0

What can be a reason of often system hangs and BSODs in the following circumstances?

1) BSODs are often not dispayed and no dump saved, computer just hangs.

2) When it is saved, it reports NTOSKRNL with random bugcheck code.

3) Long memory test for many hours (with standard memory diagnostic tools) showed everything is OK.

4) Fresh Windows re-installation on-to clean new hard drive didn't help.

What else can be bad? I don't know... CPU? system bus? Whatever? How to know?

UPDATE

Today I got new BSOD on completely new installation: https://1drv.ms/u/s!AkjSY7WYaKo6ljq-wBFKjcGsJ-m2

UPDATE 2

Loading some crash dump into WinDbg gave the following:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {5012, fffff18010804310, c73, c70}

*** ERROR: Symbol file could not be found.  Defaulted to export symbols for win32k.sys - 
Probably caused by : memory_corruption

Followup:     memory_corruption
---------

6: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000005012, The subtype of the bugcheck.
Arg2: fffff18010804310
Arg3: 0000000000000c73
Arg4: 0000000000000c70

Debugging Details:
------------------


DUMP_CLASS: 1

DUMP_QUALIFIER: 400

BUILD_VERSION_STRING:  10.0.14393.447 (rs1_release_inmarket.161102-0100)

SYSTEM_MANUFACTURER:  Gigabyte Technology Co., Ltd.

SYSTEM_PRODUCT_NAME:  B85M-D3H

SYSTEM_SKU:  To be filled by O.E.M.

SYSTEM_VERSION:  To be filled by O.E.M.

BIOS_VENDOR:  American Megatrends Inc.

BIOS_VERSION:  F13

BIOS_DATE:  06/19/2014

BASEBOARD_MANUFACTURER:  Gigabyte Technology Co., Ltd.

BASEBOARD_PRODUCT:  B85M-D3H

BASEBOARD_VERSION:  x.x

DUMP_TYPE:  2

BUGCHECK_P1: 5012

BUGCHECK_P2: fffff18010804310

BUGCHECK_P3: c73

BUGCHECK_P4: c70

BUGCHECK_STR:  0x1a_5012

CPU_COUNT: 8

CPU_MHZ: da4

CPU_VENDOR:  GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 3c

CPU_STEPPING: 3

CPU_MICROCODE: 6,3c,3,0 (F,M,S,R)  SIG: 1E'00000000 (cache) 1E'00000000 (init)

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

PROCESS_NAME:  msiexec.exe

CURRENT_IRQL:  2

ANALYSIS_SESSION_HOST:  LAGRANGIAN

ANALYSIS_SESSION_TIME:  11-30-2016 19:21:21.0450

ANALYSIS_VERSION: 10.0.14321.1024 amd64fre

LAST_CONTROL_TRANSFER:  from fffff80215394944 to fffff80215357510

STACK_TEXT:  
ffffc681`ad47c768 fffff802`15394944 : 00000000`0000001a 00000000`00005012 fffff180`10804310 00000000`00000c73 : nt!KeBugCheckEx
ffffc681`ad47c770 fffff802`1525ff11 : ffff8003`c3ab1d00 ffff8003`c3ab1d00 00000000`00000000 fffff180`10804310 : nt! ?? ::FNODOBFM::`string'+0x2dfa4
ffffc681`ad47c830 fffff802`156723b1 : 00000000`00000000 ffff8003`c3ab1d00 ffff8003`c3ab1d00 ffff8003`c3ab1800 : nt!MiCleanWorkingSet+0x45
ffffc681`ad47c860 fffff802`15672107 : 00000000`00040000 ffff8003`cedc8680 00000000`00000001 ffff8003`c3ab1800 : nt!MmCleanProcessAddressSpace+0x185
ffffc681`ad47c8d0 fffff802`156c9590 : ffff8003`c3ab1800 ffffb002`c303f060 ffffc681`ad47c9c0 00000000`00000000 : nt!PspRundownSingleProcess+0x117
ffffc681`ad47c950 fffff802`15620fa2 : ffff8003`00000000 ffff8003`c3ab1800 ffff8003`c3ab1800 ffff8003`cedc8680 : nt!PspExitThread+0x508
ffffc681`ad47ca90 fffff802`15362193 : ffff8003`c3ab1800 ffff8003`cedc8680 ffffc681`ad47cb80 ffffffff`ffffffff : nt!NtTerminateProcess+0xde
ffffc681`ad47cb00 00007ff9`049b53e4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
000000b9`acc7f758 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`049b53e4


STACK_COMMAND:  kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
    fffff8021531ae6d-fffff8021531ae6e  2 bytes - nt!MiPurgeZeroList+6d
    [ 80 fa:00 aa ]
2 errors : !nt (fffff8021531ae6d-fffff8021531ae6e)

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  LARGE

FAILURE_BUCKET_ID:  MEMORY_CORRUPTION_LARGE

BUCKET_ID:  MEMORY_CORRUPTION_LARGE

PRIMARY_PROBLEM_CLASS:  MEMORY_CORRUPTION_LARGE

TARGET_TIME:  2016-11-30T15:39:26.000Z

OSBUILD:  14393

OSSERVICEPACK:  447

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK:  272

PRODUCT_TYPE:  1

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

OSEDITION:  Windows 10 WinNt TerminalServer SingleUserTS

OS_LOCALE:  

USER_LCID:  0

OSBUILD_TIMESTAMP:  2016-11-02 13:17:03

BUILDDATESTAMP_STR:  161102-0100

BUILDLAB_STR:  rs1_release_inmarket

BUILDOSVER_STR:  10.0.14393.447

ANALYSIS_SESSION_ELAPSED_TIME: 1139

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:memory_corruption_large

FAILURE_ID_HASH:  {e29154ac-69a4-0eb8-172a-a860f73c0a3c}

Followup:     memory_corruption
---------

UPDATE 3

CPU-Z reports: (removed)

UPDATE 4

DSIM reports:

C:\WINDOWS\system32>dism /Online /Cleanup-Image /CheckHealth

Deployment Image Servicing and Management tool
Version: 10.0.14393.0

Image Version: 10.0.14393.0

No component store corruption detected.
The operation completed successfully.

C:\WINDOWS\system32>dism /Online /Cleanup-Image /ScanHealth

Deployment Image Servicing and Management tool
Version: 10.0.14393.0

Image Version: 10.0.14393.0

[==========================100.0%==========================] No component store corruption detected.
The operation completed successfully.
  • Are you using any level of RAID by chance? – Narzard Nov 29 '16 at 16:10
  • share the dmps that you get so that we can debug them – magicandre1981 Nov 29 '16 at 16:52
  • @magicandre1981 see my update please – Dims Nov 30 '16 at 11:44
  • magicandre1981's answer is excellent. I'd just like to add: Yes, SATA cables could cause such things. So could motherboards, or equipment that may be malfunctioning due to a presently- or previously-malfunctioning power supply (broken PSU, bad power from the wall). His suggestions are more likely, but there are other possibilities. It does smell a lot like a hardware problem, so swapping hardware with similar (identical preferred) pieces may isolate the individual bad component (although, of course, multiple bad components could be possible). – TOOGAM Dec 1 '16 at 14:37
  • @TOOGAM is it possible to find reason explicitly? – Dims Dec 1 '16 at 15:46
2

You have a memory corruption of the kernel (nt). chkimg compares the exe from the dump with the clean exe it downloads from the symbol server.

CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
    fffff8021531ae6d-fffff8021531ae6e  2 bytes - nt!MiPurgeZeroList+6d
    [ 80 fa:00 aa ]
2 errors : !nt (fffff8021531ae6d-fffff8021531ae6e)

In your case you have 2 miss matches and this causes crashes.

This can happen if you have disk issues (bad sectors, NTFS file system issues) or if your RAM is damaged.

Steps to debug:

  • run memtest86+ for each RAM stick (remove the other ones) to check for errors. if you get errors, remove the damaged RAM.
  • if RAM is fine, check that the RAM timings are fine. Run CPU-Z and look in memory and SPD tab if the values match.
  • if memory is fine, run a diag tool from your HDD vendor to check disk issues
  • if disk is fine, run chkdsk C: /f to detect NTFS issues. Now also run DISM to repair damaged files.
  • I have ran memory and HDD tests. Also I have replaced suspicious SSD with brand new HDD and situation persists. The only thing I still suspect are SATA cables. Is it possible bad SATA cable causing this? – Dims Nov 30 '16 at 16:52
  • Thanks a lot, looks like I have a progres. But I didn't understand, what should match in CPU-Z? – Dims Nov 30 '16 at 17:00
  • Is it possible, that MemTest does not show any errors because I was not taking out any DIMMs? – Dims Nov 30 '16 at 17:10
  • RAM timings are ok. For 666Mhz the timings are 9-9-9-24 and your values are ok. bad cables can indeed cause corruptions. try a different cable. – magicandre1981 Nov 30 '16 at 17:12
  • removing other RAm and test each stick alone is the best way to see which ram is damaged if you see errors in memtest86+ – magicandre1981 Nov 30 '16 at 17:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.