entries from index $SDH of file 0x9.
    Cleaning up 995 unused security descriptors.
    CHKDSK is compacting the security descriptor stream
    40333 data files processed. CHKDSK is verifying Usn Journal...
    34111440 USN bytes processed. Usn Journal verification completed.
    CHKDSK is verifying file data (stage 4 of 5)...
    279792 files processed. File data verification completed.
    CHKDSK is verifying free space (stage 5 of 5)...
    7242038 free clusters processed. Free space verification is complete.
    CHKDSK discovered free space marked as allocated in the
    master file table (MFT) bitmap.
    Correcting errors in the Volume Bitmap.
    Windows has made corrections to the file system.

    124571647 KB total disk space.
    95067480 KB in 234514 files.
    151660 KB in 40336 indexes.
    0 KB in bad sectors.
    384351 KB in use by the system.
    65536 KB occupied by the log file.
    28968156 KB available on disk.

    4096 bytes in each allocation unit.
    31142911 total allocation units on disk.
    7242039 allocation units available on disk.

    Internal Info:
    00 45 04 00 ab 31 04 00 90 b0 07 00 00 00 00 00 .E...1..........
    aa 01 00 00 3f 00 00 00 00 00 00 00 00 00 00 00 ....?...........
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

    Windows has finished checking your disk.
    Please wait while your computer restarts.
     
  5. Macboatmaster

    Macboatmaster Trusted Advisor

    Joined:
    Jan 14, 2010
    Messages:
    18,186
    Thanks nothing wrong there to cause concern

    Send please the actual dump file rather then the partial analysis of it
    attach it please as you did the txt file

    When you reply please just type in the box that appears when you return to the topic rather than by clicking reply on my post, as that quotes back to me all I have just posted.

    Go here

    https://www.msi.com/Motherboard/support/X58M.html#down-driver&Win7 64
    update the audio and Ethernet drivers - new issues 3 Jan 2017
     
  6. tmcribbs

    tmcribbs Thread Starter

    Joined:
    Jan 21, 2017
    Messages:
    6
    Happened again, only this time the graphics went gray in the middle of playing Minecraft. I have the dump file, tried to upload it but it said the dmp extension is not allowed. So I just changed the file extension to txt.

    Am I reading that right? Processor failure? Or could it be on the GPU?

    (I installed those new drivers the day you suggested to.)
     

    Attached Files:

  7. Macboatmaster

    Macboatmaster Trusted Advisor

    Joined:
    Jan 14, 2010
    Messages:
    18,186
    Sorry since my post of 27 Jan I have dealt with and are dealing with many other topics
    Too busy to help at this time
    As an aside issue can you read the attached because I cannot if you simply change a dump to txt it is not readable

    send it as you sent the other one - analysed
     
  8. tmcribbs

    tmcribbs Thread Starter

    Joined:
    Jan 21, 2017
    Messages:
    6
    Thanks for your time. Before I go purchasing a new MoBo and Proc, I'm just making sure that's the problem.


    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Windows\Minidump\020317-11718-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV*C:\WINDOWS\Symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7601.23572.amd64fre.win7sp1_ldr.161011-0600
    Machine Name:
    Kernel base = 0xfffff800`03411000 PsLoadedModuleList = 0xfffff800`03653730
    Debug session time: Fri Feb 3 19:38:56.890 2017 (UTC - 8:00)
    System Uptime: 0 days 0:00:06.953
    Loading Kernel Symbols
    ....................................................
    Loading User Symbols
    Mini Kernel Dump does not contain unloaded driver list
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 124, {0, fffffa800e4da038, 0, 0}

    Probably caused by : hardware

    Followup: MachineOwner
    ---------

    3: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    WHEA_UNCORRECTABLE_ERROR (124)
    A fatal hardware error has occurred. Parameter 1 identifies the type of error
    source that reported the error. Parameter 2 holds the address of the
    WHEA_ERROR_RECORD structure that describes the error conditon.
    Arguments:
    Arg1: 0000000000000000, Machine Check Exception
    Arg2: fffffa800e4da038, Address of the WHEA_ERROR_RECORD structure.
    Arg3: 0000000000000000, High order 32-bits of the MCi_STATUS value.
    Arg4: 0000000000000000, Low order 32-bits of the MCi_STATUS value.

    Debugging Details:
    ------------------


    BUGCHECK_STR: 0x124_GenuineIntel

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

    PROCESS_NAME: System

    CURRENT_IRQL: 0

    STACK_TEXT:
    fffff880`033696f0 fffff800`036d0cb9 : fffffa80`0e4da010 fffffa80`0cdc3660 fffffa80`0e410750 00000000`00000000 : nt!WheapCreateLiveTriageDump+0x6c
    fffff880`03369c10 fffff800`035b0297 : fffffa80`0e4da010 fffff800`0362a2d8 fffffa80`0cdc3660 00000000`00000000 : nt!WheapCreateTriageDumpFromPreviousSession+0x49
    fffff880`03369c40 fffff800`03517b95 : fffff800`0368cba0 00000000`00000001 fffffa80`0df25820 fffffa80`0cdc3660 : nt!WheapProcessWorkQueueItem+0x57
    fffff880`03369c80 fffff800`0348a355 : fffff880`0110ee00 fffff800`03517b70 fffffa80`0cdc3600 00000000`0000055a : nt!WheapWorkQueueWorkerRoutine+0x25
    fffff880`03369cb0 fffff800`0371c236 : 00000000`00000000 fffffa80`0cdc3660 00000000`00000080 fffffa80`0cd95b10 : nt!ExpWorkerThread+0x111
    fffff880`03369d40 fffff800`03472706 : fffff880`03186180 fffffa80`0cdc3660 fffff880`031910c0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
    fffff880`03369d80 00000000`00000000 : fffff880`0336a000 fffff880`03364000 fffff880`041e3790 00000000`00000000 : nt!KiStartSystemThread+0x16


    STACK_COMMAND: kb

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: hardware

    IMAGE_NAME: hardware

    DEBUG_FLR_IMAGE_TIMESTAMP: 0

    FAILURE_BUCKET_ID: X64_0x124_GenuineIntel_PROCESSOR_MAE_PRV

    BUCKET_ID: X64_0x124_GenuineIntel_PROCESSOR_MAE_PRV

    Followup: MachineOwner
    ---------

    3: kd> lmvm hardware
    start end module name
    Mini Kernel Dump does not contain unloaded driver list
     
  9. Macboatmaster

    Macboatmaster Trusted Advisor

    Joined:
    Jan 14, 2010
    Messages:
    18,186
    I will assist you and attempt to solve it for you
    However these issues can take a log time to solve and hours of work analysing logs

    Therefore and I hope you understand I am only prepared to help with your assurance that you will stay with it until I solve it or advise you that I cannot.
    Also it is no use you taking more than couple of days to reply to each post, except of course if you tell me you will be unable to reply for personal reasons etc, on the odd occasion, as a week or so between my post and your replies makes it hard to keep up to date with where we are.

    So if you do wish me to try = acknowledge this post please and then we may proceed
    The first and as I said only one of MANY is to download this
    https://www.sysnative.com/blogs/download/sysnativebsodcollectionapp-exe/#

    save it to your documents folder, then close all apps and open the doc folder and right click the file
    when it completes it will save to the documents folder a zipped file
    attach that to your reply please
     
    Last edited: Feb 5, 2017
  10. tmcribbs

    tmcribbs Thread Starter

    Joined:
    Jan 21, 2017
    Messages:
    6
    Actually my wife is in the hospital for surgery today, so I'll be a little slower than you'd like for the next couple days.

    Also, I took a couple weeks to respond because it took a couple weeks to crash again. I didn't want to prematurely call it fixed - and I'm glad I didn't. I've responded to you within 24 hours every time except after updating the drivers and waiting for the next crash.
     
  11. Macboatmaster

    Macboatmaster Trusted Advisor

    Joined:
    Jan 14, 2010
    Messages:
    18,186
    No problem whatsoever
    Best wishes for your wife`s surgery
    Please do take as long as you wish in view of the circumstances - as indeed I said
    Whenever you are ready send the attachment as requested and I will ensure that I stay on top of the issue.

    My comment regarding reply was in reference to my request at post 4 on 22 Jan
    and not with any suggestion that you should call it fixed
     
    Last edited: Feb 6, 2017
  12. tmcribbs

    tmcribbs Thread Starter

    Joined:
    Jan 21, 2017
    Messages:
    6
    Here it is..
     

    Attached Files:

  13. Macboatmaster

    Macboatmaster Trusted Advisor

    Joined:
    Jan 14, 2010
    Messages:
    18,186
    1. Cheers Will post when I have had a look
    As you may have seen lot to examine

    2. Hope as I said - good result for your wife.

    3. ON initial examination and it is only the first item I noticed this
    Seagate Central NAS 1D N/A FALSE N/A
    is shown as a problem device with no driver found
    Is it connected please

    4. There is a reported problem with this driver
    Problem signature:

    P2: PCI\VEN_1002&DEV_68BE&SUBSYS_200A1787&REV_00

    which is this
    Device Id Chip Description Vendor Id Vendor Name
    0x68BE ATI Radeon HD 5700 Series 0x1002 Advanced Micro Devices, Inc.
    Please download the latest offered CERTIFIED WHQL driver do not install
    Please uninstall the driver from programs and features
    reboot and install the saved driver

    5. I have spent the last hour or so looking at two of the dumps and some of the various data in the attachment I asked for which of course has all your dumps

    6. There are two main likely causes
    1. Is the Video driver above
    2. Is McAfee

    7. IMHO and it is only my opinion McAfee has apparently been responsible for causing quite a few problems. It seems to be more frequent of late.
    They are as you may know part of Intel

    8. I presume you have the means to reinstall and IF you do I recommend its uninstall - completely even if only for testing purposes.
    I think I am correct in saying McAfee has its own firewall - that would account for an error report on the Windows firewall in one of the attachments I examined.

    9. If you are going to follow my recommendations disable all of McAfee
    Uninstall using programs and features
    REBOOT
    Run the McAfee tool
    All details on the link below
    and REBOOT


    https://service.mcafee.com/webcenter/portal/cp/home/articleview;jsessionid=HzIbXpf-16pbTPJM-Gul4F38f6P-fA4K0ai5Dz6P7VZKpcgQCOSu!-999656206!1139496553?articleId=TS101331&_afrLoop=430923168774993#!@@?_afrLoop=430923168774993&articleId=TS101331&centerWidth=100%25&leftWidth=0%25&rightWidth=0%25&showFooter=false&showHeader=false&_adf.ctrl-state=qfpu1avz8_4

    AND if your McAfee includes the Optimisation tools - well generally speaking I like to leave Windows to optimize its own system.

    10. I know you will always get a difference of opinion but although 8 and 10 are better at managing their own systems, than perhaps 7 is I find it hard to believe that a 3rd party can offer better system optimisation tools for a Windows OS than Microsoft do.

    11. WHEN you have uninstalled McAfee download and run MSE
    https://support.microsoft.com/en-gb/help/14210/security-essentials-download

    update it and ensure it is turned on.

    12. Check that Windows firewall is also turned on.

    13. Test the computer for a few days.
    IF it crashes again send the dump please
    IF it does not then you will have to choose whether you stay with MSE supported by a free scan on demand with malwarebytes FREE version or you choose another AV.
    Personally I would stay with MSE but the choice is yours.

    14. NOTE
    DO NOT update the driver for the video AND uninstall McAfee at the same time otherwise you will NOT know if it does solve the crash which is responsible.

    15. My money at the moment is on McAfee

    Therefore update driver and test
    If it still crashes McAfee and test
     
    Last edited: Feb 7, 2017
  14. Macboatmaster

    Macboatmaster Trusted Advisor

    Joined:
    Jan 14, 2010
    Messages:
    18,186
    As I posted before on post 10 - 6 Feb
    Please if possible just post to reassure me you are continuing when you get chance.
    Otherwise I can delete my saved next steps - pre prepared - if you are not for some reason

    Thanks
     
  15. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/1184210