Windows 8 BSOD - Tried Memtest86, and Intel Diagnostics software.

[weirdguy]

Hello,

I was never getting a BSOD, but on December 2016, I had to get a new 2TB HD where I install all my software. I also have a 128GB SSD where I install Windows 8.

Before my 2TB broke down, I had never seen a BSOD. Only starting this December I saw the BSOD for the first time. Then, it was gone, and all Installations seem good for a while until last week (first week of March 2017).

I have already checked my PC with Memtest86, Intel Diagnostics, and another inexpensive software someone recommended on another forum I read (but didn't subscribe) called Hot CPU Tester. Neither found any problems.

I started reading about BSOD, and every time it happens it is supposed to create some Windows dump files, and apparently some memory dump files are also created.

I use ccleaner (I know some don't like it) to clean my temp and registry files, and just now realized that the memory dump files sometimes are from 800MB to up 1.XGB. So, my question is if that size of memory dump files are normal, or are they too big and could indicate RAM issues?

I was using 2 RAM modules of 8GB each. Today I decided to remove one, and so far no BSOD, and no large memory dump files shown in ccleaner.

Could anyone recommend another way to test RAM memory? And what I should look for?

Thanks,

SJ

 

[nmsuk]

Follow how to ask for bsod help and we'll get to diagnosing your bsods for you.

 

[kemical]

I use ccleaner (I know some don't like it) to clean my temp and registry files, and just now realized that the memory dump files sometimes are from 800MB to up 1.XGB. So, my question is if that size of memory dump files are normal, or are they too big and could indicate RAM issues?

Hi,
the reason why the amount varies is because it's a memory dump and not a 'small memory dump (256k)'.

To change it, open the run application.
Type sysdm.cpl in the run box and click ok.
Look across the top of the system properties box for 'Advanced' and click that.
Look for 'Startup and Recovery' near the bottom and click 'settings'.
Near the bottom you'll see a drop down menu under the heading 'write debugging information'.
In the drop down menu choose ' small memory dump (256KB)'
Under 'small dump directory' make sure it says %SystemRoot%\Minidump.
Click ok and your good to go.

I was using 2 RAM modules of 8GB each. Today I decided to remove one, and so far no BSOD, and no large memory dump files shown in ccleaner.

This may mean that one of the memory sticks was/is faulty although seeing your dump files would help.

Could anyone recommend another way to test RAM memory? And what I should look for?

Windows does have a memory testing app but it can miss errors and the best app for the job is Memtest86.
I know you used it already but was that on singular sticks or both at the same time? Testing single sticks is the best way really.

If you open the link below you'll see you can run Memtest86 in two ways. You can either burn it to disk or install it onto a USB drive it's entirely up to you. You'll then need to enter the bios to change the boot order so you can boot from either the Disk or USB stick you have Memtest86 on.
Errors will appear on the screen and are hard to miss.
You must test for at least 12 hours unless it becomes obvious there is a problem straight away.
Memtest86+ - Advanced Memory Diagnostic Tool

Please post any dump files you may have although you might have to use a third party file share site if the dumps are pretty big..

Cleaning the registry just isn't needed and your better off leaving it well alone.

 

[weirdguy]

Hi,
the reason why the amount varies is because it's a memory dump and not a 'small memory dump (256k)'.

To change it, open the run application.
Type sysdm.cpl in the run box and click ok.
Look across the top of the system properties box for 'Advanced' and click that.
Look for 'Startup and Recovery' near the bottom and click 'settings'.
Near the bottom you'll see a drop down menu under the heading 'write debugging information'.
In the drop down menu choose ' small memory dump (256KB)'
Under 'small dump directory' make sure it says %SystemRoot%\Minidump.
Click ok and your good to go.


This may mean that one of the memory sticks was/is faulty although seeing your dump files would help.


Windows does have a memory testing app but it can miss errors and the best app for the job is Memtest86.
I know you used it already but was that on singular sticks or both at the same time? Testing single sticks is the best way really.

If you open the link below you'll see you can run Memtest86 in two ways. You can either burn it to disk or install it onto a USB drive it's entirely up to you. You'll then need to enter the bios to change the boot order so you can boot from either the Disk or USB stick you have Memtest86 on.
Errors will appear on the screen and are hard to miss.
You must test for at least 12 hours unless it becomes obvious there is a problem straight away.
Memtest86+ - Advanced Memory Diagnostic Tool

Please post any dump files you may have although you might have to use a third party file share site if the dumps are pretty big..

Cleaning the registry just isn't needed and your better off leaving it well alone.

Thanks for the clarification Kemical!

 

[weirdguy]

Please find attached the zip file created with W7F Diagnostic Tool after another BSOD.

Thanks for the help!

 

[kemical]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {20, ffffe0015163bbf0, ffffe0015163bc10, 4020004}

*** WARNING: Unable to verify timestamp for mwac.sys
*** ERROR: Module load completed but symbols could not be loaded for mwac.sys
Probably caused by : fwpkclnt.sys ( fwpkclnt!FwpsConstructIpHeaderForTransportPacket0+1be )

Followup:     MachineOwner

Hi,
this bugcheck means something is causing issues with memory allocation and is usually down to a driver.

I can see in the dump files stack that Malwarebytes ( mwac.sys ) is having issues with what looks like the firewall ( fwpkclnt.sys ).

Try removing Malwarebytes and Avast AV suite. Just use the onboard Defender for now and see if the bsod stops.

It wouldn't hurt to run an sfc scan so open an admin command prompt and type:
sfc /scannow
Press enter and await results.
Please make sure you run this after removing the above. This will hopefully repair any corruption within the os.

If the bsod should continue then you'll need to run the driver verifier to try and determine the cause. This guide will help in setting things up:
Driver Verifier - Windows 10, 8.1, 8, 7 & Vista (BSOD-related) - Tech Support Forum

Post any new dump files.

 

[weirdguy]

Thanks chemical!

Removing Malwarebytes solved the problem. More than 5 days with PC on 24/7, and no BSOD.

The weird thing is that I have been using Malwarebytes and Avast paid licenses for more than 5 years now, and never before got a BSOD.

Since I have a Malwarebytes paid license, I guess I will have to talk to support of those guys. Or, do you guys recommend any other software to protect PC?

 

[nmsuk]

I'd say this is more down to Microsoft than Mbam. Only time I've had issues is with some of the beta versions of windows. Normally happens when they change something kernel related. May I suggest you run the mbam uninstaller and try a reinstall of it as I'm guessing it had somehow become corrupted during updates and the such.

 

[kemical]

Hi weirdguy,

much thanks for the update.

The weird thing is that I have been using Malwarebytes and Avast paid licenses for more than 5 years now, and never before got a BSOD.

You could try re-installing Malwarebytes from a fresh download?

Your original install of Malwebytes might simply have become corrupted ?

 

[kemical]

Oops.. didn't see the post from Rich but his suggestion is sound and i would definitely give it a try.