Since 3/8/2018 these were the new bugchecks:
A) The IRQL_NOT_LESS_OR_EQUAL bug check has a value of 0x0000000A.
3D) The INTERRUPT_EXCEPTION_NOT_HANDLED bug check has a value of 0x0000003D.
50) The PAGE_FAULT_IN_NONPAGED_AREA bug check has a value of 0x00000050.
1E) The KMODE_EXCEPTION_NOT_HANDLED bug check has a value of 0x0000001E.
F7) The DRIVER_OVERRAN_STACK_BUFFER bug check has a value of 0x000000F7.
1) In the left lower corner search type: system > open system control panel > on the left pane click advanced system settings > under startup and recovery click settings > un-check automatically restart
With this setting change whenever there is a BSOD you will see the BSOD windows. No longer will there be unexpected restarts for BSOD. There can be unexpected restarts for non-BSOD crashes. When you view the BSOD windows always allow it to go to 100% so that it can create a BSOD dump file. On the BSOD windows you will see a bugcheck. Sometimes you may see the misbehaving driver in the form *.sys. If you see the misbehaving driver please record it and post it into the thread.
2) Uninstall Malwarebytes
3) The AV software can be reinstalled in 1 week if there are no more BSOD. When the software is reinstalled if there is a BSOD then uninstall the software and find an alternative AV product. If there are no new BSOD then continue using the software.
4) Backup all files to another drive or into the cloud
5) Make a backup image using Macrium
Macrium Software | Macrium Reflect Free
Place the backup image onto another drive or into the cloud
6) Make a brand new restore point
7) Read these links on Windows driver verifier:
a) Driver Verifier-- tracking down a mis-behaving driver. - Microsoft Community
b) Enable and Disable Driver Verifier in Windows 10 Windows 10 Tutorials
Windows driver verifier is a tool that will repetitively produce BSOD until all misbehaving drivers are fixed or until the tool is turned off. Each time there is a BSOD a dump file should be created which when debugged can display a misbehaving driver.
The tool will be run for 48 hours. After the last BSOD the tool will be run for an additional 36 hours.
After each BSOD you will see the BSOD window with a bugcheck and sometimes a misbehaving driver. You will then need to turn off Windows driver verifier and this is done using the Windows advanced troubleshooting menu. There are 3 methods used to either turn off or recover from the tool.
Use the information in link b to turn off the tool.
Use the information in link a for the customized test settings.
After each BSOD the tool will be turned off and you will return to the desktop. On the desktop run whocrashed to find the misbehaving driver. Then uninstall the misbehaving driver. At the same time run the beta version of the log collector and post a new zip into the thread for troubleshooting. The debugging tools that we use are more powerful than Whocrashed and if Whocrashed did not find a misbehaving drivers we may be able to find them.
Drivers can be reinstalled after they are uninstalled or after all misbehaving drivers have been uninstalled after multiple runs of Windows driver verifier. The end result should be the same.
When using windows driver verifier some computers may become sluggish or have a very slow boot. If this happens the customized test settings can be modified. In link a there are approximately 19 customized settings. In link b there are 3 customized settings. So with more customized tests active at one time you will more likely have BSOD.
Before using the tool the files must be backed up and a brand new restore point made.
When you are comfortable with the methods to turn off the tool you can start using it.
8) Run memtest86+ version 5.01 for at least 8 passes. Memtest86+ - Advanced Memory Diagnostic Tool
This may take hours so plan to run it overnight.
a) Please make sure you use the Memtest86+ version 5.01 with the link below.
Memtest86+ - Advanced Memory Diagnostic Tool
The testing is done not by time but by passes.
The more passes the better.
There are a significant number of false negatives if fewer than 8 passes are made.
A false negative is a test pass when there is malfunctioning RAM.
There is 8 GB of RAM on the computer.
Memtest86+ version 5.01 testing takes approximately 1 - 2 hours /GB RAM
Just 1 error is a fail and you can abort testing.
Then test 1 RAM module at a time in the same DIMM each for 8 or more passes.
b) When Memtest86+ version 5.01 has completed 8 or more passes use a camera or smart phone camera to take a picture and post an image into the thread.
Memory problems. - Microsoft Community
MemTest86+ - Test RAM Windows 10 Tutorials
Code:
Event[1944]: Log Name: System Source: volmgr Date: 2018-03-13T18:28:10.562 Event ID: 161 Task: N/A Level: Error Opcode: N/A Keyword: Classic User: N/A User Name: N/A Computer: DESKTOP-IRU6EQ2 Description: Dump file creation failed due to error during dump creation.
Code:
Event[1970]: Log Name: System
Source: Microsoft-Windows-WER-SystemErrorReporting
Date: 2018-03-13T18:28:19.892
Event ID: 1005
Task: N/A
Level: Error
Opcode: N/A
Keyword: Classic
User: N/A
User Name: N/A
Computer: DESKTOP-IRU6EQ2
Description:
Unable to produce a minidump file from the full dump file.
Code:
3/11/2018 7:09 PM Windows Error Reporting Fault bucket STACK_BUFFER_OVERRUN_nt!KiSwapThread, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 91ce0126-629d-443c-92d1-c916bf395731
Problem signature:
P1: f7
P2: ffff8080d35d92ec
P3: e37397879e09
P4: ffff1c8c687861f6
P5: 0
P6: 10_0_16299
P7: 0_0
P8: 768_1
P9:
P10:
Attached files:
\\?\C:\WINDOWS\Minidump\031118-6171-01.dmp
\\?\C:\WINDOWS\TEMP\WER-12859-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4E6E.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4EAC.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4EBD.tmp.txt
These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_f7_abfa80a186c457bdd48215418d81fb86d54d1_00000000_cab_1c247668
Analysis symbol:
Rechecking for solution: 0
Report Id: b17c6c5c-7c67-4703-a513-2c92777a575b
Report Status: 268435456
Hashed bucket:3/8/2018 8:42 PM Windows Error Reporting Fault bucket AV_nt!KeWaitForSingleObject, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: b80b6b58-d0fb-4cf7-9d7f-6fedc3342759
Problem signature:
P1: a
P2: 0
P3: 2
P4: 0
P5: fffff80216957501
P6: 10_0_16299
P7: 0_0
P8: 768_1
P9:
P10:
Attached files:
\\?\C:\WINDOWS\Minidump\030818-7968-01.dmp
\\?\C:\WINDOWS\TEMP\WER-15734-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4B70.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4B80.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4B90.tmp.txt
These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_a_d3862b00d0f9eaf286c583ea94ad858212b8_00000000_cab_11106ce3
Analysis symbol:
Rechecking for solution: 0
Report Id: 3a6f640b-f84a-4435-ae7d-3ad68189ef41
Report Status: 268435456
Hashed bucket:
Code:
3/13/2018 10:34 PM Windows Error Reporting Fault bucket 0xDEADDEAD_rspCrash64!unknown_function, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 9056279d-92e6-41cc-a420-db9d6c9f520e
Problem signature:
P1: deaddead
P2: 0
P3: 0
P4: 19bba471
P5: 3c2a58ed
P6: 10_0_16299
P7: 0_0
P8: 768_1
P9:
P10:
Attached files:
\\?\C:\WINDOWS\Minidump\031318-8500-01.dmp
\\?\C:\WINDOWS\TEMP\WER-16171-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6987.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER69C6.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER69D6.tmp.txt
These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_deaddead_fb4eeee6d2fd63b53eaea1761c52384a4a01c_00000000_cab_1e2c8935
Analysis symbol:
Rechecking for solution: 0
Report Id: 1ec1dd22-3485-4e65-82fb-14dcd1bfc84d
Report Status: 268435456
Hashed bucket:3/11/2018 1:58 AM Windows Error Reporting Fault bucket 0x1E_c0000005_R_nt!KiSwapThread, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: b35c6672-36fb-42b6-9547-c45008517542
Problem signature:
P1: 1e
P2: ffffffffc0000005
P3: fffff802af6cd43e
P4: 0
P5: ffffffffffffffff
P6: 10_0_16299
P7: 0_0
P8: 768_1
P9:
P10:
Attached files:
\\?\C:\WINDOWS\Minidump\031018-5812-01.dmp
\\?\C:\WINDOWS\TEMP\WER-12484-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER45D3.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4601.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4612.tmp.txt
These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_1e_fa66c2d9e177fcad14521135f244fcf322ed567_00000000_cab_1704b1bc
Analysis symbol:
Rechecking for solution: 0
Report Id: 81156c5c-ad96-4ce2-9cc4-d5f02c6922da
Report Status: 268435456
Hashed bucket:
Code:
3/11/2018 7:09 PM Windows Error Reporting Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0
Problem signature:
P1: f7
P2: ffff8080d35d92ec
P3: e37397879e09
P4: ffff1c8c687861f6
P5: 0
P6: 10_0_16299
P7: 0_0
P8: 768_1
P9:
P10:
Attached files:
\\?\C:\WINDOWS\Minidump\031118-6171-01.dmp
\\?\C:\WINDOWS\TEMP\WER-12859-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4E6E.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4EAC.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4EBD.tmp.txt
These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_f7_abfa80a186c457bdd48215418d81fb86d54d1_00000000_cab_02a04ecb
Analysis symbol:
Rechecking for solution: 0
Report Id: b17c6c5c-7c67-4703-a513-2c92777a575b
Report Status: 4
Hashed bucket:3/13/2018 10:34 PM Windows Error Reporting Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0
Problem signature:
P1: deaddead
P2: 0
P3: 0
P4: 19bba471
P5: 3c2a58ed
P6: 10_0_16299
P7: 0_0
P8: 768_1
P9:
P10:
Attached files:
\\?\C:\WINDOWS\Minidump\031318-8500-01.dmp
\\?\C:\WINDOWS\TEMP\WER-16171-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6987.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER69C6.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER69D6.tmp.txt
These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_deaddead_fb4eeee6d2fd63b53eaea1761c52384a4a01c_00000000_cab_02b469d5
Analysis symbol:
Rechecking for solution: 0
Report Id: 1ec1dd22-3485-4e65-82fb-14dcd1bfc84d
Report Status: 4
Hashed bucket:3/8/2018 8:42 PM Windows Error Reporting Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0
Problem signature:
P1: a
P2: 0
P3: 2
P4: 0
P5: fffff80216957501
P6: 10_0_16299
P7: 0_0
P8: 768_1
P9:
P10:
Attached files:
\\?\C:\WINDOWS\Minidump\030818-7968-01.dmp
\\?\C:\WINDOWS\TEMP\WER-15734-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4B70.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4B80.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4B90.tmp.txt
These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_a_d3862b00d0f9eaf286c583ea94ad858212b8_00000000_cab_02cc4b9f
Analysis symbol:
Rechecking for solution: 0
Report Id: 3a6f640b-f84a-4435-ae7d-3ad68189ef41
Report Status: 4
Hashed bucket:3/11/2018 1:58 AM Windows Error Reporting Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0
Problem signature:
P1: 1e
P2: ffffffffc0000005
P3: fffff802af6cd43e
P4: 0
P5: ffffffffffffffff
P6: 10_0_16299
P7: 0_0
P8: 768_1
P9:
P10:
Attached files:
\\?\C:\WINDOWS\Minidump\031018-5812-01.dmp
\\?\C:\WINDOWS\TEMP\WER-12484-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER45D3.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4601.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4612.tmp.txt
These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_1e_fa66c2d9e177fcad14521135f244fcf322ed567_00000000_cab_02ac4621
Analysis symbol:
Rechecking for solution: 0
Report Id: 81156c5c-ad96-4ce2-9cc4-d5f02c6922da
Report Status: 4
Hashed bucket:
Code:
Event[223]: Log Name: System
Source: Microsoft-Windows-WHEA-Logger
Date: 2018-03-08T15:32:56.582
Event ID: 19
Task: N/A
Level: Warning
Opcode: Info
Keyword: N/A
User: S-1-5-19
User Name: NT AUTHORITY\LOCAL SERVICE
Computer: DESKTOP-IRU6EQ2
Description:
A corrected hardware error has occurred.
Reported by component: Processor Core
Error Source: Corrected Machine Check
Error Type: Cache Hierarchy Error
Processor APIC ID: 3
The details view of this entry contains further information.