BSOD, possibly bad RAM

[Nesagsar]

I'm getting very frequent BSOD crashes with no known cause. Crash dumps below.

On Thu 4/12/2018 4:54:31 PM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\Minidump\041218-13265-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x175930)
Bugcheck code: 0xC1 (0xFFFFDB0376AEA9D0, 0xFFFFDB0376AEA51E, 0x9B0628, 0x32)
Error: SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that the driver wrote to an invalid section of the special pool.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Thu 4/12/2018 4:54:31 PM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\MEMORY.DMP
This was probably caused by the following module: ntkrnlmp.exe (nt+0x175930)
Bugcheck code: 0xC1 (0xFFFFDB0376AEA9D0, 0xFFFFDB0376AEA51E, 0x9B0628, 0x32)
Error: SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION
Bug check description: This indicates that the driver wrote to an invalid section of the special pool.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Wed 4/11/2018 12:52:01 PM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\Minidump\041118-13140-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x175930)
Bugcheck code: 0xA (0xFFFF800172AFE740, 0x2, 0x1, 0xFFFFF800951D2F38)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above. This is a software bug.
This bug check belongs to the crash dump test that you have performed with WhoCrashed or other software. It means that a crash dump file was properly written out.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Tue 4/10/2018 8:36:45 PM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\Minidump\041018-15281-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x175510)
Bugcheck code: 0xA (0xFFFFA48BEDBED740, 0x2, 0x1, 0xFFFFF80272A468B8)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above. This is a software bug.
This bug check belongs to the crash dump test that you have performed with WhoCrashed or other software. It means that a crash dump file was properly written out.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Mon 4/9/2018 4:32:47 PM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\Minidump\040918-14578-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x175510)
Bugcheck code: 0xA (0xFFFF8F8403F360C0, 0x2, 0x1, 0xFFFFF8033F3BD8B8)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above. This is a software bug.
This bug check belongs to the crash dump test that you have performed with WhoCrashed or other software. It means that a crash dump file was properly written out.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Sat 4/7/2018 2:08:36 AM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\Minidump\040718-13031-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x175510)
Bugcheck code: 0xA (0xFFFFBC0B027170C0, 0x2, 0x1, 0xFFFFF800F44548B8)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above. This is a software bug.
This bug check belongs to the crash dump test that you have performed with WhoCrashed or other software. It means that a crash dump file was properly written out.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Fri 4/6/2018 5:55:56 PM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\Minidump\040618-11984-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x175510)
Bugcheck code: 0x4E (0x9A, 0x0, 0x0, 0x0)
Error: PFN_LIST_CORRUPT
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that the page frame number (PFN) list is corrupted.
This bug check belongs to the crash dump test that you have performed with WhoCrashed or other software. It means that a crash dump file was properly written out.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.
 

[Augmentum]

You can try to run memtest86 to rule our ram?

[another random person]

Try running sfc system scan to determine if any core system files are corrupted. 

You can get to it by opening command prompt as an administrator and then typing in 

 

sfc /scannow 

 

After you hit enter it will scan the system.

[svage]

I just started getting frequent BSOD very recently, most of them related to MEMORY_MANAGMENT or IRQL_NOT_LESS_OR_EQUAL even after reinstalling windows. I ran memtest86 without any error. I also noticed that most of the BSOD are caused by ntoskrnl.exe (nt+0x175930), just like your most recent ones. After googling that exact memory address, the only results are from at most 5 days ago describing people with similar BSOD. I don't know if it's a coincidence or there is actually a bad os/driver update that occured. One of the post is referring to issues with nvidia drivers, which would make sense as the drivers are updated often. I'm currently on 391.35 if that can help.

[Nesagsar]

14 hours ago, svage said:

One of the post is referring to issues with nvidia drivers, which would make sense as the drivers are updated often. I'm currently on 391.35 if that can help.

My Nvidia driver is currently on 388.59, I should probably update some time.

[Frugl1]

Registered when i saw this, as i have just experienced the same BSOD on an otherwise stable system.

Are you guys on kb4093112? The only other change in system configuration that i can think of is a recent update to the beta version of ICUE.

[DOODMANO]

I've registered as well; exact same BSOD since 4/13/18 (no changes made as of recent), which happens anywhere from 30 mins to 12 hours after the computer starts.

I've noticed that a lot of these with the label "ntoskrnl.exe+175930" in particular are mostly up to 10 days old, as svage mentioned.

 

I was on kb4093112 for maybe around some 8 or so BSODs, until updating to the 1803 insider update in case it fixed it, but it didn't.

My first BSOD, which I didn't save any info about, was actually prior to kb4093112 on the morning of 4/13/18; when it restarted, it actually ended up finishing the kb4093112 update...

 

I've also tried:

Memtest86 to 4 passes, 0 errors

Uninstalling/Reinstalling graphics drivers, as well as updating most drivers I can think of

Driver Verifier (nothing found) in accordance to these settings: https://www.techsupportforum.com/forums/f299/driver-verifier-windows-10-8-1-8-7-and-vista-bsod-related-473665.html

Reseating Power Cables, as well as replacing SATA cables: http://forums.whirlpool.net.au/archive/2718453

Reseating RAM in different slots, as well as dusting them off

CCCleaner, chkdsk /f, sfc /scannow

Bios Update (Gigabyte AB350-Gaming 3)

 

I'm not currently overclocking either.

 

A little of the dump information (from saving from BlueScreenView, condensed to important bits):

 

==================================================
Crash Time        : 4/15/2018 11:51:10 AM
Bug Check String  : DRIVER_OVERRAN_STACK_BUFFER
Bug Check Code    : 0x000000f7
Parameter 1       : 00002f84`01a5dde0
Parameter 2       : 0000d285`d1e3968c
Parameter 3       : ffff2d7a`2e1c6973
Parameter 4       : 00000000`00000000
Caused By Driver  : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+175930
File Description  : 
Product Name      : 
Company           : 
File Version      : 
Processor         : x64
Crash Address     : ntoskrnl.exe+175930
==================================================

 

==================================================
Crash Time        : 4/15/2018 10:06:47 PM
Bug Check String  : IRQL_NOT_LESS_OR_EQUAL
Bug Check Code    : 0x0000000a
Parameter 1       : 00000000`00000010
Parameter 2       : 00000000`00000002
Parameter 3       : 00000000`00000000
Parameter 4       : fffff802`219410b3
Caused By Driver  : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+175930
File Description  : 
Product Name      : 
Company           : 
File Version      : 
Processor         : x64
Crash Address     : ntoskrnl.exe+175930
==================================================

 

==================================================
Crash Time        : 4/16/2018 3:29:31 AM
Bug Check String  : MEMORY_MANAGEMENT
Bug Check Code    : 0x0000001a
Parameter 1       : 00000000`00041201
Parameter 2       : ffffb600`69f71988
Parameter 3       : 86000000`8e0a5847
Parameter 4       : ffff9789`9cc66990
Caused By Driver  : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+175930
File Description  : 
Product Name      : 
Company           : 
File Version      : 
Processor         : x64
Crash Address     : ntoskrnl.exe+175930
==================================================

 

After updating to Windows Update 1803, ntosknrl is now with "+197620":

 

==================================================
Crash Time        : 4/17/2018 12:40:47 AM
Bug Check String  : DRIVER_OVERRAN_STACK_BUFFER
Bug Check Code    : 0x000000f7
Parameter 1       : 0000c9d5`ab55a58c
Parameter 2       : 0000c9d5`ab55a51c
Parameter 3       : ffff362a`54aa5ae3
Parameter 4       : 00000000`00000000
Caused By Driver  : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+197620
File Description  : 
Product Name      : 
Company           : 
File Version      : 
Processor         : x64
Crash Address     : ntoskrnl.exe+197620
==================================================

 

If you'd like some log files from the minidump, I can provide them the next time I crash.

 

Edit: Just updated to 10.0.17133.73, low chance it'll help but just in case...

[Frugl1]

Can you get me a mini-dump for the IRQL_NOT_LESS_OR_EQUAL bugcheck @DOODMANO? I suspect that an updated version of hal.dll maybe the cause of that specific one. But I'll need to see the address space in your dump.

[DOODMANO]

@Frugl1

I've just gotten minidumps starting with PFN_LIST_CORRUPT and DRIVER_OVERRAN_STACK_BUFFER from yesterday; I didn't save any prior, sorry. 

The bug check string is different every time but I've gotten IRQL_NOT_LESS_OR_EQUAL multiple times; it's just a matter of time until it occurs again.

Are you still getting BSODs?

 

Edit: Updating to 10.0.17134.1

https://www.theverge.com/2018/4/17/17246170/microsoft-windows-10-april-update-delay

The new build is available to Windows Insiders in the Fast Ring, and will be made available to Slow Ring and Release Preview shortly. Sources familiar with Microsoft’s plans tell The Verge that this build (version 17134) has now been marked as the final version of the next major Windows 10 update.

 

Hoping this in particular will help, even though BSOD were on stable too

[DOODMANO]

https://drive.google.com/open?id=1PXUc2MRsTRfOU9bKndNuNDkg_TCyWRJv

Here are 3 of my BSOD minidumps, including the performance monitor result; 17134 didn't stop the BSOD.

 

I'm using Avast. Are you guys using Avast?

https://answers.microsoft.com/en-us/windows/forum/windows_10-performance/windows-10-random-bsod-crashes-constant-crash-when/692536c7-4741-4c24-990b-4136f523b73f

There's thread here where the topic owner had Avast and was told that Avast was the cause of the bsods. He said he'd see if anything happens but it's been 4 days so I hope he solved it. I don't really understand the minidump but I'll try uninstalling Avast.

 

@svage @Nesagsar you two still getting BSODs?

[svage]

20 hours ago, DOODMANO said:

https://drive.google.com/open?id=1PXUc2MRsTRfOU9bKndNuNDkg_TCyWRJv

Here are 3 of my BSOD minidumps, including the performance monitor result; 17134 didn't stop the BSOD.

 

I'm using Avast. Are you guys using Avast?

https://answers.microsoft.com/en-us/windows/forum/windows_10-performance/windows-10-random-bsod-crashes-constant-crash-when/692536c7-4741-4c24-990b-4136f523b73f

There's thread here where the topic owner had Avast and was told that Avast was the cause of the bsods. He said he'd see if anything happens but it's been 4 days so I hope he solved it. I don't really understand the minidump but I'll try uninstalling Avast.

 

@svage @Nesagsar you two still getting BSODs?

Yep still happening. I'm on a fresh windows install + drivers and never used Avast. I am running Samsung Magician, Corsair Link, Logitech Gaming Software, Intel Rapid Storage Technology, Nvidia drivers and Realtek HD Audio Manager. All software related to hardware that may cause this BSOD. Still originating from ntoskrnl.exe+175930. I also wonder if it may be power related. It happened once that my PC just rebooted without creating any BSOD.

 

@Frugl1 I also joined my last mini-dump if that may help

041818-6328-01.dmp

[DOODMANO]

@svage Of those, I have Samsung Magician, Logitech Gaming Software, Nvidia Drivers and Realtek HD Audio Manager installed.

I think I actually disabled Realtek but I think I ended up updating it and keeping it on.

 

Anyway, I haven't gotten a BSOD in 30 hours. It seems like uninstalling Avast did the trick for me. I will still check back, especially if I get another BSOD.

[Frugl1]

@svageYour dump suggests that the memory operation was triggered by hal.dll, which is the same as my own single crash. While i cannot say if hal.dll itself is the cause or just a layer between a buggy driver and the hardware, I can tell you that hal.dll was updated on the 10th of april of this month, so take from that what you want.

 

 

@DOODMANO Your dumps dont seem very consistant at all. Have you tried running memtest86 overnight to see if it comes up with anything?

 

Also, if both you you could try disabling fast boot in windows, that may help.

[DOODMANO]

@Frugl1 I ran memtest86 with no errors for multiple passes, as mentioned in an earlier post. The ntoskrnl.exe + ###### address changed from 175930 after installing the Insider Updates. I feel like, even though we got the same address as an error, it might just be something related to the operating system more so than the actual problem...

 

While fast startup (Windows setting) is on for me, I'm pretty sure that fast boot (BIOS) is turned off. Since I haven't run into any BSODs, I think the issue is already solved, so I don't want to change the setting at the moment.

 

I've run the computer for about 60 hours so far without any BSODs. Since uninstalling Avast did the trick for me, you might want to see if uninstalling software might do the trick for you?

[Frugl1]

@DOODMANO     The ntoskrnl offset is just the address that invoked the IRQL bugcheck, which stems from a driver trying to read a memory page(or a corrupt pointer) not currently loaded into physical memory in a thread that has a Interrupt Request Level as the memory controller itself, hence the OS detects it as unrecoverable scenario as the driver will never be able to access the page due to it itself being higher priority than the OS component responsible for loading the page from disk.

The most likely cause is a software bug. Or faulty memory resulting in corrupt pointers in memory.

 

I hope this explanation makes sense.

When analyzing your memory dump, you should look at bugcheck arg4, which will contain the actual address that resulted in this scenario.

 

I've only had one single BSOD, so it's not a huge problem for me personally.

[Frugl1]

It is completely possible for an avast driver component to misbehave and give you this behavior.

[DOODMANO]

@Frugl1Well.. After several, several hours of no BSOD, I got one. Three in the span of 10 minutes actually.

 

Hope it's not a graphics card or motherboard issue...

[Frugl1]

@DOODMANOCan you try to run prime95 blend test for at least an hour or two and see if there are any errors caused by faulty calculation/bad memory.

 

Also, have you tried a clean install to rule out possible rootkit infection?

 

I also see a

 SleepStudyHelper.sys

in your modules list.Can you pinpoint the source of this driver?

Edited April 22, 2018 by Frugl1
Request for more information.

[DOODMANO]

@Frugl1

How may I pinpoint for "SleepStudyHelper?" Google search results show that it's supposedly a part of Windows but there's no information on what it does.

 

Malwarebytes and Avast didn't detect a rootkit from their scans. However, I want to do a clean install as a last resort, since re-installing and backing up all my files takes a long time. Once I get tired of troubleshooting, I'll go straight to doing it... (I probably could have saved several hours if I went straight to a fresh install a long time ago...)

 

Also, I have a new case coming tomorrow (current one is old and I'm not a fan of it) so I will be re-building and and rule out any issues that comes with improper seating.

 

I'll run a Prime95 soon, and let you know how it goes. In the meantime, I updated my bios to another new version.

 

Thanks for keeping up with me!

[Frugl1]

Supposedly it's a driver to help profile battery drain on laptops, just never noticed it before. Let me know how p95 fares.

[DOODMANO]

Yo @Frugl1,

I haven't forgotten about the p95, but I've also done a restore to about 4 days prior to the first BSOD. I want to see how things fare, and I'll might try to get it to you by Saturday if I don't crash, although I feel a bit wary about doing it since it is known to damage CPUs; I might try another stress tester instead, or I might be confident with how it is and not do it (I'll be moving it over to a new case as well). If I do crash, I'm going to get do a stress test ASAP and also probably do fresh reinstall of Windows. So far I'm so good since a couple days ago, but we know how it went last time with Avast and 60 hours... Either way, if I do crash and/or do it, I'll notify you again. Thanks again 

 

p.s.: Weird question: Can a faulty drive BSOD after a certain amount of space on it is used? I'm not familiar with how an SSD works in this regard; for example, if I were to use 250 GB of a 500 GB drive, I'd BSOD because at 247 GB there's a faulty sector used, but if I were to only use 240 GB, I wouldn't have a BSOD? It seems like a far-fetched idea but just in case

[svage]

I found a way to trigger the BSOD each time by doing any big I/O operations on any of my hdd/ssd including my nvme drive. It happens whenever i copy multiple files at the same time from a drive to another or on the same drive. Also happens when downloading multiple files at high speed (~17mb/s). It mostly occurs on my hdds since it hit 100% activity easier than the ssd or nvme drive. My guess is the sata controller on the motherboard is at fault (or cpu issue?) or the nvme drive since it's my boot drive? I will try removing any sata drives and only using my nvme drive to be sure, and probably try to reproduce the crash on linux. @Frugl1 Got any more ideas on the issue?

 

It's also creating different BSOD code almost every time

[DOODMANO]

I BSOD'd again after moving to the new case. Otherwise it had lasted about 110 hours; I don't actually think it's the CPU or RAM that's the issue, but rather something went awry software-wise. I'll be moving over files to my external and get a factory windows reset.

 

@svage Blue screened in safe mode while moving all my files over. I might have a similar problem to you...

[svage]

@DOODMANO We do have Samsung Magician in common, which installs drivers for NVMe drives. Is your boot drive a NVMe drive?

 

edit: Never mind, NVMe drivers are actually a separate install, in my case having them or not didn't change anything.

[Frugl1]

@DOODMANO Can you try running fltmc in an elevated CMD, to list all filter drivers and post the result.