Several BSOD - Windows 8.1 x64

Davodi · Jan 17, 2015

Hello! I'm getting some BSOD and I don't know what to do, can you help me?
Cmd doen't let me use perfmon /repot command, I don't know why...

· OS - Windows 8.1
· x64
· What was original installed OS on system? - It has no OS when I purchased it
· Is the OS an OEM version (came pre-installed on system) or full retail version (YOU purchased it from retailer)? - Full retail version
· Age of system (hardware) - Around one and half a year
· Age of OS installation - have you re-installed the OS? half a year, yes.

· CPU - Intel Core i7 4700MQ
· Video Card - Intel(R) HD Graphics 4600 and NVIDIA GeForce GTX 760M

· System Manufacturer - Notebook
· Exact model number - Mountain Studio MX 174G

· Laptop or Desktop? - Laptop

Patrick · Jan 17, 2015

DRIVER_CORRUPTED_EXPOOL (c5)

This indicates that the system attempted to access invalid memory at a process IRQL that was too high.

Code:

2: kd> kv
Child-SP          RetAddr           : Args to Child                                                           : Call Site
ffffd000`2381a2c8 fffff803`5e5cece9 : 00000000`0000000a 00000000`00000092 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffffd000`2381a2d0 fffff803`5e5cd53a : 00000000`00000000 ffffd000`2381a530 00000000`00000000 ffffd000`2381a410 : nt!KiBugCheckDispatch+0x69
ffffd000`2381a410 fffff803`5e7141b2 : 00000000`000000ff 00000000`00000000 00000000`00000000 fffff803`5e5c950c : nt!KiPageFault+0x23a (TrapFrame @ ffffd000`2381a410)
ffffd000`2381a5a0 fffff803`5e714d0f : ffffe000`8087d600 ffffe000`7c5e2670 00000000`00000000 ffffe000`7c2158d0 : nt!ExDeferredFreePool+0x1a2
ffffd000`2381a620 fffff801`8dff3872 : 00000000`00000000 fffff803`5e4d9dc6 ffffc001`73428205 00000000`7246704e : nt!ExFreePoolWithTag+0x84f
ffffd000`2381a710 fffff801`8dff3622 : 00000000`00000000 ffffe000`7a1fff01 ffffd000`2381a810 ffffe000`7c5e2680 : Npfs!NpRemoveDataQueueEntry+0xe2
ffffd000`2381a750 fffff801`8dff01af : ffffd000`2381a830 ffffc001`73428228 ffffe000`7a1fff01 ffffe000`00000000 : Npfs!NpReadDataQueue+0x1a2
ffffd000`2381a7c0 fffff801`8cd7b0f5 : ffffe000`7a1fff20 ffffe000`7b5e2820 00000000`00000000 00000000`00002554 : Npfs!NpFsdRead+0x1ff
ffffd000`2381a870 fffff803`5e8a3b14 : 00000000`00000000 ffffd000`2381a951 ffffe000`7a1fff20 0000000c`001f0003 : fltmgr!FltpDispatch+0xf5
ffffd000`2381a8d0 fffff803`5e8a3706 : ffffe000`7a1fff04 ffffe000`7a1fff20 ffffd000`2381aa01 ffffe000`7a1fff20 : nt!IopSynchronousServiceTail+0x164
ffffd000`2381a9a0 fffff803`5e5ce9b3 : 00000000`ff389000 00000000`00001e1c 00000000`00000001 00000000`1421f2f4 : nt!NtReadFile+0x656
ffffd000`2381aa90 00000000`77602772 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`2381ab00)
00000000`13f5f0b8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77602772

A lot of file system stuff in the stack, like calling NtReadFile, etc. Probably an antivirus. ExFreePoolWithTag calling ExDeferredFreePool and then we go off the rails, so a driver causing pool corruption.

Code:

2: kd> .trap ffffd000`2381a410
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000000004a rbx=0000000000000000 rcx=ffffe000809ed4a0
rdx=ffffe0007c0a5ad0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8035e7141b2 rsp=ffffd0002381a5a0 rbp=000000000000001c
 r8=ffffe000809ed000  r9=0000000000000000 r10=0000000000000001
r11=0000000000000001 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
nt!ExDeferredFreePool+0x1a2:
fffff803`5e7141b2 488bc8          mov     rcx,rax

Code:

2: kd> !pte 000000000000004a 
                                           VA 000000000000004a
PXE at FFFFF6FB7DBED000    PPE at FFFFF6FB7DA00000    PDE at FFFFF6FB40000000    PTE at FFFFF68000000000
contains 05D000017783B867  contains 0AF0000177EBC867  contains 0BA0000177E3D867  contains 0000000000000000
pfn 17783b    ---DA--UWEV  pfn 177ebc    ---DA--UWEV  pfn 177e3d    ---DA--UWEV  not valid

The rax register is completely invalid.

Code:

2: kd> .formats 000000000000004a 
Evaluate expression:
  Hex:     00000000`0000004a
  Decimal: 74
  Octal:   0000000000000000000112
  Binary:  00000000 00000000 00000000 00000000 00000000 00000000 00000000 01001010
  Chars:   .......J
  Time:    Wed Dec 31 19:01:14 1969
  Float:   low 1.03696e-043 high 0
  Double:  3.65609e-322

Two possibilities here:

1.

Code:

2: kd> lmvm mwlPSDFilter
start             end                 module name
fffff801`8dd9f000 fffff801`8ddaa000   mwlPSDFilter   (deferred)             
    Image path: \SystemRoot\system32\DRIVERS\mwlPSDFilter.sys
    Image name: mwlPSDFilter.sys
    Timestamp:        Fri Mar 25 03:12:11 2011

EgisTec Inc. Fingerprint Biometrics/MyWinLocker driver, dated from 2011, update it if available. If not, leave it for now and skip to #2.

2. Get rid of avast!, it's probably the issue here given the NTFS stuff:

avast! removal - http://www.avast.com/uninstall-utility

Windows Defender (how to turn on after removal)

A.Navigate to Control Panel (with icons). You can do this by hitting Start > Search > Control Panel. Once in Control Panel, change the drop-down from Category to Large and/or Small icons.

B.Among the list of icons, find and click Action Center.

C.Assuming the removal of your prior antivirus software went properly, you will notice for both Spyware and unwated software protection (important) and Virus protection (important), it'll have a button labeled Turn on now. Click this button (it doesn't matter which, as Windows Defender serves as both in Windows 8/8.1).

Davodi · Jan 18, 2015

Thanks for the reply!

I tried to find updates for mwlPSDFilter.sys but I don't know where can I get it. EgisTec doesn't have anything in his page. Also, I don't know what this driver does...

On the other hand, I removed Avast and I turned on Windows Defender.

Now I will use my laptop all day. Sometimes BSOD doesn't appear in weeks so, if I get a new one, I'll reply here again.

Thanks for your help!

Davodi · Jan 18, 2015

I just got a new one... PAGE_FAULT_IN_NONPAGED_AREA
I was using chrome watching a youtube video, nothing special.
Here you have minidump file.

Also I uninstalled mwlPSDFilter.sys driver some hours before the last BSOD. It was a Finger print reader driver and, since my laptop has no finger print reader, I thoght that it is a wrong driver. I don't think that it was related with that BSOD.

Patrick · Jan 18, 2015

Enable verifier, please.

Driver Verifier:

What is Driver Verifier?

Driver Verifier monitors Windows kernel-mode drivers, graphics drivers, and even 3rd party drivers to detect illegal function calls or actions that might corrupt the system. Driver Verifier can subject the Windows drivers to a variety of stresses and tests to find improper behavior.

Essentially, if there's a 3rd party driver believed to be causing the issues at hand, enabling Driver Verifier will help us see which specific driver is causing the problem.

Before enabling Driver Verifier, it is recommended to create a System Restore Point:

Vista - START | type rstrui - create a restore point
Windows 7 - START | type create | select "Create a Restore Point"
Windows 8/8.1 - Restore Point - Create in Windows 8

How to enable Driver Verifier:

Start > type "verifier" without the quotes > Select the following options -

1. Select - "Create custom settings (for code developers)"
2. Select - "Select individual settings from a full list"
3. Check the following boxes -
- Special Pool
- Pool Tracking
- Force IRQL Checking
- Deadlock Detection
- Security Checks (only on Windows 7 & 8/8.1)
- DDI compliance checking (only on Windows 8/8.1)
- Miscellaneous Checks
4. Select - "Select driver names from a list"
5. Click on the "Provider" tab. This will sort all of the drivers by the provider.
6. Check EVERY box that is NOT provided by Microsoft / Microsoft Corporation.
7. Click on Finish.
8. Restart.

Important information regarding Driver Verifier:

- Perhaps the most important which I will now clarify as this has been misunderstood often, enabling Driver Verifier by itself is not! a solution, but instead a diagnostic utility. It will tell us if a driver is causing your issues, but again it will not outright solve your issues.

- If Driver Verifier finds a violation, the system will BSOD. To expand on this a bit more for the interested, specifically what Driver Verifier actually does is it looks for any driver making illegal function calls, causing memory leaks, etc. When and/if this happens, system corruption occurs if allowed to continue. When Driver Verifier is enabled per my instructions above, it is monitoring all 3rd party drivers (as we have it set that way) and when it catches a driver attempting to do this, it will quickly flag that driver as being a troublemaker, and bring down the system safely before any corruption can occur.

- After enabling Driver Verifier and restarting the system, depending on the culprit, if for example the driver is on start-up, you may not be able to get back into normal Windows because Driver Verifier will detect it in violation almost straight away, and as stated above, that will cause / force a BSOD.

If this happens, do not panic, do the following:

- Boot into Safe Mode by repeatedly tapping the F8 key during boot-up.

- Once in Safe Mode - Start > Search > type "cmd" without the quotes.

- To turn off Driver Verifier, type in cmd "verifier /reset" without the quotes.

- Restart and boot into normal Windows.

If your OS became corrupt or you cannot boot into Windows after disabling verifier via Safe Mode:

- Boot into Safe Mode by repeatedly tapping the F8 key during boot-up.

- Once in Safe Mode - Start > type "system restore" without the quotes.

- Choose the restore point you created earlier.

-- Note that Safe Mode for Windows 8/8.1 is a bit different, and you may need to try different methods: 5 Ways to Boot into Safe Mode in Windows 8 & Windows 8.1

How long should I keep Driver Verifier enabled for?

I recommend keeping it enabled for at least 24 hours. If you don't BSOD by then, disable Driver Verifier. I will usually say whether or not I'd like for you to keep it enabled any longer.

My system BSOD'd with Driver Verifier enabled, where can I find the crash dumps?

- If you have the system set to generate Small Memory Dumps, they will be located in %systemroot%\Minidump.

- If you have the system set to generate Kernel Memory Dumps, it will be located in %systemroot% and labeled MEMORY.DMP.

Any other questions can most likely be answered by this article:

Using Driver Verifier to identify issues with Windows drivers for advanced users

Davodi · Jan 19, 2015

Well, I enabled Driver Verifier 24 hours ago and there is no BSOD. When I want one, it does not appear...

Patrick · Jan 19, 2015

Just wait another day or so with it enabled.

Davodi · Jan 20, 2015

I had a new BSOD, DRIVER_VERIFIER_DETECTED_VIOLATION. It seems that was caused by a microsoft driver, but I'm not sure. Here you have minidump file.

Patrick · Jan 20, 2015

Can I actually get the kernel dump from this? The good news is the driver that is causing this bug check is revealed, but I cannot explain it to you well enough as I would like with only a small dump. Kernel dump is in C:\Windows and named MEMORY.DMP. Too large to natively upload here, so use OneDrive or something similar and paste the link.

Davodi · Jan 20, 2015

Sounds good, here you have kernel dump! https://www.dropbox.com/s/wbd2y9jyda6dps6/MEMORY.zip?dl=0

Patrick · Jan 20, 2015

Perfect, thanks.

Code:

5: kd> .bugcheck
Bugcheck code 000000C4
Arguments 00000000`00000062 ffffe001`cbc486f0 ffffe001`cbc44f00 00000000`00000001

Code:

5: kd> k
Child-SP          RetAddr           Call Site
ffffd000`25be0488 fffff800`7af036b0 nt!KeBugCheckEx
ffffd000`25be0490 fffff800`7af07c52 nt!VerifierBugCheckIfAppropriate+0x3c // Confirms leaks, throws 0xC4 bug check
ffffd000`25be04d0 fffff800`7aa365f4 nt!VfPoolCheckForLeaks+0x4a // Verifier checking for any leaks
ffffd000`25be0510 fffff800`7aef5064 nt! ?? ::FNODOBFM::`string'+0x57644
ffffd000`25be05a0 fffff800`7ad5edb2 nt!VfDriverUnloadImage+0x34 // Unloading
ffffd000`25be05d0 fffff800`7ad5ed1c nt!MiUnloadSystemImage+0x7e // Unloading 
ffffd000`25be0650 fffff800`7ad5ec64 nt!MmUnloadSystemImage+0x20 // Unloading
ffffd000`25be0680 fffff800`7ac3d3b0 nt!IopDeleteDriver+0x40
ffffd000`25be06c0 fffff800`7a8d5cbf nt!ObpRemoveObjectRoutine+0x64
ffffd000`25be0720 fffff800`7ac16da3 nt!ObfDereferenceObject+0x8f
ffffd000`25be0760 fffff800`7ac3d3b0 nt!IopDeleteDevice+0x47
ffffd000`25be0790 fffff800`7a8d5cbf nt!ObpRemoveObjectRoutine+0x64
ffffd000`25be07f0 fffff800`7a990946 nt!ObfDereferenceObject+0x8f
ffffd000`25be0830 fffff800`7ad4978d nt!PnpRemoveLockedDeviceNode+0x22a
ffffd000`25be0890 fffff800`7ad49706 nt!PnpDeleteLockedDeviceNode+0x4d
ffffd000`25be08d0 fffff800`7ad48b19 nt!PnpDeleteLockedDeviceNodes+0x9a
ffffd000`25be0950 fffff800`7ac1aa55 nt!PnpProcessQueryRemoveAndEject+0x539
ffffd000`25be0ab0 fffff800`7ac1b10f nt!PnpProcessTargetDeviceEvent+0x9d
ffffd000`25be0af0 fffff800`7a8fbacc nt!PnpDeviceEventWorker+0x31f
ffffd000`25be0b50 fffff800`7a97f440 nt!ExpWorkerThread+0x28c
ffffd000`25be0c00 fffff800`7a9d50c6 nt!PspSystemThreadStartup+0x58
ffffd000`25be0c60 00000000`00000000 nt!KiStartSystemThread+0x16

So basically a driver didn't free its pool allocations prior to unloading. 4th argument tells us there was 1 total paged or nonpaged allocations that weren't freed. According to the FBID:

Code:

FAILURE_BUCKET_ID:  0xc4_62_VRF_LEAKED_POOL_IMAGE_NETwbw02.sys

NETwbw02.sys is our guilty driver - Intel® Wireless WiFi Link Driver - Intel® Wireless WiFi Link Adapter.

Code:

5: kd> !verifier 3 NETwbw02.sys

Verify Flags Level 0x0002092b

  STANDARD FLAGS:
    [X] (0x00000000) Automatic Checks
    [X] (0x00000001) Special pool
    [X] (0x00000002) Force IRQL checking
    [X] (0x00000008) Pool tracking
    [ ] (0x00000010) I/O verification
    [X] (0x00000020) Deadlock detection
    [ ] (0x00000080) DMA checking
    [X] (0x00000100) Security checks
    [X] (0x00000800) Miscellaneous checks
    [X] (0x00020000) DDI compliance checking

We can see all of your selected DV options, but more importantly further down:

Code:

  MODULE: 0xffffe001c6f137d0 netwbw02.sys (Loaded)

    Pool Allocation Statistics: ( NonPagedPool / PagedPool )

      Current Pool Allocations: ( 0x00000001 / 0x00000000 )
      Current Pool Bytes:       ( 0x00000060 / 0x00000000 )
      Peak Pool Allocations:    ( 0x00000794 / 0x00000000 )
      Peak Pool Bytes:          ( 0x00e03ae5 / 0x00000000 )
      Contiguous Memory Bytes:       0x00000000
      Peak Contiguous Memory Bytes:  0x00000000

    Pool Allocations:

      Address             Length      Tag   Caller Address    
      ------------------  ----------  ----  ------------------
      0xffffcf813666cfa0  0x00000060  IWFS  0xfffff800cb304b25  NETwbw02

Here's our allocation from NETwbw02 that wasn't properly freed, with the IWFS pool tag (probably NETwbw02's 3rd party tag), and with a size of 60. Unfortunately as we have public symbols only, we cannot view the source files in which the memory allocations occurred. However you thankfully enabled Pool Tracking via DV's options, so we can view the log in kernel space that verifier has kept for us:

Code:

5: kd> !verifier 0x80 0xfffff800cb304b25

Log of recent kernel pool Allocate and Free operations:

There are up to 0x10000 entries in the log.

Parsing 0x0000000000010000 log entries, searching for address 0xfffff800cb304b25.



Finished parsing all pool tracking information.
No entries matching address fffff800cb304b25 have been found.

Unfortunately again however it appears that the allocation was overwritten before the crash occurred, therefore we cannot access it. As you can see, only the most recent 65,536 allocations are kept before they are overwritten (0x10000).

Nevertheless, it overall appears that there's a bug with netwbw02.sys, and that's the reason for the bug check.

Code:

5: kd> lmvm netwbw02
start             end                 module name
fffff800`cb2ee000 fffff800`cb66d000   NETwbw02   (no symbols)           
    Loaded symbol image file: NETwbw02.sys
    Image path: \SystemRoot\system32\DRIVERS\NETwbw02.sys
    Image name: NETwbw02.sys
    Timestamp:        Tue Jul 22 06:29:40 2014

It's relatively new, so perhaps a roll back if it's the latest, or an update if there's a newer version - https://downloadcenter.intel.com/default.aspx

Davodi · Jan 21, 2015

There was a new version so I updated it. I hope it was the only problem... just in case, I'll have Driver Verifier enabled more days. Thanks for your help!

Patrick · Jan 21, 2015

Keep me updated.

Davodi · Jan 23, 2015

A new one, this time KMODE_EXCEPTION_NOT_HANDLED... minidump here. If you need kernel dump tell me, my internet is really slow...

Davodi · Jan 23, 2015

Here it is! Kernel dump: https://www.dropbox.com/s/riiae3l2isk0l2w/MEMORY.zip?dl=0

Patrick · Jan 24, 2015

Downloading the crash dump now. Will post back.

Patrick · Jan 24, 2015

KMODE_EXCEPTION_NOT_HANDLED (1e)

This indicates that a kernel-mode program generated an exception which the error handler did not catch.

Code:

4: kd> .bugcheck
Bugcheck code 0000001E
Arguments ffffffff`c0000005 fffff960`003471a0 00000000`00000000 00000000`00000010

Code:

4: kd> kv
Child-SP          RetAddr           : Args to Child                                                           : Call Site
ffffd000`27c94e98 fffff801`8fdba3d7 : 00000000`0000001e ffffffff`c0000005 fffff960`003471a0 00000000`00000000 : nt!KeBugCheckEx
ffffd000`27c94ea0 fffff801`8fd746c2 : 00000000`c0000016 ffffd000`27c95770 fffff680`00000000 fffff801`8fc70017 : nt! ?? ::FNODOBFM::`string'+0x41427
ffffd000`27c95590 fffff801`8fd72e14 : 00000000`00000000 fffff901`406d6b60 ffffe001`241c1000 fffff801`903b258f : nt!KiExceptionDispatch+0xc2
ffffd000`27c95770 fffff960`003471a0 : fffff960`001354be fffff901`406d6b60 ffffd000`27c95b80 00000000`00000000 : nt!KiPageFault+0x214 (TrapFrame @ ffffd000`27c95770) // Access violation.
ffffd000`27c95908 00000000`00000001 : 00000000`00000000 00000000`00000000 fffff901`406d6b60 00000000`00000000 : win32k!xxxMNSwitchToAlternateMenu+0x78
ffffd000`27c95968 00000000`00000000 : 00000000`00000000 fffff901`406d6b60 00000000`00000000 ffffe001`18a061a0 : 0x1

Code:

4: kd> .trap ffffd000`27c95770
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff90141a317c0 rbx=0000000000000000 rcx=0000000000000000
rdx=000000000000c240 rsi=0000000000000000 rdi=0000000000000000
rip=fffff960003471a0 rsp=ffffd00027c95908 rbp=ffffd00027c95b80
 r8=fffff901406ee390  r9=0000000000000000 r10=fffff90141a317c0
r11=ffffd00027c958b0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
win32k!xxxMNSwitchToAlternateMenu+0x78:
fffff960`003471a0 8b16            mov     edx,dword ptr [rsi] ds:00000000`00000000=????????

Okay, so this looks like RAM now (or some other hardware) for a few reasons:

1. Misaligned instruction pointer (IP). Misaligned IPs never automatically imply a hardware memory related issue (or hardware issue at all), as it can be caused by stack buffer overflows, etc. However, this leads us to #2.

2. Verifier is enabled, therefore we can assume yours is not being caused by a driver causing a buffer overflow or something similar.

Code:

4: kd> !verifier

Verify Flags Level 0x0002092b

  STANDARD FLAGS:
    [X] (0x00000000) Automatic Checks
    [X] (0x00000001) Special pool
    [X] (0x00000002) Force IRQL checking
    [X] (0x00000008) Pool tracking
    [ ] (0x00000010) I/O verification
    [X] (0x00000020) Deadlock detection
    [ ] (0x00000080) DMA checking
    [X] (0x00000100) Security checks
    [X] (0x00000800) Miscellaneous checks
    [X] (0x00020000) DDI compliance checking

Code:

4: kd> !pte edx
                                           VA 0000000000000000
PXE at FFFFF6FB7DBED000    PPE at FFFFF6FB7DA00000    PDE at FFFFF6FB40000000    PTE at FFFFF68000000000
contains 58400001C8088867  contains 2770000234289867  contains 58500001EF50A867  contains 0000000000000000
pfn 1c8088    ---DA--UWEV  pfn 234289    ---DA--UWEV  pfn 1ef50a    ---DA--UWEV  not valid

Code:

4: kd> !pte ffdf3300e8c98b41
                                           VA ffdf3300e8c98b41
PXE at FFFFF6FB7DBED330    PPE at FFFFF6FB7DA66018    PDE at FFFFF6FB4CC03A30    PTE at FFFFF699807464C0
contains 0000000000000000
not valid

WARNING: noncanonical VA, accesses will fault !

etc....

Run Memtest for no less than 8 passes:

Memtest86+:

Download Memtest86+ here:

Memtest86+ - Advanced Memory Diagnostic Tool

Which should I download?

You can either download the pre-compiled .ISO that you would burn to a CD and then boot from the CD, or you can download the auto-installer for the USB key. What this will do is format your USB drive, make it a bootable device, and then install the necessary files. Both do the same job, it's just up to you which you choose, or which you have available (whether it's CD or USB).

Do note that some older generation motherboards do not support USB-based booting, therefore your only option is CD (or Floppy if you really wanted to).

How Memtest works (you don't need to read, it's only for those interested in the specifics):

Memtest uses algorithms (specifically two), namely moving inversion & what is deemed Modulo-X. Essentially, the first algorithm fills the memory with a pattern. Starting at the low address, it checks to see if the pattern was changed (it should not have been), writes the patterns complement, increments the address, and repeats. Starting at the highest address (as opposed to the lowest), it follows the same checklist.

The reason for the second algorithm is due to a few limitations, with the first being that not all adjacent cells are being tested for interaction due to modern chips being 4 to 16 bits wide regarding data storage. With that said, patterns are used to go ahead and ensure that all adjacent cells have at least been written with all possible one and zero combinations.

The second is that caching, buffering and out of order execution will interfere with the moving inversions algorithm. However, the second algorithm used is not affected by this. For starting offsets of 0-20, the algorithm will write every 20th location with a pattern, write all other locations with the patterns complement, repeat the previous one (or more) times, and then check every 20th location for the previously mentioned pattern.

Now that you know how Memtest actually works, it's important to know that the tests it goes through all mean something different. It goes from Test 0 through Test 12, many of which use either one or the other algorithm discussed above, among many other things.

Any other questions, they can most likely be answered by reading this great guide here:

FAQ : please read before posting

Davodi · Jan 30, 2015

[FONT=Arial, sans-serif]I did not have time to run Memtest, but I'll do this weekend. I'll reply after that. I didn't have any other BSOD at least...[/FONT]

Patrick · Jan 30, 2015

Let me know results.

Davodi · Feb 23, 2015

I've been busy but yesterdey I could run Memtest for 8 passes but it didn't find any error. Also, after one month without BSODs, I got a new one so here you have kernel dump file... is there any chance that a Windows driver is causing me problems instead of memory issues? Since Verifier is enabled only for non windows drivers... hope you can help me, thanks again!

Dump: https://www.dropbox.com/s/wr4spanfjwx9dq6/022215.zip?dl=0

Several BSOD - Windows 8.1 x64

Member

Sysnative Staff

Member

Member

Attachments

Sysnative Staff

Member

Sysnative Staff

Member

Attachments

Sysnative Staff

Member

Sysnative Staff

Member

Sysnative Staff

Member

Attachments

Member

Sysnative Staff

Sysnative Staff

Member

Sysnative Staff

Member