Hi all. I had this happen today for the first time. I researched this some and ran sfc/scannow. It found corrupted files that it was unable to repair. I ran a memory check utility and it found no problems. I have run the file collection app and you will find it here. My system is a Dell Inspiron 20 Model 3052, Windows 10 64 Bit, Intel Celeron CPU N3150@1.60GHz, 4GB ram View attachment SysnativeFileCollectionApp.zip
BSOD Memory Management
- Thread starter mike56
- Start date
I wanted to add that I had a recent episode while online. I forget what they call it but it was a warning that my system was infected and that I needed to call this number or my files would be locked. I ran task manger and was able to get out of it. I use Windows Defender and it alerted me to some infections. I also ran Malwarebytes free and it found a number of serious infections. I had to run it twice to get rid of them all. Since all of that happened my system seems to run slow. Everything seems slow. I have run additional scans and find nothing.
Hi mike56,
Please create a new thread at our Security Arena and read Malware Removal Posting Instructions
If SFC keeps finding problems it cannot fix, please create a new thread at the Windows Update section and read Windows Update Forum Posting Instructions
We need your system to be clean of both malware and Windows corruption, both can cause issues affecting BSODs.
Please create a new thread at our Security Arena and read Malware Removal Posting Instructions
If SFC keeps finding problems it cannot fix, please create a new thread at the Windows Update section and read Windows Update Forum Posting Instructions
We need your system to be clean of both malware and Windows corruption, both can cause issues affecting BSODs.
Hi Mike56,
The crash dump you posted indicates that the page read from the page file did not match the original page written to disk. This is likely due to pagefile/filesystem corruption which is often caused by sudden power failures, storage drivers misbehaving, or hardware failing.
From the call stack, read bottom to top, there is a page fault, which means the system had to go to the page file to bring data back into RAM. After this, it goes through the storage stack, and reads the (compressed) data. Finally the system decompresses the data, and then compares the data's hash to the hash of the data before it was sent to the page file. Because they did not match, we know that it is corrupted, and therefore the system had to crash, which is why we see nt!KeBugCheckEx being called.
The system event log is also showing some possible issues with your C: drive.
Have you experienced sudden and unexpected reboots of your system? This event is a bit worrying.
Given that you are likely not using SCSI multipath in your laptop, this sounds like something is messed up with GPT on your disk(s).
I would suggest running from an administrative prompt:
Press "Y" to schedule it on the next reboot. Then reboot your computer and let it run, this will attempt to find and repair any damage to your filesystem.
After that, please post the resulting event log from chkdsk. Here is a guide on doing that.
Then run HDTune, and run an error scan on your primary disk. Post a screenshot when that is finished.
The crash dump you posted indicates that the page read from the page file did not match the original page written to disk. This is likely due to pagefile/filesystem corruption which is often caused by sudden power failures, storage drivers misbehaving, or hardware failing.
From the call stack, read bottom to top, there is a page fault, which means the system had to go to the page file to bring data back into RAM. After this, it goes through the storage stack, and reads the (compressed) data. Finally the system decompresses the data, and then compares the data's hash to the hash of the data before it was sent to the page file. Because they did not match, we know that it is corrupted, and therefore the system had to crash, which is why we see nt!KeBugCheckEx being called.
Code:
# Child-SP RetAddr Call Site
00 ffffda01`458b4ce8 fffff800`a9a5586b nt!KeBugCheckEx
01 ffffda01`458b4cf0 fffff800`a9928456 [COLOR=#ff0000]nt!MiValidatePagefilePageHash[/COLOR]+0xa343b
02 ffffda01`458b4dc0 fffff800`a9929e68 [COLOR=#ff0000]nt!MiWaitForInPageComplete[/COLOR]+0x296
03 ffffda01`458b4ec0 fffff800`a9915936 nt!MiIssueHardFault+0x1d8
04 ffffda01`458b4fa0 fffff800`a99fdd72 nt!MmAccessFault+0xc96
05 ffffda01`458b5190 fffff800`a9962bb0 nt!KiPageFault+0x132
06 ffffda01`458b5320 fffff800`a99621b0 [COLOR=#ff0000]nt!RtlDecompressBufferXpressLz[/COLOR]+0x60
07 ffffda01`458b5350 fffff800`a9961e8d [COLOR=#ff0000]nt!RtlDecompressBufferEx[/COLOR]+0x60
08 ffffda01`458b53a0 fffff800`a9961cff nt!ST_STORE<SM_TRAITS>::StDmSinglePageCopy+0x159
09 ffffda01`458b5480 fffff800`a99616eb nt!ST_STORE<SM_TRAITS>::StDmSinglePageTransfer+0x7b
0a ffffda01`458b54d0 fffff800`a99614bc nt!ST_STORE<SM_TRAITS>::StDmpSinglePageRetrieve+0x183
0b ffffda01`458b5570 fffff800`a996312f nt!ST_STORE<SM_TRAITS>::StDmPageRetrieve+0x98
0c ffffda01`458b5630 fffff800`a99b1fb1 nt!SMKM_STORE<SM_TRAITS>::SmStDirectReadIssue+0x6f
0d ffffda01`458b5680 fffff800`a989e20b nt!SMKM_STORE<SM_TRAITS>::SmStDirectReadCallout+0x21
0e ffffda01`458b56b0 fffff800`a9959ad5 nt!KeExpandKernelStackAndCalloutInternal+0x8b
0f ffffda01`458b5700 fffff800`a9950172 nt!SMKM_STORE<SM_TRAITS>::SmStDirectRead+0xad
10 ffffda01`458b57d0 fffff800`a994f9d2 nt!SMKM_STORE<SM_TRAITS>::SmStWorkItemQueue+0x1ae
11 ffffda01`458b5820 fffff800`a9963faa nt!SMKM_STORE_MGR<SM_TRAITS>::SmIoCtxQueueWork+0xce
12 ffffda01`458b58a0 fffff800`a99a071a nt!SMKM_STORE_MGR<SM_TRAITS>::SmPageRead+0x16a
13 ffffda01`458b5910 fffff800`a992a459 nt!SmPageRead+0x2e
14 ffffda01`458b5960 fffff800`a9929e20 nt!MiIssueHardFaultIo+0x11d
15 ffffda01`458b59b0 fffff800`a9915936 nt!MiIssueHardFault+0x190
16 ffffda01`458b5a50 fffff800`a99fdd72 nt!MmAccessFault+0xc96
17 ffffda01`458b5c40 00007ffa`0f27134b nt!KiPageFault+0x132
18 00000007`ab27e9e0 00000000`00000000 0x00007ffa`0f27134bThe system event log is also showing some possible issues with your C: drive.
Code:
Event[2280]: Log Name: System
Source: Disk
Date: 2017-09-13T21:17:00.793
Event ID: 153
Task: N/A
Level: Warning
Opcode: N/A
Keyword: Classic
User: N/A
User Name: N/A
Computer: DESKTOP-I87918H
Description:
The IO operation at logical block address 0xcc14a0 for Disk 1 (PDO name: \Device\000000a0) was retried.
Code:
Event[2281]:
Log Name: System
Source: Disk
Date: 2017-09-13T21:17:00.793
Event ID: 51
Task: N/A
Level: Warning
Opcode: N/A
Keyword: Classic
User: N/A
User Name: N/A
Computer: DESKTOP-I87918H
Description:
An error was detected on device \Device\Harddisk1\DR18 during a paging operation.Have you experienced sudden and unexpected reboots of your system? This event is a bit worrying.
Code:
Event[8962]:
Log Name: System
Source: Microsoft-Windows-UserModePowerService
Date: 2017-06-24T11:29:03.720
Event ID: 22
Task: N/A
Level: Information
Opcode: Info
Keyword: N/A
User: S-1-5-18
User Name: NT AUTHORITY\SYSTEM
Computer: DESKTOP-I87918H
Description:
Reapply power settings upon completion of the provisioning engine's turn 5Given that you are likely not using SCSI multipath in your laptop, this sounds like something is messed up with GPT on your disk(s).
Code:
Event[1287]:
Log Name: System
Source: Disk
Date: 2017-09-27T14:50:02.081
Event ID: 158
Task: N/A
Level: Warning
Opcode: N/A
Keyword: Classic
User: N/A
User Name: N/A
Computer: DESKTOP-I87918H
Description:
Disk 2 has the same disk identifiers as one or more disks connected to the system. Go to Microsoft's support website (http://support.microsoft.com) and search for KB2983588 to resolve the issue.I would suggest running from an administrative prompt:
Code:
chkdsk.exe /R /X C:Press "Y" to schedule it on the next reboot. Then reboot your computer and let it run, this will attempt to find and repair any damage to your filesystem.
After that, please post the resulting event log from chkdsk. Here is a guide on doing that.
Then run HDTune, and run an error scan on your primary disk. Post a screenshot when that is finished.
Hi Spectrum. I have not had any issues with the computer other than being slow IMO. That was the first blue screen and indication of a problem that I've had. I ran the chkdsk and the other things you suggested. HD Tune appears to show the hard drive okay. Should I still go to the Security Arena and post a thread?
View attachment HDTune2.txtView attachment HDTune.txtView attachment SALog.txtView attachment Addition.txtView attachment FRST.txtView attachment chkdsk.txt
You should go to the Security Arena, it is not known what may still be on your system that can affect stability and performance.
After you're declared clean, run a SFC scan. If SFC reports unrepaired errors, go to the Windows Update section.
After you're declared clean, run a SFC scan. If SFC reports unrepaired errors, go to the Windows Update section.
It can take some days for them to get to your thread, there used to be a thread where you could let them know you're waiting for help after 3 days.
If you don't get a response after 4-5 days, contact 1 of the analysts.
If you don't get a response after 4-5 days, contact 1 of the analysts.
Has Sysnative Forums helped you? Please consider donating to help us support the site!