Random crashes, sometimes playing War Thunder, bugcheck: 0x000000c4

Hi, Need some help - have been experiencing random crashes, sometimes while playing War Thunder. I enabled "driver verifier" and was unable to successfully boot on multiple attempts. Each time, I got "Stop code: DRIVER VERIFIER DETECTED VIOLATION", but no code to go with it.

I believe it's associated with the Event 219, The driver \Driver\WUDFRd failed to load for the device ACPI\PNP0A0A\2&daba3ff&1. According to various forums, this may be associated with Asus AI Suite 3, and/or an Asus motherboard driver but I never found any actual solutions to the problem.

Previously, I had the Event 219 but the PC wasn't crashing. I attempted to address the error by variations on removing/reinstalling/using AI Suite removal tool, etc., but the error messages persisted. SFC /Scannow, DISM, virus check, malware check, MemTest86 (v4.3 and v7.5) have all been done with no errors, cautions or warnings.

Any assistance would be much appreciated!

The three crash dumps you provided are pointing towards ccSetx64.sys, the Symantec/Norton Common Client Settings Driver. However this may be a false positive as driver verifier will find problems with many drivers.

Were you getting blue screens before you enabled driver verifier, or was your computer freezing/becoming unresponsive?

Hi, I just got to that point too (just did the Debugging Tutorial). Prior to enabling driver verifier, I was having boot hangs (no spinning circle) on cold starts but not on restarts. I didn't associate that with any crashes - thought that was a result of a sub-optimal setting, like Fast Boot or hibernate (both disabled). The BSODs (actually restarts because I didn't disable the restart-on-BSOD in UEFI/BIOS) started happening infrequently, like once or twice a week, maybe two months ago, give or take but I didn't really take notice because they were happening when I was away from my desk. Maybe a week ago, they started happening when I was actually using the PC (websurfing, reading news, forums, etc), so I started digging into Event Viewer listings. In the last two days, the non-verifier BSODs occurred shortly after I started a battle on War Thunder. My first thought was a failing PSU, but it's only a few years old (Corsair 860X) and well within capacity as nothing is overclocked. It's still possible I guess but I'm trying to eliminate all the other possibilities.

One other thing that's started occurring recently is my mouse has been slowing down and/or freezing with increasing frequency. I checked the drivers and USB suspend settings but everything looks like it's supposed to. It may be completely unrelated.

I can't think of any major changes that I've made to the settings or software environment that would have triggered this stuff. Haven't tried uninstalling and reinstalling the GPUs yet, but that's my next step.

Sorry, PSU is AX860 not 860X

Update - so, I've Revo uninstalled Norton and AI Suite 3 and CCleaned the leftovers and registry (did this for a number of other programs, too). I also ran a number of the Win10 troubleshooting tools (hardware compatibility, software, etc.) and ran another iteration of MemTest 86 v5.01 (no errors). This appears to have done the trick, at least so far - I've been using my PC quite heavily, including playing War Thunder, and haven't had any BSODs since. I'm not sure which action was the fix, as I didn't try to induce a BSOD between remedial actions. I will enable driver verifier later this morning and see what happens. If I can't induce a BSOD, if I'm feeling masochistic I'll reinstall Norton and AI Suite, one at a time, and see if I can replicate the crashes - maybe I (we) can actually isolate the cause.
On a separate note, I'm still getting all of my usual errors and warnings in the event log. Any advice on addressing those would be welcome.

Which event log errors are you referring to?

If you are talking about the ones from "Microsoft-Windows-DistributedCOM" that is unfortunately normal, but harmless. You can remove these errors (although I'd imagine they will come back in a future update), but it takes some effort and you should know what you are doing when editing permissions.

If you want to see what COM service the GUID maps to, open up regedit.exe and go to

Code:

"Computer\HKEY_CLASSES_ROOT\AppID\{$GUID}"

$GUID is the long hexadecimal string in the event.

For example:

Code:

Event[337]:
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2018-03-16T07:45:50.493
  Event ID: 10016
  Task: N/A
  Level: Error
  Opcode: Info
  Keyword: Classic
  User: S-1-5-21-2543048984-2927865944-2295690734-1001
  User Name: TPT-DESKTOP\Ted
  Computer: TPT-Desktop
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 and APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 to the user TPT-DESKTOP\Ted SID (S-1-5-21-2543048984-2927865944-2295690734-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

You would go to Computer\HKEY_CLASSES_ROOT\AppID\{9CA88EE3-ACB7-47C8-AFC4-AB702511C276} in regedit.

After opening the key it should show what service that is.

Then you can open component services (comexp.msc).

From there go to Computers -> My Computer -> DCOM Config -> Find the service in that list

Right-click it, go to Properties -> Security Tab

There you can edit the security permissions (again, only do this if you know what you are doing). Add the permissions that the event is complaining about (in this case the user Ted needs local launch and activation rights)

Yes, I've tried editing the permissions, including preceding the DCOM permission change with the two registry key permission (reg backed up) changes illustrated here: Event id 10016 runtime broker - Microsoft Community

No luck. I've given up and just changed its autologger enabled dword value to zero. I figure if folks like you that are a lot smarter on this stuff than I am can't figure out a fix, my odds are pretty slim.

What concerns me more is the warning from Event 219 Kernel-PnP, "The driver \Driver\WUDFRd failed to load for the device ACPI\PNP0A0A\2&daba3ff&1." It's almost as frequent as the DCOM errors but seems to be more closely associated with whatever was causing the BSODs. I've spent many hours scouring forums and support sites for a fix, but no joy. On the bright side, it doesn't appear to be doing any noticeable damage on its own.

System seems stable - no shut-downs and everything seems to check out okay on diagnostics. I'm going to call this "solved". Appreciate your input, Spectrum! If you or anyone else wants to way in on the Event 219, that would be very welcome.