Solved BSOD Error code 139

kingsomeguy · Dec 15, 2014

Another BSOD at startup, but different error code (progress?), I think IRQL_NOT_LESS_OR_EQUAL. I already removed Virtualbox and I think I updated NvStreamKms.sys, and then disabled it to be on the safe side. I did not get to removing Avast yet.

Here's the dump (I forgot to remove the last minidump from it, sorry): View attachment 55322

Edit: I just looked at the minidump and found this:

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffffd7fffffe7e0, 2, 1, fffff80048304ba2}

Probably caused by : memory_corruption ( nt!MiRemoveAnyPage+122 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffffd7fffffe7e0, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80048304ba2, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80048572168
GetUlongFromAddress: unable to read from fffff800485721f8
 fffffd7fffffe7e0 Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
nt!MiRemoveAnyPage+122
fffff800`48304ba2 f0410fba6e1000  lock bts dword ptr [r14+10h],0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

BUGCHECK_STR:  AV

PROCESS_NAME:  dasHost.exe

ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre

DEVICE_OBJECT: fffffa80141b39d0

TRAP_FRAME:  fffff8801c10be20 -- (.trap 0xfffff8801c10be20)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000002 rbx=0000000000000000 rcx=0000000000000014
rdx=fffff8004856b1c0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80048304ba2 rsp=fffff8801c10bfb0 rbp=fffff8801c10c000
 r8=000000000000007f  r9=0000000000000000 r10=0000000000000000
r11=0000000fffffffff r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!MiRemoveAnyPage+0x122:
fffff800`48304ba2 f0410fba6e1000  lock bts dword ptr [r14+10h],0 ds:00000000`00000010=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80048274769 to fffff80048275440

STACK_TEXT:  
fffff880`1c10bcd8 fffff800`48274769 : 00000000`0000000a fffffd7f`ffffe7e0 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`1c10bce0 fffff800`48272fe0 : 00000000`00000001 00000000`00000004 00000000`00000000 fffff880`1c10be20 : nt!KiBugCheckDispatch+0x69
fffff880`1c10be20 fffff800`48304ba2 : fffffa80`141d0de0 fffffa80`141d0d70 fffff880`1c10c0a8 00000000`00000800 : nt!KiPageFault+0x260
fffff880`1c10bfb0 fffff800`482bdb44 : 00000000`00000010 fffffa80`00000000 00000000`00000000 ffffffff`ffffffff : nt!MiRemoveAnyPage+0x122
fffff880`1c10c070 fffff800`482fa32e : fffff980`00000001 00000000`00000000 fffff6fc`c00d1008 00000064`09b57930 : nt!MiGetPage+0x359
fffff880`1c10c150 fffff800`482e0926 : 00000000`00000000 00000000`00000000 fffff880`1c10c340 fffff880`1c10c328 : nt!MmCopyToCachedPage+0x25e
fffff880`1c10c2f0 fffff800`482dfeb2 : fffffa80`13f55010 00000064`09b57930 fffff880`1c10c440 fffff880`00000000 : nt!CcMapAndCopyInToCache+0x236
fffff880`1c10c3e0 fffff880`018f74e2 : fffffa80`141b39d0 fffff880`1c10c700 00000000`000000cc 00000000`00000000 : nt!CcCopyWriteEx+0x1b2
fffff880`1c10c480 fffff880`018fc66a : fffffa80`13223e10 fffff880`1c10c700 fffff880`1c10c718 00000000`00000000 : Ntfs!NtfsCommonWrite+0xd42
fffff880`1c10c6d0 fffff880`015414ee : fffffa80`14166b80 fffffa80`141cc790 fffffa80`141cc790 fffffa80`141ccb78 : Ntfs!NtfsFsdWrite+0x22a
fffff880`1c10c790 fffff880`0153f0b6 : fffffa80`0dffa8d0 fffffa80`141b39d0 fffffa80`141cc790 00000000`00000000 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x25e
fffff880`1c10c830 fffff800`4868af88 : 00000000`00000001 fffff880`1c10c911 fffffa80`141b39d0 00000000`00000000 : fltmgr!FltpDispatch+0xb6
fffff880`1c10c890 fffff800`48655bda : fffffa80`141b39d0 00000000`00000000 00000000`00000000 fffffa80`141b39d0 : nt!IopSynchronousServiceTail+0x158
fffff880`1c10c960 fffff800`48274453 : 00000000`00000501 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtWriteFile+0x809
fffff880`1c10ca90 000007fc`9b2d2c2a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000064`0927eb38 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x000007fc`9b2d2c2a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiRemoveAnyPage+122
fffff800`48304ba2 f0410fba6e1000  lock bts dword ptr [r14+10h],0

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!MiRemoveAnyPage+122

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  54546002

IMAGE_VERSION:  6.2.9200.17166

IMAGE_NAME:  memory_corruption

BUCKET_ID_FUNC_OFFSET:  122

FAILURE_BUCKET_ID:  AV_nt!MiRemoveAnyPage

BUCKET_ID:  AV_nt!MiRemoveAnyPage

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:av_nt!miremoveanypage

FAILURE_ID_HASH:  {de099fa2-7835-1495-f447-6ce78ff90329}

Followup: MachineOwner
---------

Would I be safe to assume my RAM is bad?

Edit #2: Also, any suggestions on what I should replace avast with in the meantime?

usasma · Dec 16, 2014

I asked the 8.1 question to get a general idea of the state of the system over time.
If you'll note, my profile info states "Win8.1Pro - Finally!!!" I couldn't install it for months - and I presume that a series of updates from Samsung (my laptop manufacturer) and Microsoft finally let it install!

What caused you to think that the RAM was bad?
In most cases I first assume that a STOP 0xA error is due to a misbehaving driver (although it can be caused by bad hardware also).
In this case the output states "This is usually caused by drivers using improper addresses."
I'd suggest that you run Driver Verifier according to these instructions: Driver Verifier Settings
I can't recall if you've run it before, but the sudden change in the memory dumps might warrant running it again anyways.

Also, memory corruption is a generic term. Most often it refers to corruption in the information stored at addresses in virtual memory (so the RAM isn't directly involved). But it's possible for it to be hardware.
If you're concerned, try the memory test here: Hardware Diagnostics
Also try running Prime95 - as the Blend test is a good RAM test that stresses different areas of the RAM than MemTest does.

When removing Avast, use the in-built Windows Defender and the Windows firewall. It's already there, it's free, and in most cases it'll start itself up when you remove the Avast.

Our biggest problem here is determining why the BSOD's changed:
- did we fix the original, and this is an entirely new problem?
- did we partly fix the original, and this is a result of the partial fix
- did we not fix the original, and this is an entirely new problem?
- is this just a continuation of a complicated BSOD sequence?

I'd suggest that we continue along as we have been and see if anything changes.
Driver Verifier won't change anything (once you turn it back off), so it may help us see what else is going on without disrupting what we're currently doing.

Keep an eye on the 3rd party driver lists. Drivers duplicated in each of the memory dumps are the most likely to be a cause.

Don't worry about removing the memory dumps. A part of my "process" is to see which dumps haven't been run - and then run only those.

Analysis:
The following is for informational purposes only.

Code:

[font=lucida console]**************************Mon Dec 15 20:25:59.319 2014 (UTC - 5:00)**************************
Loading Dump File [C:\Users\John\SysnativeBSODApps\121514-40828-01.dmp]
Windows 8 Kernel Version 9200 MP (8 procs) Free x64
Built by: [B]9200[/B].17166.amd64fre.win8_gdr.141031-1551
System Uptime:[B]0 days 0:01:33.938[/B]
*** ERROR: Module load completed but symbols could not be loaded for Ntfs.sys
Probably caused by :[B]memory_corruption ( nt!MiRemoveAnyPage+122 )[/B]
BugCheck [B]A, {fffffd7fffffe7e0, 2, 1, fffff80048304ba2}[/B]
BugCheck Info: [url=http://www.carrona.org/bsodindx.html#0x0000000A]IRQL_NOT_LESS_OR_EQUAL (a)[/url]
Arguments: 
Arg1: fffffd7fffffe7e0, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80048304ba2, address which referenced memory
BUGCHECK_STR:  AV
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
PROCESS_NAME:  dasHost.exe
FAILURE_BUCKET_ID: [B]AV_nt!MiRemoveAnyPage[/B]
CPUID:        "Intel(R) Core(TM) i7-4770 CPU @ 3.40GHz"
MaxSpeed:     3400
CurrentSpeed: [B]3400[/B]
  BIOS Version                  F3
  BIOS Release Date             06/03/2014
  Manufacturer                  Gigabyte Technology Co., Ltd.
  Product Name                  H97M-D3H
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
[/font]

3rd Party Drivers:
The following is for information purposes only.
Any drivers in red should be updated or removed from your system. And should have been discussed in the body of my post.

Code:

[font=lucida console]**************************Mon Dec 15 20:25:59.319 2014 (UTC - 5:00)**************************
intelppm.sys                Mon Nov  5 22:55:02 2012 (50988A16)
BthHfAud.sys                Sat Feb  2 02:24:42 2013 (510CBF3A)
BthA2DP.sys                 Fri May 31 23:08:25 2013 (51A965A9)
bcbtums.sys                 Thu Oct 17 16:45:30 2013 (52604C6A)
TeeDriverx64.sys            Thu Mar 13 14:21:52 2014 (5321F740)
dump_iaStorA.sys            Thu Apr  3 19:00:05 2014 (533DE7F5)
iaStorA.sys                 Thu Apr  3 19:00:05 2014 (533DE7F5)
RTKVHD64.sys                Wed May 28 08:17:12 2014 (5385D3C8)
Rt630x64.sys                Tue Jun 17 07:56:46 2014 (53A02CFE)
nvhda64v.sys                Mon Jul 21 10:17:53 2014 (53CD2111)
IntcDAud.sys                Tue Sep  9 08:36:30 2014 (540EF44E)
nvvad64v.sys                Thu Sep 25 11:39:23 2014 (5424372B)
igdkmd64.sys                Mon Sep 29 13:51:21 2014 (54299C19)
VBoxAswDrv.sys              Wed Nov  5 06:58:43 2014 (545A10F3)
aswMonFlt.sys               Thu Nov  6 07:53:07 2014 (545B6F33)
aswKbd.sys                  Thu Nov  6 07:53:07 2014 (545B6F33)
aswRvrt.sys                 Thu Nov  6 07:53:22 2014 (545B6F42)
aswVmm.sys                  Thu Nov  6 07:53:31 2014 (545B6F4B)
aswRdr2.sys                 Thu Nov  6 07:54:02 2014 (545B6F6A)
aswHwid.sys                 Thu Nov  6 07:55:01 2014 (545B6FA5)
aswNdisFlt.sys              Thu Nov  6 07:55:50 2014 (545B6FD6)
aswSP.sys                   Thu Nov  6 08:09:55 2014 (545B7323)
aswStm.sys                  Thu Nov  6 08:11:00 2014 (545B7364)
nvlddmkm.sys                Wed Nov 12 15:51:31 2014 (5463C853)
aswSnx.sys                  Fri Nov 21 06:17:12 2014 (546F1F38)
[/font]

usasma · Dec 16, 2014

I don't know how this'll show up, but it's a table showing the 3rd party drivers from the last 4 memory dumps:
If you scroll to the bottom, there's a bar to scroll horizontally

Code:

[TABLE="width: 256"]
[TR]
[TD]**************************Mon Dec 15 20:25:59.319 2014 (UTC - 5:00)**************************[/TD]
[TD]**************************Sun Dec 14 06:26:37.745 2014 (UTC - 5:00)**************************[/TD]
[TD]**************************Mon Dec  1 16:25:22.203 2014 (UTC - 5:00)**************************[/TD]
[TD]**************************Thu Nov 20 17:49:16.741 2014 (UTC - 5:00)**************************[/TD]
[/TR]
[TR]
[TD]intelppm.sys                Mon Nov  5 22:55:02 2012 (50988A16)[/TD]
[TD]intelppm.sys                Mon Nov  5 22:55:02 2012 (50988A16)[/TD]
[TD]intelppm.sys                Mon Nov  5 22:55:02 2012 (50988A16)[/TD]
[TD]intelppm.sys                Mon Nov  5 22:55:02 2012 (50988A16)[/TD]
[/TR]
[TR]
[TD]BthHfAud.sys                Sat Feb  2 02:24:42 2013 (510CBF3A)[/TD]
[TD]BthHfAud.sys                Sat Feb  2 02:24:42 2013 (510CBF3A)[/TD]
[TD]BthHfAud.sys                Sat Feb  2 02:24:42 2013 (510CBF3A)[/TD]
[TD]BthHfAud.sys                Sat Feb  2 02:24:42 2013 (510CBF3A)[/TD]
[/TR]
[TR]
[TD]BthA2DP.sys                 Fri May 31 23:08:25 2013 (51A965A9)[/TD]
[TD]BthA2DP.sys                 Fri May 31 23:08:25 2013 (51A965A9)[/TD]
[TD]BthA2DP.sys                 Fri May 31 23:08:25 2013 (51A965A9)[/TD]
[TD]BthA2DP.sys                 Fri May 31 23:08:25 2013 (51A965A9)[/TD]
[/TR]
[TR]
[TD]bcbtums.sys                 Thu Oct 17 16:45:30 2013 (52604C6A)[/TD]
[TD]bcbtums.sys                 Thu Oct 17 16:45:30 2013 (52604C6A)[/TD]
[TD]bcbtums.sys                 Thu Oct 17 16:45:30 2013 (52604C6A)[/TD]
[TD]bcbtums.sys                 Thu Oct 17 16:45:30 2013 (52604C6A)[/TD]
[/TR]
[TR]
[TD]TeeDriverx64.sys            Thu Mar 13 14:21:52 2014 (5321F740)[/TD]
[TD]TeeDriverx64.sys            Thu Mar 13 14:21:52 2014 (5321F740)[/TD]
[TD]TeeDriverx64.sys            Thu Mar 13 14:21:52 2014 (5321F740)[/TD]
[TD]TeeDriverx64.sys            Thu Mar 13 14:21:52 2014 (5321F740)[/TD]
[/TR]
[TR]
[TD]dump_iaStorA.sys            Thu Apr  3 19:00:05 2014 (533DE7F5)[/TD]
[TD]nvvad64v.sys                Fri Mar 28 09:32:06 2014 (533579D6)[/TD]
[TD]nvvad64v.sys                Fri Mar 28 09:32:06 2014 (533579D6)[/TD]
[TD]nvvad64v.sys                Fri Mar 28 09:32:06 2014 (533579D6)[/TD]
[/TR]
[TR]
[TD]iaStorA.sys                 Thu Apr  3 19:00:05 2014 (533DE7F5)[/TD]
[TD]dump_iaStorA.sys            Thu Apr  3 19:00:05 2014 (533DE7F5)[/TD]
[TD]iaStorA.sys                 Thu Apr  3 19:00:05 2014 (533DE7F5)[/TD]
[TD]iaStorA.sys                 Thu Apr  3 19:00:05 2014 (533DE7F5)[/TD]
[/TR]
[TR]
[TD]RTKVHD64.sys                Wed May 28 08:17:12 2014 (5385D3C8)[/TD]
[TD]iaStorA.sys                 Thu Apr  3 19:00:05 2014 (533DE7F5)[/TD]
[TD]dump_iaStorA.sys            Thu Apr  3 19:00:05 2014 (533DE7F5)[/TD]
[TD]dump_iaStorA.sys            Thu Apr  3 19:00:05 2014 (533DE7F5)[/TD]
[/TR]
[TR]
[TD]Rt630x64.sys                Tue Jun 17 07:56:46 2014 (53A02CFE)[/TD]
[TD]VBoxUSBMon.sys              Fri May 16 08:01:15 2014 (5375FE0B)[/TD]
[TD]VBoxUSBMon.sys              Fri May 16 08:01:15 2014 (5375FE0B)[/TD]
[TD]VBoxNetFlt.sys              Fri May 16 08:01:15 2014 (5375FE0B)[/TD]
[/TR]
[TR]
[TD]nvhda64v.sys                Mon Jul 21 10:17:53 2014 (53CD2111)[/TD]
[TD]VBoxNetFlt.sys              Fri May 16 08:01:15 2014 (5375FE0B)[/TD]
[TD]VBoxNetFlt.sys              Fri May 16 08:01:15 2014 (5375FE0B)[/TD]
[TD]VBoxUSBMon.sys              Fri May 16 08:01:15 2014 (5375FE0B)[/TD]
[/TR]
[TR]
[TD]IntcDAud.sys                Tue Sep  9 08:36:30 2014 (540EF44E)[/TD]
[TD]VBoxNetAdp.sys              Fri May 16 08:01:16 2014 (5375FE0C)[/TD]
[TD]VBoxNetAdp.sys              Fri May 16 08:01:16 2014 (5375FE0C)[/TD]
[TD]VBoxNetAdp.sys              Fri May 16 08:01:16 2014 (5375FE0C)[/TD]
[/TR]
[TR]
[TD]nvvad64v.sys                Thu Sep 25 11:39:23 2014 (5424372B)[/TD]
[TD]VBoxDrv.sys                 Fri May 16 08:04:43 2014 (5375FEDB)[/TD]
[TD]VBoxDrv.sys                 Fri May 16 08:04:43 2014 (5375FEDB)[/TD]
[TD]VBoxDrv.sys                 Fri May 16 08:04:43 2014 (5375FEDB)[/TD]
[/TR]
[TR]
[TD]igdkmd64.sys                Mon Sep 29 13:51:21 2014 (54299C19)[/TD]
[TD]RTKVHD64.sys                Wed May 28 08:17:12 2014 (5385D3C8)[/TD]
[TD]RTKVHD64.sys                Wed May 28 08:17:12 2014 (5385D3C8)[/TD]
[TD]RTKVHD64.sys                Wed May 28 08:17:12 2014 (5385D3C8)[/TD]
[/TR]
[TR]
[TD]VBoxAswDrv.sys              Wed Nov  5 06:58:43 2014 (545A10F3)[/TD]
[TD]Rt630x64.sys                Tue Jun 17 07:56:46 2014 (53A02CFE)[/TD]
[TD]Rt630x64.sys                Tue Jun 17 07:56:46 2014 (53A02CFE)[/TD]
[TD]Rt630x64.sys                Tue Jun 17 07:56:46 2014 (53A02CFE)[/TD]
[/TR]
[TR]
[TD]aswMonFlt.sys               Thu Nov  6 07:53:07 2014 (545B6F33)[/TD]
[TD]nvhda64v.sys                Mon Jul 21 10:17:53 2014 (53CD2111)[/TD]
[TD]nvhda64v.sys                Mon Jul 21 10:17:53 2014 (53CD2111)[/TD]
[TD]aswHwid.sys                 Thu Jun 26 07:31:26 2014 (53AC048E)[/TD]
[/TR]
[TR]
[TD]aswKbd.sys                  Thu Nov  6 07:53:07 2014 (545B6F33)[/TD]
[TD]NvStreamKms.sys             Fri Jul 25 07:35:56 2014 (53D2411C)[/TD]
[TD]NvStreamKms.sys             Fri Jul 25 07:35:56 2014 (53D2411C)[/TD]
[TD]aswMonFlt.sys               Thu Jun 26 07:32:51 2014 (53AC04E3)[/TD]
[/TR]
[TR]
[TD]aswRvrt.sys                 Thu Nov  6 07:53:22 2014 (545B6F42)[/TD]
[TD]IntcDAud.sys                Tue Sep  9 08:36:30 2014 (540EF44E)[/TD]
[TD]IntcDAud.sys                Tue Sep  9 08:36:30 2014 (540EF44E)[/TD]
[TD]aswRdr2.sys                 Thu Jun 26 07:33:28 2014 (53AC0508)[/TD]
[/TR]
[TR]
[TD]aswVmm.sys                  Thu Nov  6 07:53:31 2014 (545B6F4B)[/TD]
[TD]igdkmd64.sys                Mon Sep 29 13:51:21 2014 (54299C19)[/TD]
[TD]igdkmd64.sys                Mon Sep 29 13:51:21 2014 (54299C19)[/TD]
[TD]aswKbd.sys                  Thu Jun 26 07:34:01 2014 (53AC0529)[/TD]
[/TR]
[TR]
[TD]aswRdr2.sys                 Thu Nov  6 07:54:02 2014 (545B6F6A)[/TD]
[TD]VBoxAswDrv.sys              Wed Nov  5 06:58:43 2014 (545A10F3)[/TD]
[TD]VBoxAswDrv.sys              Wed Nov  5 06:58:43 2014 (545A10F3)[/TD]
[TD]aswSnx.sys                  Thu Jun 26 07:34:44 2014 (53AC0554)[/TD]
[/TR]
[TR]
[TD]aswHwid.sys                 Thu Nov  6 07:55:01 2014 (545B6FA5)[/TD]
[TD]aswKbd.sys                  Thu Nov  6 07:53:07 2014 (545B6F33)[/TD]
[TD]aswKbd.sys                  Thu Nov  6 07:53:07 2014 (545B6F33)[/TD]
[TD]aswRvrt.sys                 Thu Jun 26 07:35:39 2014 (53AC058B)[/TD]
[/TR]
[TR]
[TD]aswNdisFlt.sys              Thu Nov  6 07:55:50 2014 (545B6FD6)[/TD]
[TD]aswMonFlt.sys               Thu Nov  6 07:53:07 2014 (545B6F33)[/TD]
[TD]aswMonFlt.sys               Thu Nov  6 07:53:07 2014 (545B6F33)[/TD]
[TD]aswVmm.sys                  Thu Jun 26 07:35:49 2014 (53AC0595)[/TD]
[/TR]
[TR]
[TD]aswSP.sys                   Thu Nov  6 08:09:55 2014 (545B7323)[/TD]
[TD]aswRvrt.sys                 Thu Nov  6 07:53:22 2014 (545B6F42)[/TD]
[TD]aswRvrt.sys                 Thu Nov  6 07:53:22 2014 (545B6F42)[/TD]
[TD]aswNdisFlt.sys              Thu Jun 26 07:36:26 2014 (53AC05BA)[/TD]
[/TR]
[TR]
[TD]aswStm.sys                  Thu Nov  6 08:11:00 2014 (545B7364)[/TD]
[TD]aswVmm.sys                  Thu Nov  6 07:53:31 2014 (545B6F4B)[/TD]
[TD]aswVmm.sys                  Thu Nov  6 07:53:31 2014 (545B6F4B)[/TD]
[TD]aswStm.sys                  Thu Jun 26 07:47:09 2014 (53AC083D)[/TD]
[/TR]
[TR]
[TD]nvlddmkm.sys                Wed Nov 12 15:51:31 2014 (5463C853)[/TD]
[TD]aswRdr2.sys                 Thu Nov  6 07:54:02 2014 (545B6F6A)[/TD]
[TD]aswRdr2.sys                 Thu Nov  6 07:54:02 2014 (545B6F6A)[/TD]
[TD]aswSP.sys                   Wed Jul  2 13:38:12 2014 (53B44384)[/TD]
[/TR]
[TR]
[TD]aswSnx.sys                  Fri Nov 21 06:17:12 2014 (546F1F38)[/TD]
[TD]aswHwid.sys                 Thu Nov  6 07:55:01 2014 (545B6FA5)[/TD]
[TD]aswHwid.sys                 Thu Nov  6 07:55:01 2014 (545B6FA5)[/TD]
[TD]nvhda64v.sys                Mon Jul 21 10:17:53 2014 (53CD2111)[/TD]
[/TR]
[TR]
[TD][/TD]
[TD]aswNdisFlt.sys              Thu Nov  6 07:55:50 2014 (545B6FD6)[/TD]
[TD]aswNdisFlt.sys              Thu Nov  6 07:55:50 2014 (545B6FD6)[/TD]
[TD]NvStreamKms.sys             Fri Jul 25 07:35:56 2014 (53D2411C)[/TD]
[/TR]
[TR]
[TD][/TD]
[TD]aswSP.sys                   Thu Nov  6 08:09:55 2014 (545B7323)[/TD]
[TD]aswSP.sys                   Thu Nov  6 08:09:55 2014 (545B7323)[/TD]
[TD]IntcDAud.sys                Tue Sep  9 08:36:30 2014 (540EF44E)[/TD]
[/TR]
[TR]
[TD][/TD]
[TD]aswStm.sys                  Thu Nov  6 08:11:00 2014 (545B7364)[/TD]
[TD]aswStm.sys                  Thu Nov  6 08:11:00 2014 (545B7364)[/TD]
[TD]igdkmd64.sys                Mon Sep 29 13:51:21 2014 (54299C19)[/TD]
[/TR]
[TR]
[TD][/TD]
[TD]nvlddmkm.sys                Wed Nov 12 15:51:31 2014 (5463C853)[/TD]
[TD]nvlddmkm.sys                Wed Nov 12 15:51:31 2014 (5463C853)[/TD]
[TD]nvlddmkm.sys                Mon Nov  3 15:40:19 2014 (5457E833)[/TD]
[/TR]
[TR]
[TD][/TD]
[TD]aswSnx.sys                  Fri Nov 21 06:17:12 2014 (546F1F38)[/TD]
[TD="colspan: 2"]aswSnx.sys                  Fri Nov 21 06:17:12 2014 (546F1F38)[/TD]
[/TR]
[/TABLE]

kingsomeguy · Dec 16, 2014

I assumed RAM due to previous experiences with memory_corruption ending up being caused by bad RAM.
I'm running Driver Verifier and awaiting for any BSODs.
When I went to add all third party drivers, intelppm.sys came up as a driver from Microsoft. Should it be from Microsoft?

Edit: I attempted to run Prime95; first attempt the CPU temperature got to 100°C within 5 sec, so I went to make sure the fan was seated properly and applied some Artic Silver 5. Second attempt hit 90°C after a minute or two. I'm probably going to go buy a water cooler before I attempt using Prime95 again.

usasma · Dec 17, 2014

intelppm.sys is one of those drivers that just doesn't fit the usual models. It's a Microsoft driver that's used for the Intel processors.
In short, the only way to update it is through Windows Update.

It sounds like something isn't cooling your CPU properly. Most stock coolers (with adequate contact between the CPU and cooler) will be able to keep the temps down to reasonable levels (less than 80ºC).

If the system overheats that fast on Prime95 - I have to wonder about how it's doing when the BSOD's occur?
Please monitor your system's temperatures with this free tool: HWMonitor CPUID - System & hardware benchmark, monitoring, reporting
It records the max system temps, so you should be able to see what it was after you reboot the system (after a BSOD).

kingsomeguy · Dec 17, 2014

Normally, temperatures are around 30-40º idle or when browsing on Firefox (when most BSODs happened to me), and at most normally when i'm playing games or something along those lines the max I usually see is 80ºC. I do agree something is wrong with the cooling otherwise.
HWMonitor Min/Max values keep resetting after a restart for me, is there something i'm not doing right?

Edit: I'm almost certain its how my case/PSU fans are somewhat near the CPU fan, however, is an improvement from my last case I had about a month ago. Would a water cooler for the CPU help with that situation?

usasma · Dec 17, 2014

I'm uncertain, as I've only used the max values on rare occasions.
But you mention that they get up to 80ºC during gaming - I'd suspect that they get higher at times, and that is what's causing the BSOD's.

Here's a nice discussion on temp monitors: Best app to monitor CPU/GPU temps? - Steam Users' Forums
Be aware that some of them are also known to cause BSOD's - but that's not a real big issue right now as you already have BSOD's

It does complicate things a bit - so we may have to try several of them until we find one that doesn't have a BSOD problem, yet it provides the info that we need.

kingsomeguy · Dec 19, 2014

So far, no BSODs with Driver Verifier on. Should I wait a little longer or should I do something else?

cluberti · Dec 19, 2014

It actually does look like kernel pool is corrupt, the reference address is corrupt, and the memory to reference is corrupt - they're all potentially valid memory addresses (nothing odd here), but none of the addresses point to valid memory:

Code:

3: kd> !pool fffff80048304ba2Pool page fffff80048304ba2 region is Nonpaged pool
GetUlongFromAddress: unable to read from fffff800484ad470
Unable to get pool big page table. Check for valid symbols.
fffff80048304000 is not valid pool. Checking for freed (or corrupt) pool
Bad previous allocation size @fffff80048304000, last size was 0
***
*** An error (or corruption) in the pool was detected;
*** Attempting to diagnose the problem.
***
*** Use !poolval fffff80048304000 for more details.
Pool page [ fffff80048304000 ] is __inVALID.

Analyzing linked list...
[ fffff80048304000 ]: invalid previous size [ 0x3c ] should be [ 0x0 ]
[ fffff80048304000 --> fffff80048304380 (size = 0x380 bytes)]: Corrupt region


Scanning for single bit errors...
None found

The fact that driver verifier made the problem disappear means it's very likely actually a driver issue, and not bad hardware. Driver verifier, by default, uses special hooks to monitor driver function calls and catch offending bad code doing specific IRQL behaviors and memory allocations/de-allocations. However, if kernel pool corruption is happening due to a buffer overrun or underrun, then having driver verifier on can simply cause the problem to no longer happen due to the overhead imposed by the driver verifier engine (for example, the driver could have a race condition that causes bad behavior, but adding the overhead causes the problem to no longer occur because the race condition is slowed to the point it never happens).

Since these dumps have pool corruption, and driver verifier "fixes" things, I'd say we probably want to use special pool rather than driver verifier at this point to catch the offender. It seems we have a driver causing pool over or underruns, not necessarily doing other bad things in the driver itself.

kingsomeguy · Dec 19, 2014

So I would want to keep special pool on for third party drivers then in Driver Verifier settings?

usasma · Dec 21, 2014

Yes, only check the Special Pool option when starting Driver Verifier:

- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select only "Special Pool" and click "Next"

- Select "Automatically select all drivers installed on this computer" and click "Finish"
- Reboot for the settings to take effect.

More info on Special Pool here:
Special Pool (Windows Drivers)

You can also enable Special Pool using gflags - but I don't know anything about that.
Here's a link about it: Example 14: Configuring Special Pool (Windows Debuggers)

usasma · Dec 21, 2014

If the Special Pool doesn't make Verifier point out anything, I'd suggest also enabling "Pool Tracking" (from this post:

Information

Troubleshooting Pool Corruption - Debugging In Progress... - Site Home - TechNet Blogs

Information

)

FWIW - I'm not real knowledgeable about the intricacies of verifier, so I'm just guessing on this one.

kingsomeguy · Dec 21, 2014

Ok, i've enabled special pool and pool tracking in Driver Verifier, and will let you guys know if anything BSODs occur while I wait.

Edit: Is it possible Avast NG was messing around with the pool, thus causing problems every once in a while?

Mysers Briggs · Dec 24, 2014

Yes, Avast could be causing pool corruption, you can try removing it to see if the problems persist.

Without going into detail, as Driver Verifier is a lengthy, yet interesting, topic; Special Pool and Pool Tracking are quite different. They share the common goal of monitoring pool corruption, although it depends on the actual corruption which determines how they should be used. At the moment, we aren't 100% sure on what the misbehaving driver is actually doing, therefore we cannot say which option is required. However, as Cluberti mentions, it's most likely a driver overrun/underrun error, meaning Special Pool is required to find the culprit.
Special Pool monitors driver allocations and ensures they are accessing the correct addresses without writing to a different page that is already allocated. There's much more to this subject, which is why I won't explain anything else as it's beyond the scope of this post.
Pool Tracking also monitors driver allocations, however, it doesn't monitor how the drivers are writing to pages, but rather how they are freed; ensuring no memory leaks are present by failing to free the pages correctly.

Can you see how they differ? (In a nutshell of course) You cannot substitute one option for another; they have their own purposes for troubleshooting. As stated previously, because we aren't 100% sure what the driver is doing we could try both.
I hope that's cleared up the difference, in the simplest of terms. If you're interested in the two options then you can look at Pool Tracking and Special Pool at the links provided.

kingsomeguy · Dec 26, 2014

Yea, I understand the basic concept of it. It seems I have not had any BSODs, and the only thing I did between the last BSOD and before Driver Verifier was remove Avast. Either Driver Verifier is somehow "fixing" the driver, or something in Avast was causing the BSODs. I'm going to turn off Driver Verifier, and install Avast without NG or Avast Firewall, and see if I get any BSODs from there. Thanks for the help guys, and merry christmas/happy holidays to you all!

kingsomeguy · Dec 26, 2014

Looks like whatever the problem is gave me a late Christmas present, at the wrong time. Turned on Driver Verifier again with Special Pool and Pool Tracking checked for third party drivers while I wait for any other suggestions.

Edit: Temperatures were normal when the BSOD happened (30-40°).

usasma · Dec 27, 2014

Don't bother with Driver Verifier at this point. It's not pointing at anything significant at this time.

The next thing to try (IMO) is removing/replacing the drivers that are consistently present in the memory dumps.

For starters, uninstall Avast and leave it off until the system has been stabilized.
Use Windows Defender and the Windows Firewall until then.

Also, if possible, remove the bluetooth devices and their software.
If not possible to remove them, disable them in the BIOS/UEFI - then remove the software

Download a fresh copy of the latest Intel Management Engine software, then uninstall the current version from your system and install the freshly downloaded version.

Then wait and see if there's any improvement. If not, post back and we'll do some more.
Good luck!

Analysis:
The following is for informational purposes only.

Code:

[font=lucida console]**************************Fri Dec 26 04:45:26.866 2014 (UTC - 5:00)**************************
Loading Dump File [C:\Users\John\SysnativeBSODApps\122614-45343-01.dmp]
Windows 8 Kernel Version 9200 MP (8 procs) Free x64
Built by: [B]9200[/B].17166.amd64fre.win8_gdr.141031-1551
System Uptime:[B]0 days 3:36:12.485[/B]
Probably caused by :[B]ntkrnlmp.exe ( nt!KiFastFailDispatch+d0 )[/B]
BugCheck [B]139, {3, fffff8801c8f4770, fffff8801c8f46c8, 0}[/B]
BugCheck Info: [url=http://www.carrona.org/bsodindx.html#0x00000139]KERNEL_SECURITY_CHECK_FAILURE (139)[/url]
Arguments: 
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: fffff8801c8f4770, Address of the trap frame for the exception that caused the bugcheck
Arg3: fffff8801c8f46c8, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
BUGCHECK_STR:  0x139
DEFAULT_BUCKET_ID:  LIST_ENTRY_CORRUPT
PROCESS_NAME:  FlashPlayerPlu
FAILURE_BUCKET_ID: [B]0x139_3_nt!KiFastFailDispatch[/B]
CPUID:        "Intel(R) Core(TM) i7-4770 CPU @ 3.40GHz"
MaxSpeed:     3400
CurrentSpeed: [B]3400[/B]
  BIOS Version                  F3
  BIOS Release Date             06/03/2014
  Manufacturer                  Gigabyte Technology Co., Ltd.
  Product Name                  H97M-D3H
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Mon Dec 15 20:25:59.319 2014 (UTC - 5:00)**************************
Loading Dump File [C:\Users\John\SysnativeBSODApps\121514-40828-01.dmp]
Windows 8 Kernel Version 9200 MP (8 procs) Free x64
Built by: [B]9200[/B].17166.amd64fre.win8_gdr.141031-1551
System Uptime:[B]0 days 0:01:33.938[/B]
*** ERROR: Module load completed but symbols could not be loaded for Ntfs.sys
Probably caused by :[B]memory_corruption ( nt!MiRemoveAnyPage+122 )[/B]
BugCheck [B]A, {fffffd7fffffe7e0, 2, 1, fffff80048304ba2}[/B]
BugCheck Info: [url=http://www.carrona.org/bsodindx.html#0x0000000A]IRQL_NOT_LESS_OR_EQUAL (a)[/url]
Arguments: 
Arg1: fffffd7fffffe7e0, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80048304ba2, address which referenced memory
BUGCHECK_STR:  AV
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
PROCESS_NAME:  dasHost.exe
FAILURE_BUCKET_ID: [B]AV_nt!MiRemoveAnyPage[/B]
CPUID:        "Intel(R) Core(TM) i7-4770 CPU @ 3.40GHz"
MaxSpeed:     3400
CurrentSpeed: [B]3400[/B]
  BIOS Version                  F3
  BIOS Release Date             06/03/2014
  Manufacturer                  Gigabyte Technology Co., Ltd.
  Product Name                  H97M-D3H
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Sun Dec 14 06:26:37.745 2014 (UTC - 5:00)**************************
Loading Dump File [C:\Users\John\SysnativeBSODApps\121414-36015-01.dmp]
Windows 8 Kernel Version 9200 MP (8 procs) Free x64
Built by: [B]9200[/B].17166.amd64fre.win8_gdr.141031-1551
System Uptime:[B]0 days 7:36:35.365[/B]
Probably caused by :[B]ntkrnlmp.exe ( nt!KiFastFailDispatch+d0 )[/B]
BugCheck [B]139, {3, fffff8801b43dfb0, fffff8801b43df08, 0}[/B]
BugCheck Info: [url=http://www.carrona.org/bsodindx.html#0x00000139]KERNEL_SECURITY_CHECK_FAILURE (139)[/url]
Arguments: 
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: fffff8801b43dfb0, Address of the trap frame for the exception that caused the bugcheck
Arg3: fffff8801b43df08, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
BUGCHECK_STR:  0x139
DEFAULT_BUCKET_ID:  LIST_ENTRY_CORRUPT
PROCESS_NAME:  javaw.exe
FAILURE_BUCKET_ID: [B]0x139_3_nt!KiFastFailDispatch[/B]
CPUID:        "Intel(R) Core(TM) i7-4770 CPU @ 3.40GHz"
MaxSpeed:     3400
CurrentSpeed: [B]3400[/B]
  BIOS Version                  F3
  BIOS Release Date             06/03/2014
  Manufacturer                  Gigabyte Technology Co., Ltd.
  Product Name                  H97M-D3H
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
[/font]

3rd Party Drivers:
The following is for information purposes only.
Any drivers in red should be updated or removed from your system. And should have been discussed in the body of my post.

Code:

[font=lucida console]**************************Fri Dec 26 04:45:26.866 2014 (UTC - 5:00)**************************
intelppm.sys                Mon Nov  5 22:55:02 2012 (50988A16)
BthHfAud.sys                Sat Feb  2 02:24:42 2013 (510CBF3A)
dump_storahci.sys           Fri Mar  1 21:15:44 2013 (513160D0)
BthA2DP.sys                 Fri May 31 23:08:25 2013 (51A965A9)
bcbtums.sys                 Thu Oct 17 16:45:30 2013 (52604C6A)
TeeDriverx64.sys            Thu Mar 13 14:21:52 2014 (5321F740)
iaStorA.sys                 Thu Apr  3 19:00:05 2014 (533DE7F5)
RTKVHD64.sys                Wed May 28 08:17:12 2014 (5385D3C8)
Rt630x64.sys                Tue Jun 17 07:56:46 2014 (53A02CFE)
IntcDAud.sys                Tue Sep  9 08:36:30 2014 (540EF44E)
igdkmd64.sys                Mon Sep 29 13:51:21 2014 (54299C19)
nvhda64v.sys                Thu Oct  9 13:02:27 2014 (5436BFA3)
aswMonFlt.sys               Thu Nov  6 07:53:07 2014 (545B6F33)
aswKbd.sys                  Thu Nov  6 07:53:07 2014 (545B6F33)
aswRvrt.sys                 Thu Nov  6 07:53:22 2014 (545B6F42)
aswVmm.sys                  Thu Nov  6 07:53:31 2014 (545B6F4B)
aswRdr2.sys                 Thu Nov  6 07:54:02 2014 (545B6F6A)
aswHwid.sys                 Thu Nov  6 07:55:01 2014 (545B6FA5)
aswSP.sys                   Thu Nov  6 08:09:55 2014 (545B7323)
aswStm.sys                  Thu Nov  6 08:11:00 2014 (545B7364)
nvvad64v.sys                Thu Nov 20 10:33:54 2014 (546E09E2)
aswSnx.sys                  Fri Nov 21 06:17:12 2014 (546F1F38)
cpuz138_x64.sys             Thu Nov 27 06:16:46 2014 (5477081E)
nvlddmkm.sys                Sat Dec 13 01:53:17 2014 (548BE25D)
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Mon Dec 15 20:25:59.319 2014 (UTC - 5:00)**************************
dump_iaStorA.sys            Thu Apr  3 19:00:05 2014 (533DE7F5)
nvhda64v.sys                Mon Jul 21 10:17:53 2014 (53CD2111)
nvvad64v.sys                Thu Sep 25 11:39:23 2014 (5424372B)
VBoxAswDrv.sys              Wed Nov  5 06:58:43 2014 (545A10F3)
aswNdisFlt.sys              Thu Nov  6 07:55:50 2014 (545B6FD6)
nvlddmkm.sys                Wed Nov 12 15:51:31 2014 (5463C853)
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Sun Dec 14 06:26:37.745 2014 (UTC - 5:00)**************************
nvvad64v.sys                Fri Mar 28 09:32:06 2014 (533579D6)
VBoxNetFlt.sys              Fri May 16 08:01:15 2014 (5375FE0B)
VBoxUSBMon.sys              Fri May 16 08:01:15 2014 (5375FE0B)
VBoxNetAdp.sys              Fri May 16 08:01:16 2014 (5375FE0C)
VBoxDrv.sys                 Fri May 16 08:04:43 2014 (5375FEDB)
NvStreamKms.sys             Fri Jul 25 07:35:56 2014 (53D2411C)
[/font]

kingsomeguy · Dec 27, 2014

Removed Avast, removed bluetooth device (there was no software for it apparently), and removed Intel Management Software (was never really using this anyways); awaiting for any BSODS.

usasma · Dec 28, 2014

You may need the Intel Management software. In most cases, if it's needed, you'll see an error in Device Manager for a PCI Simple Communications Controller.

But leave it be for now and let's see what happens (and, if it BSOD's, what's in the memory dump).

kingsomeguy · Dec 28, 2014

Not getting any errors so far, and is there any other antivirus I can use in the meantime that won't grind my computer to a halt for half an hour or more when attempting to run certain games or when downloading sometimes?

Edit: Or should I just disable Windows Defender until we determine the problem?

Solved BSOD Error code 139

New Member

My Computer

Mr. Cranky Pants

My Computer

Mr. Cranky Pants

My Computer

New Member

My Computer

Mr. Cranky Pants

My Computer

New Member

My Computer

Mr. Cranky Pants

My Computer

New Member

My Computer

Cat herder

My Computer

New Member

My Computer

Mr. Cranky Pants

My Computer

Mr. Cranky Pants

My Computer

New Member

My Computer

Member

My Computer

New Member

My Computer

New Member

My Computer

Mr. Cranky Pants

My Computer

New Member

My Computer

Mr. Cranky Pants

My Computer

New Member

My Computer