Windows 10: Frequent BSOD memory_management

Looking through the event log I see 30 of these:
Code: Event[7440]: Log Name: System Source: Microsoft-Windows-Kernel-Boot Date: 2017-06-11T21:20:55.679 Event ID: 29 Task: N/A Level: Error Opcode: Info Keyword: N/A User: S-1-5-18 User Name: NT AUTHORITY\SYSTEM Computer: DESKTOP-L224S2J Description: Windows failed fast startup with error status 0xC00000D4.[/quote] Disable Fast Startup, see if that helps: How to Turn On or Off Fast Startup in Windows 10

 

Hi Rich

I disabled fast startup but still received another IRQL NOT LESS OR EQUAL .

I've attached a new report, in case there's something else in this one.

DESKTOP-L224S2J-16_06_2017__82529_97.zip

Many thanks
George

 

Latest dump shows:
Code: BugCheck A, {8, 2, 1, fffff80145a2db2c} Probably caused by : raspptp.sys ( raspptp!CtlDisconnectCallback+a7 )[/quote] Driver Description: Peer-to-Peer Tunneling Protocol (Microsoft)

Networking definitely involved. Any way you can switch to Ethernet instead of WiFi for awhile for testing purposes? If doing so resolves the problem then we need to look for a newer driver for your Realtek RTL8192CU Wireless LAN 802.11n USB 2.0 Network adapter or replace it.Adapter

 

Hi Rich

The Realtek RTL8192CU Wireless LAN 802.11n USB 2.0 Network Adaptor was replaced prior to the last couple of crashes. I've been running an ASUS PCI-Express WIFI card for a week or two now.

I did go through and delete all the old Realtek USB wifi drivers from the system but this evening I've had another memory_management crash. I've attached the logs, hopefully this one has something interesting!

DESKTOP-L224S2J-Wed_21_Jun_225048_62.zip

Many thanks
George

 

The latest dump shows a problem with dxgmms2.sys.
Code: BugCheck 1A, {41793, ffffe300f8bdcfd8, 1fc, 1fb} *** ERROR: Symbol file could not be found. Defaulted to export symbols for dxgmms2.sys - Probably caused by : dxgmms2.sys ( dxgmms2!VidMmInterface+3c6eb )[/quote] Driver Description: DirectX Graphics MMS

So this is definitely graphics related. I check the driver for your NVIDIA GeForce GTX 950 and it's a bit downlevel:
Version 382.05 dated 1 May 2017. There is a newer version available:
GeForce Game Ready Driver

Version: 382.53 WHQL Release Date: 2017.6.9 Operating System: Windows 10 64-bit Language: English (US) File Size: 423.35 MB


Remove and install latest Nvidia drivers:

I suggest completely uninstalling the Nvidia display drivers using Display Driver Uninstaller (DDU) from WagnardMobile (near bottom of page) then get the latest driver for you Nvidia card here: NVIDIA Driver Downloads

Then do a custom install of only the NVidia graphics driver and the PhysX driver.

See if that gets rid of the problem.

 

If the NVidia does not completely fix the bsod check to see if you are using anything by Wacom.
WTouch User Mode Driver
Please uninstall and reinstall the software/driver for anything Wacom
Can you use a wired connection as above and not use a router while troubleshooting?
WacomPen Wacom Serial Pen HID D Wacom Serial Pen HID D Kernel Manual C:\WINDOWS\system32\drivers\wacompen.sys
wacomrouterf Wacom Router Filter Dr Wacom Router Filter Dr Kernel C:\WINDOWS\system32\drivers\wacomrouterfilter.sys

Are you using Adobe photoshop? lightroom.exe
Can you uninstall and reinstall the software?

Are you using any Garmin products? esu.exe
Can you uninstall and reinstall them?

 

Code: A corruption was discovered in the file system structure on volume WD. A corruption was found in a file system index structure. The file reference number is 0x5000000000005. The name of the file is "\". The corrupted index attribute is ":$I30:$INDEX_ALLOCATION"[/quote]
Code: A corruption was discovered in the file system structure on volume WD. A corruption was found in a file system index structure. The file reference number is 0x5000000000005. The name of the file is "\". The corrupted index attribute is ":$I30:$INDEX_ALLOCATION".[/quote] Code: A corruption was discovered in the file system structure on volume F:. A corruption was found in a file system index structure. The file reference number is 0x3000000000fc1. The name of the file is "\STEAM\steamapps\common\Counter-Strike Global Offensive\csgo\resource\flash\econ\weapons\cached". The corrupted index attribute is ":$I30:$INDEX_ALLOCATION".[/quote] Code: A corruption was discovered in the file system structure on volume WD. A corruption was found in a file system index structure. The file reference number is 0x5000000000005. The name of the file is "\". The corrupted index attribute is ":$I30:$INDEX_ALLOCATION".[/quote] Code: A corruption was discovered in the file system structure on volume D:. A file system index structure contains entries that violate ordering rules. The file reference number is 0xa000000001cd9. The name of the file is "\FLAC". The corrupted index attribute is ":$I30:$INDEX_ALLOCATION". The corrupted subtree is rooted at entry number 0 of the index block located at Vcn 0x5.[/quote]

Code:

[A corruption was discovered in the file system structure on volume D:.
 The exact nature of the corruption is unknown. The file system structures need to be scanned online.
 /CODE]
 
 [CODE][Windows failed fast startup with error status 0xC00000D4./CODE]
 
 [CODE][Crash dump initialization failed!/CODE]
 
 
  Code: The file system structure on volume F: cannot be corrected. Please run the chkdsk utility on the volume F:.[/quote]   Code: The file system structure on volume D: cannot be corrected. Please run the chkdsk utility on the volume D:.[/quote]  
 
 Open administrative command prompt and type or copy and paste:
 1) winver (in the pop up about windows > view your windows version and build > type this information into the thread)
 2) sfc /scannow
 3) dism /online /cleanup-image /restorehealth
 When these have completed > right click on the top bar or title bar of the administrative command prompt box > left click on edit then select all > right click on the top bar again > left click on copy > paste into the thread
 
 
 On each drive please run one of these SMART tests and post images for each drive into the thread:
 [url='http://crystalmark.info/software/CrystalDiskInfo/index-e.html']http://crystalmark.info/software/Cry...o/index-e.html[/url]
 [url]http://www.hdtune.com/[/url]
 [url]https://www.hdsentinel.com/[/url]
 
 
 
 Please plan to open administrative command prompt and type or copy and paste:
 chkdsk /x /f /r
 Please run chkdsk in this format for all of your drives. It may take a long time to run so plan to run overnight.

 

Thanks for your replies ztrucker and zbook,

Updates:

• Updated display drivers
• Removed Wacom drivers (no longer used anyway)
• Win version 15063.413
• SFC & DISM:

Microsoft Windows [Version 10.0.15063]
(c) 2017 Microsoft Corporation. All rights reserved.

C:\WINDOWS\system32>sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.

C:\WINDOWS\system32>dism /online /cleanup-image /restorehealth

Deployment Image Servicing and Management tool
Version: 10.0.15063.0

Image Version: 10.0.15063.0

[==========================100.0%==========================] The restore operation completed successfully.
The operation completed successfully.

• I have already run HDTUNE on all the drives and they all passed (posted 27th May).

• Still to do chkdsk all drives

In the mean time please find my latest BSODs attached in case they offer any other insights.

DESKTOP-L224S2J-Sat_08_Jul_130906_32.zip

Thanks
George

 

Updating with the CHKDSK results



Checking file system on C:
The type of the file system is NTFS.
Volume label is WINDOWS.

A disk check has been scheduled.
Windows will now check the disk.

Stage 1: Examining basic file system structure ...
664320 file records processed. File verification completed.
5198 large file records processed. 0 bad file records processed.
Stage 2: Examining file name linkage ...
821864 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered to lost and found.
Stage 3: Examining security descriptors ...
Cleaning up 697 unused index entries from index $SII of file 0x9.
Cleaning up 697 unused index entries from index $SDH of file 0x9.
Cleaning up 697 unused security descriptors.
Security descriptor verification completed.
78773 data files processed. CHKDSK is verifying Usn Journal...
37603576 USN bytes processed. Usn Journal verification completed.

Stage 4: Looking for bad clusters in user file data ...
664304 files processed. File data verification completed.

Stage 5: Looking for bad, free clusters ...
19386140 free clusters processed. Free space verification is complete.

Windows has scanned the file system and found no problems.
No further action is required.

249478143 KB total disk space.
170913504 KB in 409206 files.
241544 KB in 78774 indexes.
0 KB in bad sectors.
778535 KB in use by the system.
65536 KB occupied by the log file.
77544560 KB available on disk.

4096 bytes in each allocation unit.
62369535 total allocation units on disk.
19386140 allocation units available on disk.

Internal Info:
00 23 0a 00 82 71 07 00 cf 2d 0d 00 00 00 00 00 .#...q...-......
1b 04 00 00 21 00 00 00 00 00 00 00 00 00 00 00 ....!...........

Windows has finished checking your disk.
Please wait while your computer restarts.



Checking file system on D:
The type of the file system is NTFS.
Volume label is WD.

A disk check has been scheduled.
Windows will now check the disk.

Stage 1: Examining basic file system structure ...
94720 file records processed. File verification completed.
1 large file records processed. 0 bad file records processed.
Stage 2: Examining file name linkage ...
107662 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered to lost and found.
Stage 3: Examining security descriptors ...
Cleaning up 2 unused index entries from index $SII of file 0x9.
Cleaning up 2 unused index entries from index $SDH of file 0x9.
Cleaning up 2 unused security descriptors.
Security descriptor verification completed.
6471 data files processed.
Stage 4: Looking for bad clusters in user file data ...
94704 files processed. File data verification completed.

Stage 5: Looking for bad, free clusters ...
82726221 free clusters processed. Free space verification is complete.

Windows has scanned the file system and found no problems.
No further action is required.

511999999 KB total disk space.
180900332 KB in 63561 files.
18392 KB in 6473 indexes.
0 KB in bad sectors.
176391 KB in use by the system.
65536 KB occupied by the log file.
330904884 KB available on disk.

4096 bytes in each allocation unit.
127999999 total allocation units on disk.
82726221 allocation units available on disk.

Internal Info:
00 72 01 00 8b 11 01 00 87 11 01 00 00 00 00 00 .r..............
89 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................



E:\>chkdsk /x /f /r
The type of the file system is NTFS.
Cannot lock current drive.
Volume dismounted. All opened handles to this volume are now invalid.
Volume label is WD.

Stage 1: Examining basic file system structure ...
5120 file records processed.
File verification completed.
0 large file records processed.
0 bad file records processed.

Stage 2: Examining file name linkage ...
6046 index entries processed.
Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered to lost and found.

Stage 3: Examining security descriptors ...
Security descriptor verification completed.
463 data files processed.

Stage 4: Looking for bad clusters in user file data ...
5104 files processed.
File data verification completed.

Stage 5: Looking for bad, free clusters ...
28546316 free clusters processed.
Free space verification is complete.

Windows has scanned the file system and found no problems.
No further action is required.

255999999 KB total disk space.
141734584 KB in 4166 files.
1256 KB in 465 indexes.
0 KB in bad sectors.
78895 KB in use by the system.
65536 KB occupied by the log file.
114185264 KB available on disk.

4096 bytes in each allocation unit.
63999999 total allocation units on disk.
28546316 allocation units available on disk.

E:\>

 

Code: fffff801`cd654638 fffff80b`8eaf1beeUnable to load image nvlddmkm.sys, Win32 error 0n2*** WARNING: Unable to verify timestamp for nvlddmkm.sys*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys nvlddmkm+0x111bee[/quote]
Code: 6 Jul 07:15 Application Error Faulting application name: NVDisplay.Container.exe, version: 1.2.0.0, time stamp: 0x59079e96 Faulting module name: NvXDCore.dll_unloaded, version: 8.17.13.8205, time stamp: 0x59079dd9 Exception code: 0xc0000005 Fault offset: 0x00000000000c1951 Faulting process ID: 0x728 Faulting application start time: 0x01d2f627902f3172 Faulting application path: C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe Faulting module path: NvXDCore.dll Report ID: 5f7bff7c-3cf6-4d53-aa87-1e1917cef640 Faulting package full name: Faulting package-relative application ID:[/quote]

Code: nvlddmkm nvlddmkm nvlddmkm Kernel Manual Running OK TRUE FALSE 5,832,704 6,443,008 0 8 Jun 00:03:57 C:\WINDOWS\system32\DriverStore\FileRepository\n 36,864[/quote]
nvlddmkm.sys nVidia Video drivers Download Drivers | NVIDIA
Get from OEM for laptops


The misbehaving driver is nvlddmkm.sys
This is the Nvidia driver.
Earlier in the thread this driver was replaced.
The driver can be replaced using the Asus web site as a source of computer manufacture approved drivers or can be directly from the Nvidia web site.
Please review the steps that you had made to replace this driver.
If there are several options with revisions on the Asus web site please post all of the options that you see for your computer's serial or product number and the operating system.

 

Hi zbook, thanks very much for your reply.

I'm only getting one blue screen type at the moment which is an IRQ one that happens sometime around Windows shutdown. Fast startup is still disabled though.

I did another full uninstall of all NVidia drivers on the system and then reinstalled the latest one direct from Nvidia. It seems like the general consensus online is to use Nvidias latest however as the card is made by Zotac perhaps I should try the latest from them (despite being slightly older than Nvidias)?

All I could find on Asus website with regards to compatibility for my motherboard was a hardware compatability list that dates back to 2015 - my NVidia chipset is not listed.

Thanks

 

Code: BugCheck A, {8, 2, 1, fffff801cb298b2c}Probably caused by : raspptp.sys ( raspptp!CtlDisconnectCallback+a7 )[/quote] Code: fffff801`cd654638 fffff80b`8eaf1beeUnable to load image nvlddmkm.sys, Win32 error 0n2*** WARNING: Unable to verify timestamp for nvlddmkm.sys*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys nvlddmkm+0x111bee[/quote] Code: 6 Jul 07:15 Application Error Faulting application name: NVDisplay.Container.exe, version: 1.2.0.0, time stamp: 0x59079e96 Faulting module name: NvXDCore.dll_unloaded, version: 8.17.13.8205, time stamp: 0x59079dd9 Exception code: 0xc0000005 Fault offset: 0x00000000000c1951 Faulting process ID: 0x728 Faulting application start time: 0x01d2f627902f3172 Faulting application path: C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe Faulting module path: NvXDCore.dll Report ID: 5f7bff7c-3cf6-4d53-aa87-1e1917cef640 Faulting package full name: Faulting package-relative application ID:[/quote]
nvlddmkm.sys nVidia Video drivers Download Drivers | NVIDIA
Get from OEM for laptops


Code: BugCheck 1A, {41793, ffff8700d7000e88, f, e}Probably caused by : memory_corruption ( nt!MiDeleteVirtualAddresses+11b98e )[/quote]



1) Make sure that there is no over clocking while troubleshooting.


Sometimes there are problems in the bios that produce bsod.

The bios in your computer: BIOS Version/Date American Megatrends Inc. 3701, 31 Mar


Please check to see if this is the most up to date version.


To ensure that there are no improper bios settings please reset the bios.


Sometimes there can be failure to boot after resetting the bios.

So please make sure your files are backed up.

Please make a backup image with Macrium:


Macrium Software | Macrium Reflect Free: Macrium Software | Macrium Reflect Free


And please create a restore point.




How to Clear Your Computers CMOS to Reset BIOS Settings:


How to Clear Your Computers CMOS to Reset BIOS Settings


3 Ways to Reset Your BIOS - wikiHow:


3 Ways to Reset Your BIOS - wikiHow




2) Uninstall all Nvidia drivers/software

The best way to do this is to uninstall everything of Nvidia using Display Driver Uninstaller and install new drivers from Asus.

If there are no suitable Asus approved drivers then download from the Nvidia web site.

When you do this be sure the "clean install" box is checked and only install the Graphics driver and the PhysX driver.

Display Driver Uninstaller Download version 17.0.6.7: Official Display Driver Uninstaller DDU Download

 

Hi zbook,

I have performed your suggestions 1) & 2).

However, I get the same old memory management BSOD and an occasional IRQ one at shutdown.

This is all despite doing a clean install of latest NVIDIA (using DDU) and several weeks ago installing a different Wireless Network Card.

Yesterday, to take the Nvidia card out of the equation, I installed an ATI Firepro (workstation) Graphics card (doing a full video driver uninstall before doing so). This has been in for 24 hours and no memory management errors but today I did have the IRQ one.

I've attached my latest reports.
DESKTOP-L224S2J-Fri_11_Aug_210605_51.zip

Kind regards
George

 

There was 1 bsod today and yesterday and there were no definitive misbehaving drivers.

Are you still using Fengato software (dvdfab.sys) or was this software uninstalled?

Windows driver verifier is a tool that is used to find misbehaving drivers.
It will repetitively produce bsod until the misbehaving drivers are fixed or until the tool is turned off.

Before using this tool make sure startup and recovery settings have automatic restart unchecked so that you have time to view the bsod window. When windows driver verifier is used there is often a stop code displayed: driver verifier detected violation. Sometimes the misbehaving driver is posted in the form *.sys. If you see it on the bsod window please record the misbehaving driver and post it into the thread.

Microsoft Community

After each bsod you will need to turn off windows driver verifier and return to the desktop. It is important to get comfortable with these methods before using the tool.

Open administrative command prompt and type: shutdown /r /o /f /t 00
The computer should reboot to the windows advanced troubleshooting menu.
Navigate to each of these:
1) startup options (not startup repair) > select #6 safe mode with command prompt > type: verifier /reset
2) command prompt > opens Administrator X: \Windows\system32\cmd.exe > type: verifier /bootmode resetonbootfail
3) restore
The above commands should always be used in the order above to turn off windows driver verifier. If restore is used the bsod mini dump file will likely disappear and little progress will be made in the troubleshooting.

To turn on windows driver verifier and to customize the testing use the information in this link:
Microsoft Community

For information on turning off windows driver verifier see this link:
Enable and Disable Driver Verifier in Windows 10 Windows 10 Performance Maintenance Tutorials

Before using windows driver verifier perform the following steps:
1) create a brand new restore point
2) backup files to another drive or to the cloud
3) make an image of the drive using Macrium: Macrium Software | Your Image is Everything
4) save the Macrium image on a drive other than the drive that is being tested with windows driver verifier.

Download and install these two software applications so that you can run them each time you return to the desktop:
Blue screen of death (STOP error) information in dump files.
Resplendence Software - WhoCrashed, automatic crash dump analyzer

As the bsod occur please post a new zip: BSOD - Posting Instructions - Windows 10 Forums


Code: BugCheck A, {8, 2, 1, fffff802feeabb2c}Probably caused by : raspptp.sys ( raspptp!CtlDisconnectCallback+a7 )[/quote] Code: BugCheck 1A, {41793, ffff84009cb54ec8, 13, 12}Probably caused by : memory_corruption ( nt!MiDeleteVirtualAddresses+11b980 )[/quote]
Code: Event[13728]: Log Name: System Source: Microsoft-Windows-Kernel-PnP Date: 2017-08-10T18:45:18.839 Event ID: 219 Task: N/A Level: Warning Opcode: Info Keyword: N/A User: S-1-5-18 User Name: NT AUTHORITY\SYSTEM Computer: DESKTOP-L224S2J Description: The driver \Driver\dvdfab failed to load for the device USBSTOR\CdRom&Ven_PLEXTOR&Prod_BD-ROM_PX-B120U&Rev_1.11\6666666666666669FD6&0.[/quote] dvdfab.sys DVDFab Passkey x86 Driver by Fengtao Software Inc Support: http://www.dvdfab.com/support.htm
Downloads: http://www.dvdfab.com/download.htm

 

Hi zbook,

Regarding dvdfab.sys I reinstalled this as it's absence didn't make any difference. Would you like me to uninstall again?

Today I got a memory management bsod so to me that suggests that the issue wasn't NVidia specific (as I'm now running an ATI workstation card).

I ran driver verifier with the suggested settings (thank you for the link) however when I rebooted all I got was the Windows splash logo (nothing else) and it just hung there. I have now reverted to a restore point. What's going on here?

Many thanks (as always)
George