4

So after 3 years of using a fresh install of Windows 7 x64, I've to upgrade to Windows 10 because of job reasons.

I downloaded the latest Windows 10 Pro build image (1803) from Microsoft and used Rufus 3.1 to create a bootable flash disk.

I did a fresh install on my SSD (formatting it previously) and after a few days of using the computer I started to get random BSODs. Around 1 or 2 per day.

The BSODs error are either MEMORY_MANAGEMENT or ATTEMPTED_WRITE_TO_READONLY_MEMORY.

Things I've tried:

  • Run 2 passes of Windows Memory Diagnostic. No errors.
  • Run sfc /scannow. No errors.
  • Updated the GPU drivers to the latest (Nvidia Geforce GTX 970)
  • Updated BIOS to latest version (from 0802 to 0803 on ASUS Z-97E)

I might have had just a couple of BSODs over the 3 years of Windows 7 so I don't think it's a hardware related problem. The BSODs started just after fresh installing Windows 10.

How do I open the MEMORY.DMP generated by Windows and what do I look in there to see what's causing the BSODs?

Anything else I can try?

UPDATE I've opened C:\MEMORY.DMP with WinDbg x64 and here's the result: https://pastebin.com/B2pS9VZt

UPDATE 2 I've just had another BSOD. This time it was SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION.
Dump here: https://pastebin.com/0hckXpqP

UPDATE 3 Minidumps files

UPDATE 4
I've run memtest all night and I've a lot of errors. I guess I do have faulty RAM. Are we sure this is faulty RAM right? It'll get fixed once I replace it right? No way to know which stick/s are faulty? Have to remove them and run memtest again to know which one?
Here are the results: http://ancient-name.surge.sh/

  • Spurious random crashes with no apparent reason smells a lot like there might be a hardware issue or a malware. You can open the dump file with BlueScreenView and similar tools. As a kernel mode dev you'd use WinDbg straight, though. If the alleged cause (some driver or the kernel itself pointed out in the dump) varies across crashes, you're likely dealing with either of the above causes. Oh and some anti-malware that isn't yet prepared for the anti-Spectre/Meltdown kernel changes might also cause this, I reckon. – 0xC0000022L Sep 1 '18 at 22:54
  • 1
    Posting text output from windbg is almost always nearly useless. Please zip up your minidump files, post the zip file on a file sharing site like dropbox, and post a link. After looking at those we may ask you to share one of the larger dump files. p.s. - " Is it really that hard to know which driver/device caused a BSOD? " Very often, yes, it is that hard. It's not unusual to spend more than a week analyzing a single dump. But minidumps are often dead ends - not enough memory is preserved in them. – Jamie Hanrahan Sep 3 '18 at 23:03
  • 1
    Are you using Asus's automatic overclock? I had a very similar experience going from Win7 to Win10 on an Asus M5A97 r2 motherboard. In Win 7 is ran perfectly, but with no changes in BIOS after installing Windows 10 I would get random BSOD indicating memory issues, at the advice of some forums (that I can't find now) I disabled the automatic overclocking on the Asus BIOS main setup page and the problem went away. – acejavelin Sep 3 '18 at 23:29
  • 1
    @acejavelin I'm using the default "normal" profile on Asus UEFI. I don't think it's overclocking anything. – emzero Sep 4 '18 at 0:30
  • 4
    Possible duplicate of Determining Bad RAM With Memtest86 – harrymc Sep 12 '18 at 20:33
10
+500

The most likely cause of this type of crash is defective memory. As suggested by harrymc, the first thing to try is generally to run a memory testing program, such as Windows Memory Diagnostic (included in Windows), the original MemTest86 (maintained by PassMark Software), or the open-source Memtest86+. (I've added this section for the benefit of other readers here who may be experiencing similar problems but not have tried memory testing.)


The question author can skip this section. It is being retained for reference by other readers.

If the memory test passes, you may have a faulty processor.

The processor's integrated memory controller (IMC) can sometimes cause memory problems. Simple memory operations like reading data from particular memory locations may work normally, but the processor's ability to perform essential memory management operations, including virtual memory, aren't tested by memory testing programs.

Another possibility is a faulty cache. Caches are small amounts of memory inside the processor used to accelerate memory accesses. Although your processor should be able to detect cache errors (and generate a machine-check exception when that happens, causing a WHEA_UNCORRECTABLE_ERROR BSOD), it is not impossible for data in cache to get corrupted and cause memory corruption without the processor itself noticing. That, too, would not be detected by memory testing software.

To check the IMC, download Intel's processor diagnostic program and run an IMC test. To check the processor caches, download Prime95 and run the small FFTs torture test (your processor may get very hot or the fans may run loud; this is normal). If either test fails, you'll probably need to replace the processor. (I'm assuming the processor and memory are not overclocked or otherwise being operated outside of specifications.)


Since you've run a memory test and have found errors, it should be pretty obvious that one or more memory modules need to be replaced. I can glean more information from the report you've posted.

The errors occur at one particular region of the memory, around 0x19BDD79F0, which would limit the problem to one module. The address suggests, but does not confirm, that the problem is in one of the Patriot Memory modules.

Because memory on most systems, including yours, works best in pairs, try removing both modules of either brand and rerun the test. If that doesn't work, reinstall the modules you removed and remove the other pair. If the problem clears up, you can use the system normally until you get replacement memory modules.


I should note that Windows 10 uses more advanced memory management techniques, including virtual memory compression to maximize performance on systems with limited memory. Although your system has 16 GB of memory, Windows will still compress the data in memory by default (my desktop has 32 GB and is no different here). Memory errors are detected readily during compression and decompression of data and will immediately cause the operation to fail, causing the system to crash. Memory errors affecting uncompressed application or other data would "simply" result in application crashes or corrupted files (though it can still cause OS crashes). For this reason, Windows 10 is more sensitive to memory errors than previous versions of Windows.

  • Thanks. I'll run those two and get back to you tomorrow. – emzero Sep 4 '18 at 0:32
  • 1
    @emzero: Updated my answer. Long story short, Windows 10 has a memory compression feature which makes it more sensitive to memory errors than previous versions of Windows. – bwDraco Sep 4 '18 at 16:21
  • 1
    Ignoring kernel-/user-mode for a minute (even if compression were entirely user-mode) a failure to decompress would still trigger a crash (there is no safe way for the OS to recover, apart from maybe killing the process - but there's known faulty memory now). – Bob Sep 4 '18 at 17:27
  • 1
    @bwDraco I've removed both Patriot modules and Memtest86 passed twice with 0 errors. Also, no BSOD in 12 hours. So I guess we can say for sure at least one of them is faulty. I'll just dump both and get 2 of the same Corsair model I already have. Thank you, the bounty is yours =) – emzero Sep 4 '18 at 18:10
  • 1
    @emzero: To award the bounty, click on the blue "+500" below the voting controls for the answer you want to award the bounty for. I'm pleased I can help :) – bwDraco Sep 4 '18 at 18:16
3

By the dumps the error is coming from two sources: IRQ and int 3 instruction. IRQ means that some driver that was called by the interrupt and it is faulty - what means that you have to check all drivers you have installed in this system for one to be faulty.

Int 3 is a debugger interrupt, which means that there is some software (also it can be driver) that is calling breakpoint (int 3) where it shouldn't be. This can happen for Debug version of software.

Mostly such BSODs are coming from not properly written drivers, so this is the source where I would search for a problem. Uninstall all drivers (or make a fresh install of operating system) and check them one by one. Between each driver make some bigger usage of the system (make 7-zip benchmark for example) and you will find the faulty one.

The other source of the problem could be overclocked CPU or RAM, to check that, configure system in BIOS to use only nominal values of provided hardware. Not more.

3

I can see in the minidumps that you also had a crash condition of SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION. I also noted that all your crashes occur in the kernel or inside the HAL, but never inside any device driver, so that the problem is not with a specific malfunctioning device.

It is therefore very likely that your memory is defective. Windows 10 might be using a defective part of the RAM that was not used before.

Have first a look at the Event Viewer to see if it contains any useful information.

Then I suggest to run MemTest86 :

MemTest86 is the original, free, stand alone memory testing software for x86 computers. MemTest86 boots from a USB flash drive or CD and tests the RAM in your computer for faults using a series of comprehensive algorithms and test patterns.

You might also try to boot with a subset of your RAM sticks, respecting the arrangements specified for your motherboard, in order to find the bad stick.


Notes on your MemTest86 results : You have thousands of errors. The tests of memory addressing passed, so the problem is not with the memory controller. The errors are with the RAM itself, where data stored is incorrect when read. This suggests that at least one of your memory sticks is bad, and that the problem is not with the CPU or the motherboard.

What you can do

You could take out sticks and run MemTest86 on the subset. Your motherboard is the Asus Z97-E that needs at least two sticks in DIMM_A1 and DIMM_B1. The following diagram is from page 1-7 of the manual:

image

Putting in any two sticks of same make, and testing, will narrow the field to either the Corsair or Patriot sticks. When you know the two sticks out of which one only (hopefully) is bad, you may try to mix sticks of different manufacturer. Their specifications seem identical, so this might work.

It might also be that putting only one stick in DIMM_A1 will work enough for MemTest86. The diagram from the manual is unclear and may indicate that one stick may work in either DIMM_A1 or DIMM_B1. Even if that's not the case, sometimes non-recommended configurations may still somewhat work, depending on the motherboard.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.