BSOD Random times when computer unattended.

aymanibousi · 24 Apr 2018

Hi guys

Have ran driver verifier, immediatly got a IRP stack overflow error and then got a BSOD everytime before window starts, went back to my restore point beforehand as I could not start windows again. Now, i have uploaded the crash dump because finally it gave me one. Furthermore, the crashes seem to happen 1 hour or 2 hours exactly after computer is put on idle (keep in mind that the power mode is on performance). attached is the log colllector beta 2

zbook · 24 Apr 2018

Open file explorer > this PC > C: > in the right upper corner search for: C:\windows\memory.dmp > zip > post a one drive or drop box share link into the thread
So far there has only been 1 mini dump file for debugging with Windows driver verifier.
Please post multiple dump files.
Using system restore often leads to a loss of the dump file.
What happens with startup options?
What happens with bootmode?

The misbehaving driver identified in the debugging was: covefs.sys
Name Covecube Disk Enumerator
Manufacturer Covecube Inc.
PNP Device ID ROOT\SCSIADAPTER\0000
Driver c:\windows\system32\drivers\covefs_disk.sys (2.0.61.0, 55.10 KB (56,424 bytes), 29/09/2017 12:00 AM)

Please update the Covecube drivers:

Code:

covefs    CoveFS    \??\c:\windows\system32\drivers\covefs.sys    File System Driver    Yes    System    Running    OK    Ignore    No    Yes

Code:

covefsdisk    CoveFSDisk    c:\windows\system32\drivers\covefs_disk.sys    Kernel Driver    Yes    Manual    Running    OK    Normal    No    Yes

aymanibousi · 24 Apr 2018

Ok, drivepool (software using this driver) has already been updated to the newest build. I have 1 new minidump (Microsoft OneDrive - Access files anywhere. Create docs with free Office Online.) but the others have been wiped, but whocrashed has managed to catch them (please note, I have taken out my graphics card, used DDU in safe mode to uninstall the drive, now trying out a nvidia based card, but it crashed before I could install the drive):

Crash Dump Analysis

Crash dumps are enabled on your computer.

Crash dump directories:
C:\Windows
C:\Windows\Minidump
C:\Windows\LiveKernelReports

On Wed 25/04/2018 1:52:20 PM your computer crashed or a problem was reported
crash dump file: C:\Windows\Minidump\042518-24296-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x175930)
Bugcheck code: 0xD1 (0xFFFFF803B5AC23DF, 0x2, 0x8, 0xFFFFF803B5AC23DF)
Error: DRIVER_IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.
This bug check belongs to the crash dump test that you have performed with WhoCrashed or other software. It means that a crash dump file was properly written out.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

On Wed 25/04/2018 1:52:20 PM your computer crashed or a problem was reported
crash dump file: C:\Windows\MEMORY.DMP
This was probably caused by the following module: ntkrnlmp.exe (nt!setjmpex+0x83D9)
Bugcheck code: 0xD1 (0xFFFFF803B5AC23DF, 0x2, 0x8, 0xFFFFF803B5AC23DF)
Error: DRIVER_IRQL_NOT_LESS_OR_EQUAL
Bug check description: This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.
This bug check belongs to the crash dump test that you have performed with WhoCrashed or other software. It means that a crash dump file was properly written out.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

On Wed 25/04/2018 9:34:05 AM your computer crashed or a problem was reported
crash dump file: C:\Windows\LiveKernelReports\win32kbase.sys-20180425-0934.dmp
This was probably caused by the following module: ntkrnlmp.exe (nt!IoUnregisterShutdownNotification+0xBBE)
Bugcheck code: 0x164 (0xF, 0xFFFFC78310A18700, 0xF, 0x0)
Error: WIN32K_CRITICAL_FAILURE
Bug check description: This indicates that Win32k has encountered a critical failure. This may be caused by your graphics driver.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

On Wed 25/04/2018 9:34:05 AM your computer crashed or a problem was reported
crash dump file: C:\Windows\LiveKernelReports\win32kbase.sys\win32kbase.sys-20180425-0934.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x425B4E)
Bugcheck code: 0x164 (0xF, 0xFFFFC78310A18700, 0xF, 0x0)
Error: WIN32K_CRITICAL_FAILURE
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that Win32k has encountered a critical failure. This may be caused by your graphics driver.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

zbook · 24 Apr 2018

For all BSOD please run the beta log collector so that all log files are updated with each BSOD dump file.
Open file explorer > this PC > C: > in the right upper corner search for C:Windowsmemory.dmp > zip > post a one drive or drop box share link into this thread.

Commands are run on the mini and memory dumps. This provides deeper debugging than Whocrashed. This little that can done with a txt file unless it displays a misbehaving driver but often the misbehaving drivers are found using the commands. So it is important to have the files for the debugging.

Covecube Disk Enumerator software and its drivers (covefs_disk.sys, covefs.sys) were not in our driver database. Sometimes we submit drivers to update the database. What information do you have for the software and drivers?

aymanibousi · 24 Apr 2018

oh sorry, all done :)

I have changed graphics card completly as well

zbook · 24 Apr 2018

See if you can find this memory dump file > zip > post into the thread using one drive or drop box:
Crash dump found at C:\Windows\MEMORY.DMP
Creation date: 04/25/2018 13:54:57
Size on disk: 583 MB

Code:

24/04/2018 8:43 AM    Windows Error Reporting    Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: 35
P2: ffffc2020e0c6c10
P3: 0
P4: 0
P5: 0
P6: 10_0_16299
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\Windows\Minidump\042418-22906-01.dmp
\\?\C:\Windows\TEMP\WER-94250-0.sysdata.xml
\\?\C:\Windows\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER9371.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER9382.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER93B2.tmp.txt

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_35_2d789d2275c5d137844152ea6f543da11e651e31_00000000_cab_03e993bf

Analysis symbol: 
Rechecking for solution: 0
Report Id: 28a086b5-2ac5-4651-aa7a-e390d0f5a0aa
Report Status: 4
Hashed bucket:25/04/2018 1:55 AM    Windows Error Reporting    Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: d1
P2: fffff803b5ac23df
P3: 2
P4: 8
P5: fffff803b5ac23df
P6: 10_0_16299
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\Windows\Minidump\042518-24296-01.dmp
\\?\C:\Windows\TEMP\WER-75359-0.sysdata.xml
\\?\C:\Windows\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER36EA.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER36EB.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER370C.tmp.txt

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_d1_844d4af59f821be335678899505732d2d228e510_00000000_cab_03b93709

Analysis symbol: 
Rechecking for solution: 0
Report Id: 40941a2d-c067-424e-bc8d-2dbe5afe7e89
Report Status: 4
Hashed bucket:

Code:

24/04/2018 8:43 AM    Windows Error Reporting    Fault bucket 0x35_VRF_disk!DiskDeviceControl, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 536b71c3-1bb1-417e-8842-1651f3fc4ee5

Problem signature:
P1: 35
P2: ffffc2020e0c6c10
P3: 0
P4: 0
P5: 0
P6: 10_0_16299
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\Windows\Minidump\042418-22906-01.dmp
\\?\C:\Windows\TEMP\WER-94250-0.sysdata.xml
\\?\C:\Windows\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER9371.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER9382.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER93B2.tmp.txt

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_35_2d789d2275c5d137844152ea6f543da11e651e31_00000000_cab_33a1de74

Analysis symbol: 
Rechecking for solution: 0
Report Id: 28a086b5-2ac5-4651-aa7a-e390d0f5a0aa
Report Status: 268435456
Hashed bucket:

Code:

25/04/2018 1:56 AM    Windows Error Reporting    Fault bucket AV_CODE_AV_BAD_IP_nt!KiRemoveTimer2, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: f5d46853-98a5-436c-992d-3ea2dc3d4610

Problem signature:
P1: d1
P2: fffff803b5ac23df
P3: 2
P4: 8
P5: fffff803b5ac23df
P6: 10_0_16299
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\Windows\Minidump\042518-24296-01.dmp
\\?\C:\Windows\TEMP\WER-75359-0.sysdata.xml
\\?\C:\Windows\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER36EA.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER36EB.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER370C.tmp.txt

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_d1_844d4af59f821be335678899505732d2d228e510_00000000_cab_1f69847d

Analysis symbol: 
Rechecking for solution: 0
Report Id: 40941a2d-c067-424e-bc8d-2dbe5afe7e89
Report Status: 268435456
Hashed bucket:25/04/2018 1:56 AM    Windows Error Reporting    Fault bucket LKD_0x164_win32kbase!HMUnlockObjectInternal, type 0
Event Name: LiveKernelEvent
Response: Not available
Cab Id: 54f9dffd-feda-44e0-a13c-e5b4329ee10a

Problem signature:
P1: 164
P2: f
P3: ffffc78310a18700
P4: f
P5: 0
P6: 10_0_16299
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\Windows\LiveKernelReports\win32kbase.sys\win32kbase.sys-20180425-0934.dmp
\\?\C:\Windows\TEMP\WER-75359-0.sysdata.xml
\\?\C:\Windows\LiveKernelReports\win32kbase.sys-20180425-0934.dmp
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER368C.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER36AB.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER36CB.tmp.txt

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_164_efd78b181ed04e50c6a0a67a9eeabd66868d7f2d_00000000_cab_1f695d6d

Analysis symbol: 
Rechecking for solution: 0
Report Id: e55b4a20-80bb-4e39-876f-cf648a4a3e0a
Report Status: 268435456
Hashed bucket:

aymanibousi · 24 Apr 2018

Ahhh, sorry, found it, here it is: Microsoft OneDrive - Access files anywhere. Create docs with free Office Online.

zbook · 24 Apr 2018

What was done with covefs.sys?

Covecube Disk Enumerator software and its drivers (covefs_disk.sys, covefs.sys) were not in our driver database. Sometimes we submit drivers to update the database. What information do you have for the software and drivers?

The latest BSOD memory dump debugging displayed RT640x64.sys as the misbehaving hardware driver.

Update: rt640x64.sys Realtek PCIe GBE Family Controller
Updating a driver. - Microsoft Community
Realtek

Code:

rt640x64.sys Fri Jan 19 05:29:08 2018 (5A61D684)

Code:

Name    [00000001] Realtek PCIe GBE Family ControllerAdapter Type    Ethernet 802.3
Product Type    Realtek PCIe GBE Family Controller
Installed    Yes
PNP Device ID    PCI\VEN_10EC&DEV_8168&SUBSYS_81681849&REV_06\4&9B80F17&0&00AB
Last Reset    25/04/2018 2:44 PM
Index    1
Service Name    rt640x64
IP Address    192.168.1.3, fe80::d8:85f0:94cb:d99b
IP Subnet    255.255.255.0, 64
Default IP Gateway    192.168.1.1
DHCP Enabled    Yes
DHCP Server    192.168.1.1
DHCP Lease Expires    2/01/1970 12:00 PM
DHCP Lease Obtained    1/01/1970 12:00 PM
MAC Address    ‪D0:50:99:37:A1:C5‬
I/O Port    0x0000C000-0x0000CFFF
Memory Address    0xFA104000-0xFA104FFF
Memory Address    0xFA100000-0xFA1FFFFF
IRQ Channel    IRQ 4294967279
Driver    c:\windows\system32\drivers\rt640x64.sys (10.25.119.2018, 1,002.83 KB (1,026,896 bytes), 15/08/2017 3:19 PM)

Code:

rt640x64    Realtek RT640 NT Driver    c:\windows\system32\drivers\rt640x64.sys    Kernel Driver    Yes    Manual    Running    OK    Normal    No    Yes

Code:

rt640x64     Realtek RT640 NT Drive Realtek RT640 NT Drive Kernel        Manual     Running    OK         TRUE        FALSE        4,096             966,656     0          20/01/2018 12:29:08 AM C:\Windows\system32\drivers\rt640x64.sys

aymanibousi · 24 Apr 2018

Hi, I have updated the realtek drivers through the website. Thank you for spotting that, although I used a program called driver booster to update all my drivers this morning (it was the 2018 version already) but nevertheless, i uninstalled and installed the one from the realtek website.
With regards to covecube, that belongs to drivepool program. Its updated to the latest version. I dont know what else to do with it. I did a right click on it and update, and its already the latest version.

zbook · 24 Apr 2018

Can you uninstall drivepool software then reinstall the software so that there are new drivers?

For updating drivers please do not use driver update software. Many times you do not know what you are getting. We see significant problems with drivers from these websites and some need to perform system restore or clean install.

The best source for all drivers is from the computer or motherboard manufacturer.
If drivers are not available the next best source is the component manufacturer (Intel, Nvidia, AMD, Killer Networks, Realtek, etc.)

If there are any more BSOD please post both a beta log collector zip and a memory dump.