Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

My System Freezes, please help


  • Please log in to reply
10 replies to this topic

#1 Wh0

Wh0

  • Members
  • 59 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Naples, Florida
  • Local time:04:02 PM

Posted 21 May 2015 - 05:12 PM

Rarely do I get a BSOD just a system freeze that goes on for a few minutes, occasionally I need to do a restart

Attached Files



BC AdBot (Login to Remove)

 


m

#2 thisisu

thisisu

  • Malware Response Team
  • 2,525 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:03:02 PM

Posted 22 May 2015 - 02:58 AM

Hi,

 

I'm suspecting a RAM issue.

 

Run memtest for 8 passes:
 
Memtest86+:
 
Download Memtest86+ here:
 
 
Which should I download?
 
You can either download the pre-compiled .ISO that you would burn to a  CD and then boot from the CD, or you can download the auto-installer for  the USB key. What this will do is format your USB drive, make it a  bootable device, and then install the necessary files. Both do the same  job, it's just up to you which you choose, or which you have available  (whether it's CD or USB).
 
Do note that some older generation motherboards do not support USB-based  booting, therefore your only option is CD (or Floppy if you really  wanted to). 
 
How Memtest works (you don't need to read, it's only for those interested in the specifics):
 
Memtest uses algorithms (specifically two), namely moving inversion  & what is deemed Modulo-X. Essentially, the first algorithm fills  the memory with a pattern. Starting at the low address, it checks to see  if the pattern was changed (it should not have been), writes the  patterns complement, increments the address, and repeats. Starting at  the highest address (as opposed to the lowest), it follows the same  checklist.
 
The reason for the second algorithm is due to a few limitations, with  the first being that not all adjacent cells are being tested for  interaction due to modern chips being 4 to 16 bits wide regarding data  storage. With that said, patterns are used to go ahead and ensure that  all adjacent cells have at least been written with all possible one and  zero combinations.
 
The second is that caching, buffering and out of order execution will  interfere with the moving inversions algorithm. However, the second  algorithm used is not affected by this. For starting offsets of 0-20,  the algorithm will write every 20th location with a pattern, write all  other locations with the patterns complement, repeat the previous one  (or more) times, and then check every 20th location for the previously  mentioned pattern.
 
Now that you know how Memtest actually works, it's important to know  that the tests it goes through all mean something different. It goes  from Test 0 through Test 12, many of which use either one or the other  algorithm discussed above, among many other things.
 
Any other questions, they can most likely be answered by reading this great guide here: FAQ : please read before posting
 
 
 

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************


MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041287, An illegal page fault occurred while holding working set synchronization.
Parameter 2 contains the referenced virtual address.
Arg2: 0000000000000203
Arg3: 0000000000000000
Arg4: 0000000000000000


Debugging Details:
------------------




BUGCHECK_STR:  0x1a_41287


CUSTOMER_CRASH_COUNT:  1


DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT


PROCESS_NAME:  wermgr.exe


CURRENT_IRQL:  0


ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre


TRAP_FRAME:  fffff880074f4170 -- (.trap 0xfffff880074f4170)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000002
rdx=0000000000000203 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8000309c549 rsp=fffff880074f4300 rbp=0000000000000200
 r8=0000000000007a55  r9=0000000000000003 r10=0000000000007a58
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!MmMapLockedPagesSpecifyCache+0x9e9:
fffff800`0309c549 f00fb10a        lock cmpxchg dword ptr [rdx],ecx ds:00000000`00000203=????????
Resetting default scope


LAST_CONTROL_TRANSFER:  from fffff8000301b88a to fffff800030808c0


STACK_TEXT:  
fffff880`074f4008 fffff800`0301b88a : 00000000`0000001a 00000000`00041287 00000000`00000203 00000000`00000000 : nt!KeBugCheckEx
fffff880`074f4010 fffff800`0307e9ee : 00000000`00000001 00000000`00000203 00000000`00000000 fffffa80`0b4eb720 : nt! ?? ::FNODOBFM::`string'+0x41a95
fffff880`074f4170 fffff800`0309c549 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
fffff880`074f4300 fffffa80`00000008 : fffffa80`0b4eb720 fffff800`0360b552 00000000`00000000 fffff880`074f4480 : nt!MmMapLockedPagesSpecifyCache+0x9e9
fffff880`074f43d0 fffffa80`0b4eb720 : fffff800`0360b552 00000000`00000000 fffff880`074f4480 00000000`00000000 : 0xfffffa80`00000008
fffff880`074f43d8 fffff800`0360b552 : 00000000`00000000 fffff880`074f4480 00000000`00000000 fffff800`00000000 : 0xfffffa80`0b4eb720
fffff880`074f43e0 fffff800`030a01d3 : fffffa80`0b4eb720 00000000`00000000 00000000`00000001 00000000`00000001 : hal!HalpRequestIpiSpecifyVector+0x41
fffff880`074f4410 00000000`00000801 : 00000000`00000000 66496553`0333d5cc fffffa80`0a5e4b80 fffff800`031b731d : nt!KiIpiSendRequest+0x2d3
fffff880`074f44d0 00000000`00000000 : 66496553`0333d5cc fffffa80`0a5e4b80 fffff800`031b731d fffff880`074f4b60 : 0x801




STACK_COMMAND:  kb


FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+41a95
fffff800`0301b88a cc              int     3


SYMBOL_STACK_INDEX:  1


SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+41a95


FOLLOWUP_NAME:  MachineOwner


MODULE_NAME: nt


IMAGE_NAME:  ntkrnlmp.exe


DEBUG_FLR_IMAGE_TIMESTAMP:  553e7b7b


IMAGE_VERSION:  6.1.7601.18839


FAILURE_BUCKET_ID:  X64_0x1a_41287_nt!_??_::FNODOBFM::_string_+41a95


BUCKET_ID:  X64_0x1a_41287_nt!_??_::FNODOBFM::_string_+41a95


ANALYSIS_SOURCE:  KM


FAILURE_ID_HASH_STRING:  km:x64_0x1a_41287_nt!_??_::fnodobfm::_string_+41a95


FAILURE_ID_HASH:  {7c01da75-2c32-08e9-3200-5b61d23fbc97}


Followup: MachineOwner

 



#3 Wh0

Wh0
  • Topic Starter

  • Members
  • 59 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Naples, Florida
  • Local time:04:02 PM

Posted 22 May 2015 - 07:26 AM

I'll give that a whirl when I get home from school, thank you :thumbup2:



#4 Wh0

Wh0
  • Topic Starter

  • Members
  • 59 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Naples, Florida
  • Local time:04:02 PM

Posted 23 May 2015 - 12:49 AM

Windows memory tester ran for almost 11 hours and completed, it found no errors



#5 thisisu

thisisu

  • Malware Response Team
  • 2,525 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:03:02 PM

Posted 23 May 2015 - 01:52 AM

Windows Memory Tester? Test with Memtest86+.



#6 Wh0

Wh0
  • Topic Starter

  • Members
  • 59 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Naples, Florida
  • Local time:04:02 PM

Posted 23 May 2015 - 07:21 PM

I've had 0% success creating a bootible memory iso, is there something else I can try?  

 

If not I'll have zsomeone at school create one Tuesday.



#7 thisisu

thisisu

  • Malware Response Team
  • 2,525 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:03:02 PM

Posted 23 May 2015 - 11:08 PM

Try these instructions for creating the ISO. http://forum.imgburn.com/index.php?/topic/61-how-to-write-an-image-file-to-a-disc-using-imgburn/



#8 Wh0

Wh0
  • Topic Starter

  • Members
  • 59 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Naples, Florida
  • Local time:04:02 PM

Posted 24 May 2015 - 12:46 AM

oh



#9 Wh0

Wh0
  • Topic Starter

  • Members
  • 59 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Naples, Florida
  • Local time:04:02 PM

Posted 27 May 2015 - 07:26 AM

When I left my house this morning, memory test had finished 4 passes with no errors found.  I won't be home till about 10 tonight, should the memory test not turn up anything negative what would be my next step to evaluate the problem?



#10 thisisu

thisisu

  • Malware Response Team
  • 2,525 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:03:02 PM

Posted 27 May 2015 - 08:10 AM

When I left my house this morning, memory test had finished 4 passes with no errors found.  I won't be home till about 10 tonight, should the memory test not turn up anything negative what would be my next step to evaluate the problem?

 

We can test the hard drive. The thing is, your logs are very clean. There's only 1 BSOD dump log though, and that suggested a fault with memory/RAM.

 

Here's the guide on the hard drive test: http://www.techsupportforum.com/6510-how-to-perform-a-seagates-seatools-test/



#11 thisisu

thisisu

  • Malware Response Team
  • 2,525 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:03:02 PM

Posted 27 May 2015 - 08:13 AM

You can also complete step #3 of the BSOD posting instructions -> 

Blue Screen of Death (BSOD) Posting Instructions - Windows 10, 8.1, 8, 7 & Vista

 

 

3. Run PERFMON System Health Report - 
- Bring up an elevated admin CMD prompt -

  • Windows 10, 7 & Vista - START | type cmd.exe into the start search box | right-click on cmd.exe | select "Run as Administrator" 
  • Windows 8.1 & 8 - Press WIN +X keys | select "Command Prompt (Admin)"

Type or paste perfmon /report into the CMD screen | save as HTML file | Zip and attach this file.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users