random BSOD on windows 8.1 caused by ntoskrnl.exe

Question

Hi all,

I am facing major issues as my new computer is plagued with BSOD since i bought it.

I have not over clocked any of the components and have been unlucky to solve issues related to BSOD. the occurrences are totally random but the cause(ntoskrnl.exe) remains the same even the address (ntoskrnl.exe+14dca0) but the check string changes

below are the dumps created

Any help would be deeply appreciated. Thanks

==================================================

Dump File         : 013114-8046-01.dmp

Crash Time        : 31/01/2014 11:53:22 PM

Bug Check String  : ATTEMPTED_WRITE_TO_READONLY_MEMORY

Bug Check Code    : 0x000000be

Parameter 1       : fffff680`003fff00

Parameter 2       : 02300003`68b5f025

Parameter 3       : ffffd000`229ee0e0

Parameter 4       : 00000000`0000000b

Caused By Driver  : ntoskrnl.exe

Caused By Address : ntoskrnl.exe+14dca0

File Description  :

Product Name      :

Company           :

File Version      :

Processor         : x64

Crash Address     : ntoskrnl.exe+14dca0

Stack Address 1   :

Stack Address 2   :

Stack Address 3   :

Computer Name     :

Full Path         : C:\WINDOWS\Minidump\013114-8046-01.dmp

Processors Count  : 8

Major Version     : 15

Minor Version     : 9600

Dump File Size    : 302,312

Dump File Time    : 31/01/2014 11:54:17 PM

==================================================

==================================================

Dump File         : 012814-138437-01.dmp

Crash Time        : 28/01/2014 4:06:41 AM

Bug Check String  : MEMORY_MANAGEMENT

Bug Check Code    : 0x0000001a

Parameter 1       : 00000000`00041792

Parameter 2       : fffff680`1ea93080

Parameter 3       : 00000000`0d000000

Parameter 4       : 00000000`00000000

Caused By Driver  : ntoskrnl.exe

Caused By Address : ntoskrnl.exe+14dca0

File Description  :

Product Name      :

Company           :

File Version      :

Processor         : x64

Crash Address     : ntoskrnl.exe+14dca0

Stack Address 1   :

Stack Address 2   :

Stack Address 3   :

Computer Name     :

Full Path         : C:\WINDOWS\Minidump\012814-138437-01.dmp

Processors Count  : 8

Major Version     : 15

Minor Version     : 9600

Dump File Size    : 302,256

Dump File Time    : 28/01/2014 4:09:38 AM

==================================================

==================================================

Dump File         : 012514-7937-01.dmp

Crash Time        : 25/01/2014 6:12:05 PM

Bug Check String  : PAGE_FAULT_IN_NONPAGED_AREA

Bug Check Code    : 0x00000050

Parameter 1       : ffffc000`34503b40

Parameter 2       : 00000000`00000000

Parameter 3       : fffff800`00d69a16

Parameter 4       : 00000000`00000002

Caused By Driver  : ntoskrnl.exe

Caused By Address : ntoskrnl.exe+14dca0

File Description  :

Product Name      :

Company           :

File Version      :

Processor         : x64

Crash Address     : ntoskrnl.exe+14dca0

Stack Address 1   :

Stack Address 2   :

Stack Address 3   :

Computer Name     :

Full Path         : C:\WINDOWS\Minidump\012514-7937-01.dmp

Processors Count  : 8

Major Version     : 15

Minor Version     : 9600

Dump File Size    : 302,312

Dump File Time    : 25/01/2014 6:12:54 PM

==================================================

==================================================

Dump File         : 012514-6828-01.dmp

Crash Time        : 25/01/2014 11:58:59 AM

Bug Check String  : MEMORY_MANAGEMENT

Bug Check Code    : 0x0000001a

Parameter 1       : 00000000`00041793

Parameter 2       : fffff6bf`fd94f080

Parameter 3       : 00000000`00000002

Parameter 4       : 00000000`00000001

Caused By Driver  : ntoskrnl.exe

Caused By Address : ntoskrnl.exe+14dca0

File Description  :

Product Name      :

Company           :

File Version      :

Processor         : x64

Crash Address     : ntoskrnl.exe+14dca0

Stack Address 1   :

Stack Address 2   :

Stack Address 3   :

Computer Name     :

Full Path         : C:\WINDOWS\Minidump\012514-6828-01.dmp

Processors Count  : 8

Major Version     : 15

Minor Version     : 9600

Dump File Size    : 302,256

Dump File Time    : 25/01/2014 12:00:11 PM

==================================================

Answer 1

Thanks!

We have various different bug checks:

ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)

This is issued if a driver attempts to write to a read-only memory segment.

MEMORY_MANAGEMENT (1a)

*This indicates that a severe memory management error occurred.*BugCheck 1A, {41792, fffff6801ea93080, d000000, 0}

- The 1st parameter of the bug check is 41792 which indicates a corrupted PTE has been detected.

If we check the PFN database:

3: kd> dt nt!_MMPFN fffff6801ea93080   +0x000 u1               : <unnamed-tag>   +0x008 u2               : <unnamed-tag>   +0x010 PteAddress       : 0x000000007b000000 \_MMPTE   +0x010 VolatilePteAddress : 0x000000007b000000 Void   +0x010 Lock             : 0n2063597568   +0x010 PteLong          : 0x7b000000   +0x018 u3               : <unnamed-tag>   +0x01c NodeBlinkLow     : 0   +0x01e Unused           : 0y0000   +0x01e VaType           : 0y0000   +0x01f ViewCount        : 0 ''   +0x01f NodeFlinkLow     : 0 ''   +0x020 OriginalPte      : _MMPTE   +0x028 u4               : <unnamed-tag>

There doesn't appear to be any corruption, so this is likely caused by hardware as opposed to a driver causing memory corruption. However, it's still very possible!

We also have a different 1st parameter - BugCheck 1A, {41793, fffff6bffd94f080, 2, 1}

- The 1st parameter of the bug check is 41793 which indicates an unknown memory management error occurred.

PAGE_FAULT_IN_NONPAGED_AREA (50)

This indicates that invalid system memory has been referenced.

Bug check 0x50 usually occurs after the installation of faulty hardware or in the event of failure of installed hardware (usually related to defective RAM, be it main memory, L2 RAM cache, or video RAM).

Another common cause is the installation of a faulty system service.

Antivirus software can also trigger this error, as can a corrupted NTFS volume.

--------------

1. You have a lot of problematic Asus software installed, such as AiChargerPlus, Asus PC Probe, etc. All of Asus' utility software is unnecessary bloatware that is known to cause issues. Please remove any and all Asus software.
2. Enable Driver Verifier if you're still crashing:

Driver Verifier:

What is Driver Verifier?

Driver Verifier is included in Windows 8, 7, Windows Server 2008 R2, Windows Vista, Windows Server 2008, Windows 2000, Windows XP, and Windows Server 2003 to promote stability and reliability; you can use this tool to troubleshoot driver issues. Windows kernel-mode components can cause system corruption or system failures as a result of an improperly written driver, such as an earlier version of a Windows Driver Model (WDM) driver.

Essentially, if there's a 3rd party driver believed to be at issue, enabling Driver Verifier will help flush out the rogue driver if it detects a violation.

Before enabling Driver Verifier, it is recommended to create a System Restore Point:

Vista - START | type rstrui - create a restore point

Windows 7 - START | type create | select "Create a Restore Point"

Windows 8 - http://www.eightforums.com/tutorials/4690-restore-point-create-windows-8-a.html

How to enable Driver Verifier:

Start > type "verifier" without the quotes > Select the following options -

1. Select - "Create custom settings (for code developers)"
2. Select - "Select individual settings from a full list"
3. Check the following boxes -

• Special Pool
• Pool Tracking
• Force IRQL Checking
• Deadlock Detection
• Security Checks (Windows 7 & 8)
• DDI compliance checking (Windows 8)
• Miscellaneous Checks

4. Select  - "Select driver names from a list"
5. Click on the "Provider" tab. This will sort all of the drivers by the provider.
6. Check EVERY box that is [B]NOT[/B] provided by Microsoft / Microsoft Corporation.
7. Click on Finish.
8. Restart.

Important information regarding Driver Verifier:

• If Driver Verifier finds a violation, the system will BSOD.
• After enabling Driver Verifier and restarting the system, depending on the culprit, if for example the driver is on start-up, you may not be able to get back into normal Windows because Driver Verifier will flag it, and as stated above, that will cause / force a BSOD.

If this happens, do not panic, do the following:

• Boot into Safe Mode by repeatedly tapping the F8 key during boot-up.
• Once in Safe Mode - Start > Search > type "cmd" without the quotes.
• To turn off Driver Verifier, type in cmd "verifier /reset" without the quotes.

・    Restart and boot into normal Windows.

If your OS became corrupt or you cannot boot into Windows after disabling verifier via Safe Mode:

• Boot into Safe Mode by repeatedly tapping the F8 key during boot-up.
• Once in Safe Mode - Start > type "system restore" without the quotes.
• Choose the restore point you created earlier.

How long should I keep Driver Verifier enabled for?

It varies, many experts and analysts have different recommendations. Personally, I recommend keeping it enabled for at least 24 hours. If you don't BSOD by then, disable Driver Verifier.

My system BSOD'd, where can I find the crash dumps?

They will be located in %systemroot%\Minidump

Any other questions can most likely be answered by this article:

http://support.microsoft.com/kb/244617

Regards,

Patrick

Answer 2

Hi Patrick,

Thank you so much for your help. i have now removed all asus bloatware and have turned verifier on as per your instructions. i havnt had a bsod since the past 1 hour will keep the computer on for about 2 days to confirm.

Will keep you updated if anything out of the ordinary occurs

Again many thanks for your help really appreciate it !

Answer 3

thank you for your prompt reply.

I have uploaded dmp files in the following location

https://drive.google.com/file/d/0B9FrcoVV9SfBMEJHSU9WRHc3U1k/edit?usp=sharing

Answer 4

We do need the actual DMP file as it contains the only record of the sequence of events leading up to the crash, what drivers were loaded, and what was responsible.

We prefer at least 2 DMP files to spot trends and confirm the cause.

---

Please follow our instructions for finding and uploading the files we need to help you fix your computer. They can be found here

If you have any questions about the procedure please ask

Answer 5

Hi,

In order to assist you, we will need the DMP files to analyze what exactly occurred at the time of the crash, etc.

If you don't know where DMP files are located, here's how to get to them:

 1.    Navigate to the %systemroot%\Minidump folder.

 2.    Copy any and all DMP files in the Minidump folder to your Desktop and then zip up these files.

 3.    Upload the zip containing the DMP files to Skydrive or a hosting site of your choice and paste in your reply.

If you are going to use Skydrive but don't know how to upload to it, please visit the following:

http://www.wikihow.com/Use-SkyDrive

Please note that any "cleaner" programs such as TuneUp Utilities, CCleaner, etc, by default will delete DMP files upon use.

If your computer is not generating DMP files, please do the following:

1. Start > type %systemroot% which should show the Windows folder, click on it. Once inside that folder, ensure there is a Minidump folder created. If not, CTRL-SHIFT-N to make a New Folder and name it Minidump.
2. Windows key + Pause key. This should bring up System. Click Advanced System Settings on the left > Advanced > Performance > Settings > Advanced > Ensure there's a check-mark for 'Automatically manage paging file size for all drives'.
3. Windows key + Pause key. This should bring up System. Click Advanced System Settings on the left > Advanced > Startup and Recovery > Settings > System Failure > ensure there is a check mark next to 'Write an event to the system log'.

Ensure Small Memory Dump is selected and ensure the path is %systemroot%\Minidump.

4. Double check that the WERS is ENABLED:

Start > Search > type services.msc > Under the name tab, find Windows Error Reporting Service > If the status of the service is not Started then right click it and select Start. Also ensure that under Startup Type it is set to Automatic rather than Manual. You can do this by right clicking it, selecting properties, and under General selecting startup type to 'Automatic', and then click Apply.

If you cannot get into normal mode to do any of this, please do this via Safe Mode.

Regards,

Patrick