[SOLVED] [8.1 x64] 0x50 memory_corruption: A strange recurring BSOD issue

S

Sysnative Windows Update

Inactive
Joined
Oct 9, 2014
Posts
741
Hello,
back approximately half a year ago one of my two Desktop systems in my house has started BSOD-ing. the BSOD listed ntfs.sys as the cause (which of course is not the cause). I have done all the testing (stress tests, HDD tests, Memtest86+, DV, SFC, BIOS updates, checked the temps, check for malware, defraged the HDD). It was good for two-three months, then again.
It happened today as well with the same ntfs.sys. It didn't create a dump file (yes, it is configured properly, but it rebooted before it could finish the process).

The system is rock stable otherwise. It can play games for hours and hours without issue, heck, days even. It is not OC-ed as it has an Intel H67 with a i7 2600, 8GB RAM, GTX 760 4GB, 500GB Seagate HDD, Samsung 840 Pro SSD, GS 700 PSU.
It'd appreciate your input as to figuring out the cause, because something is clearly not right.

I'd be happy to provide you with any information you may require :)

Dropbox - SysnativeFileCollectionApp(6).zip
 
Re: A strange recurring BSOD issue

Have you tried a different SATA port? With the issues I was experiencing with my SSD a couple weeks ago, I came across an interesting troubleshooting article that described similar behavior due to a bad SATA port on the motherboard.
 
Re: A strange recurring BSOD issue

There are no dumps in the attached zip file.

Seeing ntfs.sys - run SeaTools for DOS, LONG test (on ALL drives) - Hard Drive (HDD) Diagnostics + SSD Test

I know that you said that you ran HDD tests, but please humor me here.

Regards. . .

John
 
Re: A strange recurring BSOD issue

Odd that you do not have any mini-dumps as the eventlog shows they were created. Make sure CCleaner is not deleting any of the minidump files. Look in the settings and uncheck the entry for deleting minidumps.

Code: 
Event[466]:
  Log Name: System
  Source: Microsoft-Windows-WER-SystemErrorReporting
  Date: 2017-08-21T08:47:05.000
  Event ID: 1001
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: PC
  Description: 
The computer has rebooted from a bugcheck.  The bugcheck was: 0x00000050 (0xffffd001468788d8, 0x0000000000000001, 0xfffff801f378e921, 0x0000000000000000). A dump was saved in: C:\Windows\Minidump\082117-5062-01.dmp. Report Id: 082117-5062-01.
 
Re: A strange recurring BSOD issue

jcgriff2 said:
There are no dumps in the attached zip file.

Seeing ntfs.sys - run SeaTools for DOS, LONG test (on ALL drives) - Hard Drive (HDD) Diagnostics + SSD Test

I know that you said that you ran HDD tests, but please humor me here.

Regards. . .

John
Click to expand...

does ALL drives include SSDs? Because on the link I saw SSDLife for SSDs, which I have already used to check. Is SeaTools safe for the SSDs?
 
Re: A strange recurring BSOD issue

softwaremaniac said:
does ALL drives include SSDs? Because on the link I saw SSDLife for SSDs, which I have already used to check. Is SeaTools safe for the SSDs?
Click to expand...

Seagate recommends SeaTools to test their SSDs, so I would expect it to be safe for all SSDs. I tested my Crucial SSD with it and have not had problems with the SSD afterward (since I removed it from the Motherboard it was not compatible with).
 
Re: A strange recurring BSOD issue

The CPU voltage, frequency and RAM voltage, timing, etc. are all good?
 
Re: A strange recurring BSOD issue

dtsoftbus01.sys present: DAEMON Tools Virtual Bus Driver c:\windows\system32\drivers\dtsoftbus01.sys. Try to remove/uninstall it.

You are using e1iexpress service and e1i63x64.sys for your Intel 82579V Gigabit Network Connection. I have the same NIC, but I'm using e1cexpress service and e1c64x64.sys (12.10.29.0, 468.752 bytes, 26/09/2014 17.07). I'm not sure which one of the two drivers is the correct one.

Different ram manufacturers: you could try hcidesign memtest; you could also try to remove one of the sticks (put the other stick in the correct slot).

New firmware available (if I'm not wrong...): Download BIOS Update [BLH6710H.86A]


Hope this helps...
 
Re: A strange recurring BSOD issue

I have previously tried everything you told me. Didn't help. But the PC is running solid now, so, I'll be monitoring and reporting back when something happens.

Thanks for the suggestions.
 
Re: A strange recurring BSOD issue

Looks like I got the bugger, BSODed once again while I was removing Malwarebytes Anti-Exploit, but it managed to remove it. Will keep you posted and give you the dump when I can.
 
Re: A strange recurring BSOD issue

Code: 
[COLOR=#ff0000]BugCheck 3B[/COLOR][COLOR=#1e1e1e], {[/COLOR][COLOR=#008000]c0000005[/COLOR][COLOR=#1e1e1e], [/COLOR][COLOR=#1e1e1e]fffff80384ccaf02[/COLOR][COLOR=#1e1e1e], [/COLOR][COLOR=#1e1e1e]ffffd00023420eb0[/COLOR][COLOR=#1e1e1e], [/COLOR][COLOR=#1e1e1e]0[/COLOR][COLOR=#1e1e1e]}[/COLOR]

[COLOR=#1e1e1e]Probably caused by : [/COLOR][COLOR=#1e1e1e]Unknown_Image[/COLOR][COLOR=#1e1e1e] ( [/COLOR][COLOR=#1e1e1e]PAGE_NOT_ZERO[/COLOR][COLOR=#1e1e1e] )[/COLOR][COLOR=#1e1e1e][FONT=verdana]

Code: 
3: kd>[/FONT][/COLOR][COLOR=#008000][FONT=verdana]!error c0000005[/FONT][/COLOR][COLOR=#1e1e1e][FONT=verdana]
Error code: (NTSTATUS) 0xc0000005 (3221225477) - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.[/FONT][/COLOR][COLOR=#1e1e1e][FONT=verdana]

WinDbg has highlighted that a number of pages have been corrupted, which will made the dump file difficult to debug.

I've noticed that an avast! driver is present within the raw stack of the thread, have you considered updating or removing the program?

Code: 
3: kd>[/FONT][/COLOR][COLOR=#008000][FONT=verdana]!dpx[/FONT][/COLOR][COLOR=#1e1e1e][FONT=verdana]
Start memory scan  : 0xffffd000234205f8 ($csp)
End memory scan    : 0xffffd00023422000 (Stack Base)

               rsp : 0xffffd000234205f8 : 0xfffff80384d778e9 : nt!KiBugCheckDispatch+0x69
0xffffd000234205f8 : 0xfffff80384d778e9 : nt!KiBugCheckDispatch+0x69
0xffffd00023420610 : 0xfffff80384ccaf02 : nt!KiSwapThread+0x152
Unable to load image aswSP.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for [/FONT][/COLOR][COLOR=#ff0000][FONT=verdana]aswSP.sys[/FONT][/COLOR][COLOR=#1e1e1e][FONT=verdana]
*** ERROR: Module load completed but symbols could not be loaded for aswSP.sys
0xffffd00023420728 : 0xfffff80384d775b3 : nt!KiSystemServiceCopyEnd+0x13
0xffffd00023420738 : 0xfffff80384d771fc : nt!KiSystemServiceHandler+0x7c
0xffffd00023420758 : 0xfffff80384fcd942 : nt!NtWaitForSingleObject+0xb2
0xffffd00023420770 : 0xfffff80384d775b3 : nt!KiSystemServiceCopyEnd+0x13
0xffffd00023420778 : 0xfffff80384d732ed : nt!RtlpExecuteHandlerForException+0xd
0xffffd000234207a0 : 0xffffd00023420830 : 0xfffff80384d775b3 : nt!KiSystemServiceCopyEnd+0x13
0xffffd000234207a8 : 0xfffff80384cd87fd : nt!RtlDispatchException+0x1a5
0xffffd000234207b8 : 0xfffff80384c1e000 : "nt!_guard_check_icall_fptr <PERF> (nt+0x0)"
0xffffd00023420800 : 0xfffff80384c1e000 : "nt!_guard_check_icall_fptr <PERF> (nt+0x0)"
0xffffd00023420830 : 0xfffff80384d775b3 : nt!KiSystemServiceCopyEnd+0x13
0xffffd00023420838 : 0xfffff80384c1e000 : "nt!_guard_check_icall_fptr <PERF> (nt+0x0)"
0xffffd00023420840 : 0xfffff80384f3c8d8 : "nt!BcpCursor <PERF> (nt+0x31e8d8)"
0xffffd00023420860 : 0xfffff80384d77180 : nt!KiSystemServiceHandler
0xffffd000234208a8 : 0xfffff80384fe7fe6 : nt!ObpCreateHandle+0x596
0xffffd00023420948 : 0xfffff803853af58f : hal!HalSendSoftwareInterrupt+0xc0
0xffffd00023420988 : 0xfffff80384d76157 : nt!KiPageFault+0x257
0xffffd000234209f0 : 0xffffd00023420eb8 : 0xfffff80384ca3860 : nt!MiFlushTbAsNeeded+0xf8
0xffffd000234209f8 : 0xfffff80384c982af : nt!ExpReleaseResourceForThreadLite+0x48f
0xffffd00023420a00 : 0xffffd00023421348 : 0xfffff80384c4b837 : nt!RtlGetExtendedContextLength+0x1f
0xffffd00023420a20 : 0xffffd00023421348 : 0xfffff80384c4b837 : nt!RtlGetExtendedContextLength+0x1f
0xffffd00023420b38 : 0xfffff80384c674c9 : nt!MiAllocateWsle+0x269
0xffffd00023420b98 : 0xfffff80384c68688 : nt!MiResolveDemandZeroFault+0x428
0xffffd00023420be8 : 0xfffff803853af58f : hal!HalSendSoftwareInterrupt+0xc0
0xffffd00023420bf8 : 0xfffff80384ec9240 : nt!ExNode0
0xffffd00023420c58 : 0xfffff80384d1d3cf : nt!KiDeferredReadyThread+0xf6f
0xffffd00023420c60 : 0xfffff80384f1a180 : nt!KiInitialPCR+0x180
0xffffd00023420c70 : 0xfffff80384ec9240 : nt!ExNode0
0xffffd00023420cb8 : 0xfffff80384c60842 : nt!MiDispatchFault+0x2e2
0xffffd00023420d48 : 0xfffff80384d14930 : nt!KiOpFetchBytes+0x30
0xffffd00023420d58 : 0xfffff80384c652a0 : nt!KeWaitForSingleObject
0xffffd00023420d60 : 0xfffff80384fcd9e2 : nt!NtWaitForSingleObject+0x152
0xffffd00023420d68 : 0xfffff80384c1e000 : "nt!_guard_check_icall_fptr <PERF> (nt+0x0)"
0xffffd00023420d70 : 0xfffff80384f3320c : "nt!BcpCursor <PERF> (nt+0x31520c)"
0xffffd00023420d78 : 0xfffff80384c1e000 : "nt!_guard_check_icall_fptr <PERF> (nt+0x0)"
0xffffd00023420d80 : 0xfffff80384f331dc : "nt!BcpCursor <PERF> (nt+0x3151dc)"
0xffffd00023420d88 : 0xfffff80384c1e000 : "nt!_guard_check_icall_fptr <PERF> (nt+0x0)"
0xffffd00023420d90 : 0xfffff80384f30338 : "nt!BcpCursor <PERF> (nt+0x312338)"
0xffffd00023420d98 : 0xfffff80384c1e000 : "nt!_guard_check_icall_fptr <PERF> (nt+0x0)"
0xffffd00023420da0 : 0xfffff80384f4b050 : "nt!BcpCursor <PERF> (nt+0x32d050)"
0xffffd00023420da8 : 0xfffff80384c1e000 : "nt!_guard_check_icall_fptr <PERF> (nt+0x0)"
0xffffd00023420db0 : 0xfffff80384f3c8d8 : "nt!BcpCursor <PERF> (nt+0x31e8d8)"
0xffffd00023420dd8 : 0xfffff80384d146c7 : nt!KiPreprocessFault+0x83
0xffffd00023420df8 : 0xfffff80384c63a00 : nt!MmAccessFault+0x280
0xffffd00023420e00 : 0xffffd00023420e10 : 0xfffff80384ccaf02 : nt!KiSwapThread+0x152
0xffffd00023420e10 : 0xfffff80384ccaf02 : nt!KiSwapThread+0x152
0xffffd00023420e18 : 0xfffff80384ccaf04 : nt!KiSwapThread+0x154
0xffffd00023420e50 : 0xfffff80384c1e000 : "nt!_guard_check_icall_fptr <PERF> (nt+0x0)"
0xffffd00023420e78 : 0xfffff80384d1bd34 : nt!KiDispatchException+0x190
0xffffd00023420eb8 : 0xfffff80384ca3860 : nt!MiFlushTbAsNeeded+0xf8
0xffffd00023420f80 : 0xfffff80384d7898f : nt!memset+0xcf
0xffffd00023420f90 : 0xfffff80384c1e000 : "nt!_guard_check_icall_fptr <PERF> (nt+0x0)"
0xffffd00023420fa8 : 0xfffff80384ccaf02 : nt!KiSwapThread+0x152
0xffffd00023420fb8 : 0xfffff80384d76157 : nt!KiPageFault+0x257
0xffffd00023421020 : 0xffffd00023420eb8 : 0xfffff80384ca3860 : nt!MiFlushTbAsNeeded+0xf8
0xffffd00023421028 : 0xfffff80384c982af : nt!ExpReleaseResourceForThreadLite+0x48f
0xffffd00023421030 : 0xffffd00023421348 : 0xfffff80384c4b837 : nt!RtlGetExtendedContextLength+0x1f
0xffffd000234211b8 : 0xfffff80384c65026 : nt!ExReleasePushLockExclusiveEx+0x36
0xffffd000234211d8 : 0xfffff80384c65026 : nt!ExReleasePushLockExclusiveEx+0x36
0xffffd000234211f0 : 0xffffd00023421498 : 0xfffff9600013247d : win32k!HANDLELOCK::vUnlock+0x25
0xffffd00023421218 : 0xfffff9600040ddc7 : "win32k!NSInstrumentation::CLeakTrackingAllocator::AllocateCommon<<lambda_16c8fa6c1365df5cd1a45d38bb6ccfe2>,<lambda_278f24766fae20cbf0c48ddfc336e8e8> >"+0x2f
0xffffd00023421278 : 0xfffff960001f3cba : win32k!RFONTOBJ::vDelayedReclaim+0x5a
0xffffd00023421288 : 0xfffff960001463da : win32k!LFONTOBJ::~LFONTOBJ+0x16
0xffffd00023421298 : 0xfffff80384fe7fe6 : nt!ObpCreateHandle+0x596
0xffffd000234212a8 : 0xffffd00023421498 : 0xfffff9600013247d : win32k!HANDLELOCK::vUnlock+0x25
0xffffd000234212d8 : 0xfffff80384ebaa85 : nt!ExFreePoolWithTag+0x5f5
0xffffd000234212e8 : 0xfffff9600040e50a : win32k!NSInstrumentation::CLeakTrackingAllocator::Allocate+0x46
0xffffd00023421308 : 0xfffff9600010c635 : win32k!PushThreadGuardedObject+0x71
0xffffd00023421320 : 0xffffd00023421348 : 0xfffff80384c4b837 : nt!RtlGetExtendedContextLength+0x1f
0xffffd00023421338 : 0xfffff960000d8f92 : win32k!ESTROBJ::vInit+0x142
0xffffd00023421348 : 0xfffff80384c4b837 : nt!RtlGetExtendedContextLength+0x1f
0xffffd00023421398 : 0xfffff80384c978a2 : nt!ExReleaseResourceAndLeaveCriticalRegion+0x12
0xffffd00023421458 : 0xfffff80384c65026 : nt!ExReleasePushLockExclusiveEx+0x36
0xffffd00023421488 : 0xfffff960001274bd : win32k!HANDLELOCK::vLockHandle+0x12d
0xffffd00023421498 : 0xfffff9600013247d : win32k!HANDLELOCK::vUnlock+0x25
0xffffd000234214a8 : 0xfffff80384c978a2 : nt!ExReleaseResourceAndLeaveCriticalRegion+0x12
0xffffd000234214c8 : 0xfffff960000df851 : win32k!HmgLockEx+0xb1
0xffffd000234214e8 : 0xfffff80384c94f8b : nt!MiReleasePtes+0x21b
0xffffd00023421540 : 0xfffff80384c1e000 : "nt!_guard_check_icall_fptr <PERF> (nt+0x0)"
0xffffd00023421568 : 0xfffff80384d779ce : nt!KiExceptionDispatch+0xce
0xffffd00023421690 : 0xfffff80384c1e000 : "nt!_guard_check_icall_fptr <PERF> (nt+0x0)"
0xffffd000234216b8 : 0xfffff80384ccaf02 : nt!KiSwapThread+0x152
0xffffd000234216d8 : 0xfffff80384d7898f : nt!memset+0xcf
0xffffd00023421748 : 0xfffff80384d75efe : nt!KiGeneralProtectionFault+0xfe
0xffffd00023421750 : 0x0000000fffffffff :  Trap @ ffffd00023421750
0xffffd00023421758 : 0xfffff80384ca5e5d : nt!MiProbeLockFrame+0x2cd
0xffffd000234217b0 : 0xfffff80384d7898f : nt!memset+0xcf
0xffffd000234218b8 : 0xfffff80384ccaf02 : nt!KiSwapThread+0x152
0xffffd00023421978 : 0xfffff80384cca979 : nt!KiCommitThreadWait+0x129
0xffffd00023421990 : 0xfffff8017a1e26f0 : condrv!CdpFastIoDeviceControl
0xffffd000234219f8 : 0xfffff80384c65613 : nt!KeWaitForSingleObject+0x373
0xffffd00023421a18 : 0xfffff8038508dfa2 : nt!NtDeviceIoControlFile+0x56
0xffffd00023421a78 : 0xffffd00023421b80 :  !du ""l rights""
0xffffd00023421a88 : 0xfffff80384fcd942 : nt!NtWaitForSingleObject+0xb2
0xffffd00023421af8 : 0xfffff80384d775b3 : nt!KiSystemServiceCopyEnd+0x13
0xffffd00023421b00 : 0xffffe0003286a540 :  Trap @ ffffd00023421b00
0xffffd00023421b70 : 0x002e006e006f0069 :  !du [/FONT][/COLOR][COLOR=#ff0000][FONT=verdana]""ion.  All rights""[/FONT][/COLOR][COLOR=#1e1e1e][FONT=verdana]
0xffffd00023421b78 : 0x006c004100200020 :  !du ""  All rights""
0xffffd00023421b80 : 0x006900720020006c :  !du ""l rights""[/FONT][/COLOR][COLOR=#1e1e1e][FONT=verdana]

It may not be the issue, but considering the number of win32k.sys calls, it could be likely influence within the resultant crash. There was an interesting string present too: "All Rights"?

I wonder if it possibly related to memory access privileges?

Code: 
3: kd>[/FONT][/COLOR][COLOR=#008000][FONT=verdana]lmvm aswSP[/FONT][/COLOR][COLOR=#1e1e1e][FONT=verdana]
Browse full module list
start             end                 module name
fffff801`772f5000 fffff801`773a3000   aswSP    T (no symbols)           
    Loaded symbol image file: aswSP.sys
    Image path: aswSP.sys
    Image name: aswSP.sys
    Browse all global symbols  functions  data
    Timestamp:        [/FONT][/COLOR][COLOR=#ff0000][FONT=verdana]Fri Apr 28 08:46:31 2017[/FONT][/COLOR][COLOR=#1e1e1e][FONT=verdana] (5902F357)
    CheckSum:         00094B16
    ImageSize:        000AE000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4[/FONT][/COLOR][COLOR=#1e1e1e]
[/COLOR]
 
Last edited:

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top