Just had a BSOD but this time it was ATTEMPTED_WRITE_TO_READONLY_MEMORY caused by afd.sys. Having a look in BlueScreenView. it shows the following files;
afs.sys
hal.dll
intelppm.sys
ntoskrnl.exe
I also double checked my setting in the BIOS and all settings are set to auto, including valtages for CPU and XMP for RAM.
I have removed EasyTune from my OS as well. Just in case that it was running in the background and then messing with the hardware.
The logs displayed corruption of the operating system and drive file system.
1) Open administrative command prompt and copy and paste:
2) Sfc /scannow
3) dism /online /cleanup-image /restorehealth
4) When these have completed > right click on the top bar or title bar of the administrative command prompt box > left click on edit then select all > right click on the top bar again > left click on edit then copy > paste into the thread
5) chkdsk /r /v
Run this command on each partition using the syntax: chkdsk /r /v C: or chkdsk /r /v /D: changing the drive letter to the applicable drive.
This may take a lot of time so plan to run overnight.
C:\WINDOWS\system32>chkdsk /r /v
The type of the file system is NTFS.
Cannot lock current drive.
Chkdsk cannot run because the volume is in use by another
process. Would you like to schedule this volume to be
checked the next time the system restarts? (Y/N)
Type: Y
reboot
6) Use the txt and images in this thread to find the chkdsk reports in the event viewer > copy and paste > notepad > post share links into the thread using one drive, drop box, or google drive.
7) Open administrative command prompt and copy and paste this command:
8) When these have completed > right click on the top bar or title bar of the administrative command prompt box > left click on edit then select all > right click on the top bar again > left click on edit then copy > paste into the thread using a share linkCode:bcdedit /enum bcdedit | find "osdevice" diskpart list disk list volume select disk 0 detail disk list partition select partition 1 detail partition select partition 2 detail partition select partition 3 detail partition select partition 4 detail partition select partition 5 detail partition select disk 1 detail disk list partition select partition 1 detail partition select partition 2 detail partition select partition 3 detail partition select partition 4 detail partition select partition 5 detail partition select disk 2 detail disk list partition select disk 3 detail disk list partition exit h: dir
9) Open disk management > by default the columns are compressed > widen each of these columns: Status and Volume > make sure that the characters in each row are in full view and that none of the letters are cutoff > post an image into the thread
Disk Management - How to Post a Screenshot of | Windows 10 Tutorials
10) For any BSOD :
a) run the BETA log collector and post a new zip into this thread
b) open file explorer > this pc > C: > in the right upper corner search for C:\Windows\memory.dmp > view the file size > if the file size is < 1.5 GB then zip > post a share link into this thread using one drive, drop box, or google drive
Last edited by zbook; 31 Oct 2018 at 16:23.
I have ran SFC and DISM. Everything completed fine. I ran chkdsk /r /v and this came back with the following;
I the rest of the drives will be checked over night.Code:Checking file system on C: The type of the file system is NTFS. A disk check has been scheduled. Windows will now check the disk. Stage 1: Examining basic file system structure ... 347136 file records processed. File verification completed. 5465 large file records processed. 0 bad file records processed. Stage 2: Examining file name linkage ... 970 reparse records processed. 448812 index entries processed. Index verification completed. 0 unindexed files scanned. 0 unindexed files recovered to lost and found. 970 reparse records processed. Stage 3: Examining security descriptors ... Cleaning up 388 unused index entries from index $SII of file 0x9. Cleaning up 388 unused index entries from index $SDH of file 0x9. Cleaning up 388 unused security descriptors. Security descriptor verification completed. 50839 data files processed. CHKDSK is verifying Usn Journal... 40415808 USN bytes processed. Usn Journal verification completed. Stage 4: Looking for bad clusters in user file data ... 347120 files processed. File data verification completed. Stage 5: Looking for bad, free clusters ... 200280513 free clusters processed. Free space verification is complete. Windows has scanned the file system and found no problems. No further action is required. 976749567 KB total disk space. 174985456 KB in 274697 files. 155972 KB in 50840 indexes. 0 KB in bad sectors. 486087 KB in use by the system. 65536 KB occupied by the log file. 801122052 KB available on disk. 4096 bytes in each allocation unit. 244187391 total allocation units on disk. 200280513 allocation units available on disk. Internal Info: 00 4c 05 00 aa f7 04 00 6a 39 09 00 00 00 00 00 .L......j9...... 2b 02 00 00 9f 01 00 00 00 00 00 00 00 00 00 00 +............... Windows has finished checking your disk. Please wait while your computer restarts.
For step 7 this is the output;
Screenshot for step 9;Code:PS C:\Windows\system32> bcdedit /enum >> bcdedit | find "osdevice" >> diskpart Windows Boot Manager -------------------- identifier {bootmgr} device partition=\Device\HarddiskVolume4 path \EFI\MICROSOFT\BOOT\BOOTMGFW.EFI description Windows Boot Manager locale en-GB inherit {globalsettings} flightsigning Yes default {current} resumeobject {3eaab0c0-c807-11e8-9614-d37385855e1a} displayorder {current} {32e81025-28c4-11e5-90cc-a7bfa26c5522} toolsdisplayorder {memdiag} timeout 5 Windows Boot Loader ------------------- identifier {current} device partition=C: path \Windows\system32\winload.efi description Windows 10 locale en-GB inherit {bootloadersettings} recoverysequence {3eaab0c2-c807-11e8-9614-d37385855e1a} displaymessageoverride Recovery recoveryenabled Yes isolatedcontext Yes allowedinmemorysettings 0x15000075 osdevice partition=C: systemroot \Windows resumeobject {3eaab0c0-c807-11e8-9614-d37385855e1a} nx OptIn bootmenupolicy Standard useplatformclock No Windows Boot Loader ------------------- identifier {32e81025-28c4-11e5-90cc-a7bfa26c5522} device unknown path \Windows\system32\winload.efi description Windows 7 Enterprise locale en-US recoverysequence {32e81026-28c4-11e5-90cc-a7bfa26c5522} recoveryenabled Yes osdevice unknown systemroot \Windows resumeobject {cbdb8a9f-c930-11e5-adb0-806e6f6e6963} bootmenupolicy Legacy FIND: Parameter format not correct Microsoft DiskPart version 10.0.17763.1 Copyright (C) Microsoft Corporation. On computer: LEE-PC DISKPART> list disk Disk ### Status Size Free Dyn Gpt -------- ------------- ------- ------- --- --- Disk 0 Online 1863 GB 3072 KB * Disk 1 Online 465 GB 0 B * Disk 2 Online 223 GB 1024 KB * Disk 3 Online 3726 GB 0 B * Disk 4 Online 931 GB 0 B * DISKPART> list volume Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- Volume 0 D Virtual Mac NTFS Partition 1763 GB Healthy Volume 1 E USB BACKUP NTFS Partition 99 GB Healthy Volume 2 Recovery NTFS Partition 450 MB Healthy Volume 3 F Recordings NTFS Partition 465 GB Healthy Volume 4 FAT32 Partition 100 MB Healthy System Volume 5 R SCRATCH NTFS Partition 223 GB Healthy Volume 6 C NTFS Partition 931 GB Healthy Boot DISKPART> select disk 0 Disk 0 is now the selected disk. DISKPART> detail disk WDC WD2003FZEX-00Z4SA0 Disk ID: {68125B6E-44DF-4F67-8980-00E881555892} Type : RAID Status : Online Path : 0 Target : 0 LUN ID : 0 Location Path : PCIROOT(0)#PCI(1700)#RAID(P00T00L00) Current Read-only State : No Read-only : No Boot Disk : No Pagefile Disk : No Hibernation File Disk : No Crashdump Disk : No Clustered Disk : No Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- Volume 0 D Virtual Mac NTFS Partition 1763 GB Healthy Volume 1 E USB BACKUP NTFS Partition 99 GB Healthy DISKPART> list partition Partition ### Type Size Offset ------------- ---------------- ------- ------- Partition 1 Primary 1763 GB 1024 KB Partition 2 Primary 99 GB 1763 GB DISKPART> select partition 1 Partition 1 is now the selected partition. DISKPART> detail partition Partition 1 Type : ebd0a0a2-b9e5-4433-87c0-68b6b72699c7 Hidden : No Required: No Attrib : 0000000000000000 Offset in Bytes: 1048576 Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- * Volume 0 D Virtual Mac NTFS Partition 1763 GB Healthy DISKPART> select partition 2 Partition 2 is now the selected partition. DISKPART> detail partition Partition 2 Type : ebd0a0a2-b9e5-4433-87c0-68b6b72699c7 Hidden : No Required: No Attrib : 0000000000000000 Offset in Bytes: 1893023612928 Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- * Volume 1 E USB BACKUP NTFS Partition 99 GB Healthy DISKPART> select partition 3 The specified partition is not valid. Please select a valid partition. There is no partition selected. DISKPART> detail partition There is no partition selected. Please select a partition and try again. DISKPART> select partition 4 The specified partition is not valid. Please select a valid partition. There is no partition selected. DISKPART> detail partition There is no partition selected. Please select a partition and try again. DISKPART> select partition 5 The specified partition is not valid. Please select a valid partition. There is no partition selected. DISKPART> detail partition There is no partition selected. Please select a partition and try again. DISKPART> select disk 1 Disk 1 is now the selected disk. DISKPART> detail disk ST3500312CS Disk ID: {EF7E04F6-ADF7-40E8-91C8-EF419C8AF6F7} Type : RAID Status : Online Path : 0 Target : 1 LUN ID : 0 Location Path : PCIROOT(0)#PCI(1700)#RAID(P00T01L00) Current Read-only State : No Read-only : No Boot Disk : No Pagefile Disk : No Hibernation File Disk : No Crashdump Disk : No Clustered Disk : No Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- Volume 2 Recovery NTFS Partition 450 MB Healthy Volume 3 F Recordings NTFS Partition 465 GB Healthy Volume 4 FAT32 Partition 100 MB Healthy System DISKPART> list partition Partition ### Type Size Offset ------------- ---------------- ------- ------- Partition 1 Recovery 450 MB 1024 KB Partition 2 System 100 MB 451 MB Partition 3 Reserved 16 MB 551 MB Partition 4 Primary 465 GB 567 MB DISKPART> select partition 1 Partition 1 is now the selected partition. DISKPART> detail partition Partition 1 Type : de94bba4-06d1-4d40-a16a-bfd50179d6ac Hidden : No Required: Yes Attrib : 0X8000000000000001 Offset in Bytes: 1048576 Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- * Volume 7 Recovery NTFS Partition 450 MB Healthy Hidden DISKPART> select partition 2 Partition 2 is now the selected partition. DISKPART> detail partition Partition 2 Type : c12a7328-f81f-11d2-ba4b-00a0c93ec93b Hidden : Yes Required: No Attrib : 0X8000000000000000 Offset in Bytes: 472907776 Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- * Volume 4 FAT32 Partition 100 MB Healthy System DISKPART> select partition 3 Partition 3 is now the selected partition. DISKPART> detail partition Partition 3 Type : e3c9e316-0b5c-4db8-817d-f92df00215ae Hidden : Yes Required: No Attrib : 0X8000000000000000 Offset in Bytes: 577765376 There is no volume associated with this partition. DISKPART> select partition 4 Partition 4 is now the selected partition. DISKPART> detail partition Partition 4 Type : ebd0a0a2-b9e5-4433-87c0-68b6b72699c7 Hidden : No Required: No Attrib : 0000000000000000 Offset in Bytes: 594542592 Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- * Volume 3 F Recordings NTFS Partition 465 GB Healthy DISKPART> select partition 5 The specified partition is not valid. Please select a valid partition. There is no partition selected. DISKPART> detail partition There is no partition selected. Please select a partition and try again. DISKPART> select disk 2 Disk 2 is now the selected disk. DISKPART> detail disk KINGSTON SA400S37240G Disk ID: {0D1AB521-6A64-448E-9F1B-E391E24537E1} Type : RAID Status : Online Path : 0 Target : 3 LUN ID : 0 Location Path : PCIROOT(0)#PCI(1700)#RAID(P00T03L00) Current Read-only State : No Read-only : No Boot Disk : No Pagefile Disk : No Hibernation File Disk : No Crashdump Disk : No Clustered Disk : No Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- Volume 5 R SCRATCH NTFS Partition 223 GB Healthy DISKPART> list partition Partition ### Type Size Offset ------------- ---------------- ------- ------- Partition 1 Reserved 15 MB 17 KB Partition 2 Primary 223 GB 16 MB DISKPART> select disk 3 Disk 3 is now the selected disk. DISKPART> detail disk WDC WD4003FZEX-00Z4SA0 Disk ID: {1A2E1565-D6DB-4824-836C-8E8594ADF1A1} Type : RAID Status : Online Path : 0 Target : 4 LUN ID : 0 Location Path : PCIROOT(0)#PCI(1700)#RAID(P00T04L00) Current Read-only State : No Read-only : No Boot Disk : No Pagefile Disk : No Hibernation File Disk : No Crashdump Disk : No Clustered Disk : No There are no volumes. DISKPART> list partition Partition ### Type Size Offset ------------- ---------------- ------- ------- Partition 1 Reserved 128 MB 17 KB Partition 2 Primary 3725 GB 129 MB DISKPART> exit Leaving DiskPart... PS C:\Windows\system32> h: Set-Location : Cannot find drive. A drive with the name 'H' does not exist. At line:1 char:1 + Set-Location $MyInvocation.MyCommand.Name + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : ObjectNotFound: (H:String) [Set-Location], DriveNotFoundException + FullyQualifiedErrorId : DriveNotFound,Microsoft.PowerShell.Commands.SetLocationCommand PS C:\Windows\system32>
Attachment 210726
1) If the drives are in RAID, what configuration are the drives in?
2) Parts of the Windows operating system are on different disks (disk 4 and 1).
3) The Windows event viewer for startup repair has reported multiple times partition H however partition H was not displayed in the diskpart commands or disk management image.
4) Whenever Windows upgrades is performed Windows can install all partitions on one disk or on multiple disks.
5) To prevent Windows from being installed on multiple disks the other cables must be disconnected or the disks removed from the computer during the upgrade.
6) In the left lower corner search type: system or system control > open system control panel > on the left pane click advanced system settings
a) > on the advanced tab under startup and recovery > click settings > post an image of the startup and recovery into the thread.
b) > on the advanced tab under performance > click on settings > under performance options > click on the advanced tab > under virtual memory > click on change > post an image of the virtual memory tab into the thread
7) Run the BETA log collector and post a new zip into the thread.
8) Open administrative command prompt and type or copy and paste:
9) When these have completed > right click on the top bar or title bar of the administrative command prompt box > left click on edit then select all > right click on the top bar again > left click on edit then copy > paste into the threadCode:diskpart list disk list volume select disk 4 detail disk list partition select partition 1 detail partition select partition 2 detail partition
10) Make sure that there is no over clocking while troubleshooting.
Code:Event[11050]: Log Name: System Source: Microsoft-Windows-StartupRepair Date: 2018-10-27T11:26:29.887 Event ID: 1002 Task: N/A Level: Information Opcode: Info Keyword: N/A User: S-1-5-18 User Name: NT AUTHORITY\SYSTEM Computer: LEE-PC.xpe.local Description: Start-up Repair failed. Event[11051]: Log Name: System Source: Microsoft-Windows-StartupRepair Date: 2018-10-27T11:26:29.887 Event ID: 1121 Task: N/A Level: Information Opcode: Info Keyword: N/A User: S-1-5-18 User Name: NT AUTHORITY\SYSTEM Computer: LEE-PC.xpe.local Description: The following file necessary for Windows start-up was corrupt: H:\Windows\system32\ntoskrnl.exe Event[11052]: Log Name: System Source: Microsoft-Windows-StartupRepair Date: 2018-10-27T11:26:29.887 Event ID: 1121 Task: N/A Level: Information Opcode: Info Keyword: N/A User: S-1-5-18 User Name: NT AUTHORITY\SYSTEM Computer: LEE-PC.xpe.local Description: The following file necessary for Windows start-up was corrupt: H:\Windows\system32\ntoskrnl.exe Event[11053]: Log Name: System Source: Microsoft-Windows-StartupRepair Date: 2018-10-27T11:26:29.887 Event ID: 1121 Task: N/A Level: Information Opcode: Info Keyword: N/A User: S-1-5-18 User Name: NT AUTHORITY\SYSTEM Computer: LEE-PC.xpe.local Description: The following file necessary for Windows start-up was corrupt: h:\windows\system32\ntoskrnl.exe Event[11054]: Log Name: System Source: Microsoft-Windows-StartupRepair Date: 2018-10-27T11:26:29.887 Event ID: 1206 Task: N/A Level: Information Opcode: Info Keyword: N/A User: S-1-5-18 User Name: NT AUTHORITY\SYSTEM Computer: LEE-PC.xpe.local Description: Copied the following file from backup files:Code:Event[8653]: Log Name: System Source: Microsoft-Windows-Ntfs Date: 2018-10-24T17:10:10.180 Event ID: 98 Task: N/A Level: Error Opcode: Info Keyword: N/A User: S-1-5-18 User Name: NT AUTHORITY\SYSTEM Computer: LEE-PC Description: Volume C: (\Device\HarddiskVolume12) needs to be taken offline to perform a Full Chkdsk. Please run "CHKDSK /F" locally via the command line, or run "REPAIR-VOLUME <drive:>" locally or remotely via PowerShell. Event[8654]: Log Name: System Source: Ntfs Date: 2018-10-24T17:10:10.203 Event ID: 55 Task: N/A Level: Error Opcode: Info Keyword: N/A User: S-1-5-18 User Name: NT AUTHORITY\SYSTEM Computer: LEE-PC Description: A corruption was discovered in the file system structure on volume C:. The exact nature of the corruption is unknown. The file system structures need to be scanned and fixed offline.
The RAID is software based from the BIOS. It is in RAID 0. Referencing back to the latest BSOD (ATTEMPTED_WRITE_TO_READONLY_MEMORY) I have installed all Intel drivers I have, Chipset, ME and RST. as well as removing any overclocking software.
In terms of the mystery H: partition. When in WINRE the system picks up the C: partition as H: for some odd reason.
Next steps for me are to complete the drive checks over night and cold boot later tomorrow to see if we have fixed the issues.
The prior post had been updated with step numbers.
Run HD Tune: (free edition) (test all drives)
https://www.hdtune.com/
Post images of test results for these tabs:
a) Health (SMART)
b) Benchmark
c) Full error scan
I haven't run HD Tune but last night I didn't get a BSOD so I think it may be resolved. I will test it today and at the end of the day if it hasn't blue screened then I will list the things that have been changed. I have a feeling that removing Gigabyte's overclocking software has resolved the issue.
So, I haven’t had a single BSOD for 5 days now. Below is a breakdown of what has been done so anyone with the same problem can try all this before raising a post.
* Downgrade OS back to originally installed version.
* Run IPDT.
* Run Memtest.
* Run SFC, DISM and CHKDSK. (“SFC /SCANNOW” “DISM /Online /Cleanup-Image /RestoreHealth” “CHKDSK /r /v”)
* Uninstall ANY overclocking software.
* Uninstall GlassWire and/or ANY software that monitors system, example: NZXT CAM.
* Uninstall ANY antivirus programs.
* Reinstall USB, audio, graphics, Intel ME, Intel RST and Intel chipset drivers.
* REBOOT.
* Remove over/underclock settings.
* Run Driver Verifier and then reinstalled any programs that flagged.
If the issue persists after doing the above steps, then raise a post.
A big thank you to Ztrucker and zbook for all the support.
Last edited by YouTookMyJob; 07 Nov 2018 at 06:45. Reason: Cleanup
Glad to see it sorted.
You are welcome.
Quote