Windows 10: BSOD Probably caused by : memory_corruption

Hi,


My computer frequently has BSOD. I have used windbg to analyze 800mb dump file as attached bellow:

please help , thank you!

Microsoft (R) Windows Debugger Version 10.0.17763.1 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\lojason\Desktop\LogSubmit\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.


************* Path validation summary **************
Response Time (ms) Location
Deferred SRV* C:\Symbols *https://msdl.microsoft.com/download/symbols
Symbol search path is: SRV* C:\Symbols *https://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 10 Kernel Version 17134 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 17134.1.amd64fre.rs4_release.180410-1804
Machine Name:
Kernel base = 0xfffff800`76a92000 PsLoadedModuleList = 0xfffff800`76e4c1f0
Debug session time: Tue Oct 9 09:41:18.421 2018 (UTC + 8:00)
System Uptime: 0 days 15:30:34.265
Loading Kernel Symbols
...............................................................
................................................................
................................................................
..................................
Loading User Symbols

Loading unloaded module list
......................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 139, {3, ffffd18c7b33f4b0, ffffd18c7b33f408, 0}

Probably caused by : memory_corruption

Followup: memory_corruption
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffffd18c7b33f4b0, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffffd18c7b33f408, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------


KEY_VALUES_STRING: 1


STACKHASH_ANALYSIS: 1

TIMELINE_ANALYSIS: 1


DUMP_CLASS: 1

DUMP_QUALIFIER: 401

BUILD_VERSION_STRING: 17134.1.amd64fre.rs4_release.180410-1804

SYSTEM_MANUFACTURER: LENOVO

SYSTEM_PRODUCT_NAME: 20F5S1Y60F

SYSTEM_SKU: LENOVO_MT_20F5_BU_Think_FM_ThinkPad X260

SYSTEM_VERSION: ThinkPad X260

BIOS_VENDOR: LENOVO

BIOS_VERSION: R02ET58W (1.31 )

BIOS_DATE: 07/19/2017

BASEBOARD_MANUFACTURER: LENOVO

BASEBOARD_PRODUCT: 20F5S1Y60F

BASEBOARD_VERSION: SDK0J40697 WIN

DUMP_TYPE: 1

BUGCHECK_P1: 3

BUGCHECK_P2: ffffd18c7b33f4b0

BUGCHECK_P3: ffffd18c7b33f408

BUGCHECK_P4: 0

TRAP_FRAME: ffffd18c7b33f4b0 -- (.trap 0xffffd18c7b33f4b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffba830c352750 rbx=0000000000000000 rcx=0000000000000003
rdx=ffffba83157cfee0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80076c64360 rsp=ffffd18c7b33f640 rbp=0000000000000745
r8=00000000ffffffff r9=7fffba830ba4c400 r10=fffff800736c6180
r11=0000000000000040 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po cy
nt!ExDeleteResourceLite+0x172680:
fffff800`76c64360 cd29 int 29h
Resetting default scope

EXCEPTION_RECORD: ffffd18c7b33f408 -- (.exr 0xffffd18c7b33f408)
ExceptionAddress: fffff80076c64360 (nt!ExDeleteResourceLite+0x0000000000172680)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY

CPU_COUNT: 4

CPU_MHZ: 9c0

CPU_VENDOR: GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 4e

CPU_STEPPING: 3

CPU_MICROCODE: 6,4e,3,0 (F,M,S,R) SIG: BE'00000000 (cache) BE'00000000 (init)

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

BUGCHECK_STR: 0x139

PROCESS_NAME: System

CURRENT_IRQL: 2

DEFAULT_BUCKET_ID: FAIL_FAST_CORRUPT_LIST_ENTRY

ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE_STR: c0000409

EXCEPTION_PARAMETER1: 0000000000000003

ANALYSIS_SESSION_HOST: ISCNPC0TCPC8

ANALYSIS_SESSION_TIME: 10-09-2018 17:22:44.0479

ANALYSIS_VERSION: 10.0.17763.1 x86fre

STACK_TEXT:
ffffd18c`7b33f188 fffff800`76c3ae69 : 00000000`00000139 00000000`00000003 ffffd18c`7b33f4b0 ffffd18c`7b33f408 : nt!KeBugCheckEx
ffffd18c`7b33f190 fffff800`76c3b210 : ffffba83`141f02b0 fffff800`76ba9de1 ffffba83`141f02b0 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffffd18c`7b33f2d0 fffff800`76c3981f : ffffba83`160d0c88 00000000`00000000 ffffba83`0ba4c030 ffffaa88`fd01c810 : nt!KiFastFailDispatch+0xd0
ffffd18c`7b33f4b0 fffff800`76c64360 : ffffd18c`7b33f6e0 fffff80c`324f7fa0 ffffaa88`fd01c600 fffff80c`3240feef : nt!KiRaiseSecurityCheckFailure+0x2df
ffffd18c`7b33f640 fffff80c`32411170 : 00000000`00000745 ffffd18c`00000000 ffffba83`0d0b1a00 ffffba83`160d0c88 : nt!ExDeleteResourceLite+0x172680
ffffd18c`7b33f690 fffff80c`324c899f : 00000000`00000745 ffffba83`0d0b1a00 00000000`00000001 ffffba83`160d0c88 : Ntfs!NtfsFreeNonpagedDataFcb+0x20
ffffd18c`7b33f6c0 fffff80c`323fe45d : ffffba83`160d0c88 ffffaa88`f5d62100 ffffaa88`00000000 00000000`00000000 : Ntfs!NtfsDeleteFcb+0x4cf
ffffd18c`7b33f740 fffff80c`324c8cab : ffffba83`160d0c88 ffffba83`0ba4c180 ffffaa88`fd01c6c0 ffffaa88`fd01caf8 : Ntfs!NtfsTeardownFromLcb+0x1fd
ffffd18c`7b33f7e0 fffff80c`3240155a : ffffba83`160d0c88 ffffd18c`7b33f8e1 ffffaa88`fd01caf8 ffffba83`160d0c88 : Ntfs!NtfsTeardownStructures+0xeb
ffffd18c`7b33f860 fffff80c`324d3b9c : ffffd18c`7b33fa00 ffffaa88`00000000 fffff80c`00000000 ffffba83`160d0c88 : Ntfs!NtfsDecrementCloseCounts+0xaa
ffffd18c`7b33f8a0 fffff80c`324f8187 : ffffba83`160d0c88 ffffaa88`fd01c810 ffffaa88`fd01c6c0 ffffba83`0ba4c180 : Ntfs!NtfsCommonClose+0x44c
ffffd18c`7b33f9a0 fffff80c`324f7faf : 00000000`00000000 ffffba83`167cd040 ffffba83`0ba75830 ffffba83`0ba75830 : Ntfs!NtfsFspCloseInternal+0x1c7
ffffd18c`7b33fad0 fffff800`76ad4315 : 00000000`00000200 fffff800`76d02900 ffffba83`0ba75830 fffff800`76e6e8a0 : Ntfs!NtfsFspClose+0xf
ffffd18c`7b33fb00 fffff800`76b76cb7 : ffffba83`167cd040 00000000`00000080 ffffba83`0ba71040 ffffba83`167cd040 : nt!ExpWorkerThread+0xf5
ffffd18c`7b33fb90 fffff800`76c317d6 : ffff8280`b20c0180 ffffba83`167cd040 fffff800`76b76c70 000001cf`570e5ae8 : nt!PspSystemThreadStartup+0x47
ffffd18c`7b33fbe0 00000000`00000000 : ffffd18c`7b340000 ffffd18c`7b339000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16


THREAD_SHA1_HASH_MOD_FUNC: 2052fb158b8f728fcb34e2b3fa44f73e09383d8b

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 0df948c287f28a54167085453b91ed984301d068

THREAD_SHA1_HASH_MOD: baf72ea6dc105da5d0f2fb8a45027cf1bace7247

FOLLOWUP_NAME: memory_corruption

MODULE_NAME: memory_corruption

IMAGE_NAME: memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

STACK_COMMAND: .thread ; .cxr ; kb

FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_IMAGE_memory_corruption

BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_IMAGE_memory_corruption

PRIMARY_PROBLEM_CLASS: 0x139_3_CORRUPT_LIST_ENTRY_IMAGE_memory_corruption

TARGET_TIME: 2018-10-09T01:41:18.000Z

OSBUILD: 17134

OSSERVICEPACK: 0

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 272

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2018-06-08 17:00:00

BUILDDATESTAMP_STR: 180410-1804

BUILDLAB_STR: rs4_release

BUILDOSVER_STR: 10.0.17134.1.amd64fre.rs4_release.180410-1804

ANALYSIS_SESSION_ELAPSED_TIME: 13f7

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0x139_3_corrupt_list_entry_image_memory_corruption

FAILURE_ID_HASH: {6b711939-e5de-38cb-287e-eb7d8c867a90}

Followup: memory_corruption
---------

0: kd>
ExceptionAddress: fffff80076c64360 (nt!ExDeleteResourceLite+0x0000000000172680)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY

:)

 

Windows 10 BSOD (memdump says probably "memory_corruption")

Hi there,

I have been having bsod problems with this pc. It crashes randomly without any warning about once a day and displays a different bsod message every time.

I tried analyzing the memory dumps. "!analyze -v" indicates that it's probably caused by "memory_corruption". However, I don't know whether it is caused by bad ram/slot or by an application.

I have not yet run memtest but will do so shortly.

Here is the link to the memory dumps and system info :

https://drive.google.com/open?id=0B46vJwN2gxKrOUExSnR5d2VpdXM

If gdrive doesn't work :

http://www.filedropper.com/crashlogs

 

BSOD Probably caused by : memory_corruption?

Hello,

We need log files(called dump files) that tell us what lead to crash.

Please share them with us for a better analysis of the problem. Instructions can be found here:

http://answers.microsoft.com/en-us/windows/wiki...

 

BSOD Probably caused by : memory_corruption?

Hi Chase, I am Rob, a volunteer and a 10 time and dual award MVP specializing in Windows troubleshooting and Bluescreen analysis. Please remember as volunteers we are not responsible for the development of Windows or the computer hardware and drivers.

Below are methods to troubleshoot and try to fix the issue as well as how to post the DMP files so I can do a detailed analysis to see if we can glean more from it.

Methods to troubleshoot if you really want to, however, I do not recommend doing so on a brand new computer.

Troubleshoot blue screen errors <-- read this link

http://windows.microsoft.com/en-us/windows-10/t...

We can analyze the minidumps if you make them available from the OneDrive or other file sharing sites (such as MediaFire). If you have problems uploading the minidumps copy them to the Desktop or the Documents folder and upload them from there.

One-Drive - Share files and folders and change permissions

http://windows.microsoft.com/en-us/onedrive/sha...

Upload photos and files

http://windows.microsoft.com/en-us/onedrive/add...

Zip or upload the contents of C:\Windows\minidump

Use OneDrive to upload collected files

http://social.technet.microsoft.com/Forums/en-U...

=====

Check these resources :

Troubleshoot blue screen errors <-- read this link

http://windows.microsoft.com/en-us/windows-10/t...

BCCode: 0A 0x0000000A

Drivers could be at fault, however, disk issues or antivirus/antispyware/security products are just as likely to be the root cause as they can force a driver to corrupt or go out of bounds. The video driver or something affecting it would be very suspect.

Be sure the drivers, BIOS, and low-level chipset drivers are all updated by

manually checking at the System maker and device makers' sites.

BBCode: A 0x000000A <-- read this link

http://www.faultwire.com/solutions-fatal_error/...*1025.html?order=votes

This utility makes it easy to see which versions are loaded: Run DriverView - set VIEW to Hide Microsoft drivers - update those without Dump in their names. (Also update the BIOS and low-level chipset drivers.)

DriverView - Free - utility displays the list of all device drivers currently loaded on your system. For each driver in the list, additional useful information is displayed: load address of the driver, description, version, product name, company that created
the driver, and more.

http://www.nirsoft.net/utils/driverview.html

For Drivers check System Maker as fallbacks and Device Maker's which are the most current. Right Click the Start Button - Device Manager - Display Adapter - write down the make and complete model of your video adapter - double click - Driver's tab - write down
the version info. Now click UPdate Driver (this may not do anything as MS is far behind certifying drivers) - then Right Click - Uninstall - REBOOT this will refresh the driver stack.

Repeat that for Network - Network Card (NIC), Wifi, Sound, Mouse and Keyboard if 3rd party with their own software and drivers and any other major device drivers you have.

Now go to System Maker's site (Dell, HP, Toshiba as examples) (as rollback) and then Device Maker's site (Realtek, Intel, Nvidia, ATI as examples) and get their latest versions. (Look for BIOS, Chipset, and software updates at System Maker's site while there.)

Download - SAVE - go to where you put them - Right Click - RUN AD ADMIN - REBOOT after each installation.

Always check in Device Manager - Drivers tab to be sure the version you are installing actually shows up. This is because some drivers rollback before the latest is installed (sound drivers particularly do this) so install a driver - reboot - check to be sure
it is installed and repeat as needed.

Repeat at Device Makers - BTW at Device Makers DO NOT RUN THEIR SCANNER - check manually by model.

Manually look at manufacturer's sites for drivers - and Device Maker's sites.

http://pcsupport.about.com/od/driverssupport/ht...

=====

Memory tests do not catch all errors such as mismatched memory (possible even for sticks that appear to be identical) and when faster memory is placed in the system behind slower memory. So it is best to also swap sticks in and out to check for those even if
all memory tests fail to show a problem.

To test RAM check here - let it run 4+ hours or so. <-- best method

www.memtest.org

MemTestX86 - Test RAM With

http://www.tenforums.com/tutorials/14201-memtes...

For the Windows Memory Diagnostic Tool.

Type in Cortana's search box -> Memory - find Memory Diagnostics tool

at top of list - click it - in Windows 8/8.1/10 the name is "Windows

Memory Diagnostic".

How to Run the Memory Diagnostics Tool in Windows 10 - name is

"Windows Memory Diagnostic" - Control Panel - Security and Maintenance - Administrative Tools - look for the tool.

======

After doing ALL the updates you can, and if the issue continues, then run

DriverVerifier.

Driver Verifier can help find some BSOD issues :

Using Driver Verifier to identify issues with Windows drivers for advanced users

http://support.microsoft.com/kb/244617

How To Troubleshoot Driver Problems in Windows Vista or 7. (8/8.1 and 10 are essentially the same).

http://www.winvistaclub.com/t79.html

Using Driver Verifier

https://msdn.microsoft.com/en-us/library/window...

WINKEY + X - RUN - type in -> verifier /reset hit enter to disable

If DriverVerifier creates a minidump upload it and post the link here so we can analyze it.

Please let us know the results and if you need further assistance.