BSOD Kernel Auto Boost Lock Acquisition With Raised IRQL

mudslag · 17 Jan 2019

Got 2 bsod in the last hour with the stop code: Kernel Auto Boost Lock Acquisition With Raised IRQL. Before this, I got this in the past but maybe 6 months ago. Im at a complete loss as to what is going on. It's happened when I had my work programs up and it happened when I had nothing running.

I googled the error and none of the issues related to this are something I have. I don't have a wireless adapter, bluethooth device or DNAS on the system. The BIOS is up to date and no external HD and nothing showed up with checking the disk for errors.

Iv uploaded the log collector and looking for advice. Thanks

Attachment 221203

zbook · 17 Jan 2019

See rule #4

Forum Rules - Windows 10 Help Forums

Please remove all tools used to bypass the activation of software.

mudslag · 17 Jan 2019

Im not sure what bypass tools are running, My windows is legit. Thanks

zbook · 17 Jan 2019

techsmith
corel

mudslag · 17 Jan 2019

ok Iv deleted the programs and redid and attached the log file. Thanks

zbook · 17 Jan 2019

Hi mudslag,

Welcome to the the Ten Forums BSOD forum.

Please perform the following steps:

1) Open file explorer > this PC > C: > in the right upper corner search for: C:\windows\memory.dmp > zip > post a share link into the thread using one drive, drop box, or google drive

Code:

Crash dump found at C:\WINDOWS\MEMORY.DMP
Creation date: 01/17/2019 06:25:51
Size on disk: 996 MB

2) Open administrative command prompt and type or copy and paste:
3) sfc /scannow
4) dism /online /cleanup-image /restorehealth
5) chkdsk /scan
6) wmic RecoverOS set AutoReboot = False
7) When these have completed > right click on the top bar or title bar of the administrative command prompt box > left click on edit then select all > right click on the top bar again > left click on edit then copy > paste into the thread

8) Make sure that there is no overclocking during the troubleshooting process

9) Open Ccleaner > click windows tab > scroll down to system and advanced > post an image into the thread

10) In the left lower corner search type: system or system control > open system control panel > on the left pane click advanced system settings
a) > on the advanced tab under startup and recovery > click settings > post an image of the startup and recovery window into the thread.
b) > on the advanced tab under performance > click on settings > on the performance options window > click on the advanced tab > under virtual memory > click on change > post an image of the virtual memory window into the thread

11) Update the specs in the "My Computer" section:

System Specs - Fill in at Ten Forums | Tutorials
In the left corner below in your post you find 'My System Specs'.
After clicking it you can find a link a little below that says 'Update your System Spec', click on this link to get to the page where you can fill in your system specs.
System Info - See Your System Specs - Windows 7 Help Forums

Include PSU. cooler, case, peripherals and anything attached to the computer by wired or wireless (mouse, keyboard, headset, printer, xbox, USB wireless network card, etc.)

12) Open device manager > click view > click show hidden devices > manually expand all rows > look for any row displaying a yellow triangle with black exclamation mark or unknown device > post images into the thread

Code:

VirtualBox Host-Only Ethernet Adapter	ROOT\NET\0000	This device is disabled.
ASMedia USB 3.1 eXtensible Host Controller - 1.10 (Microsoft)	PCI\VEN_1B21&DEV_1242&SUBSYS_86751043&REV_00\4&2C9BF1CA&0&00E4	43
Unknown USB Device (Device Descriptor Request Failed)	USB\VID_0000&PID_0002\5&1CC0E58A&0&7	This device is disabled.

Code:

1/15/2019 4:28 AM	Windows Error Reporting	Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: 192
P2: ffffa9888f313080
P3: ffffa98885d08648
P4: 2
P5: 0
P6: 10_0_17134
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\011419-14609-01.dmp
\\?\C:\WINDOWS\TEMP\WER-21187-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6CCF.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6CE0.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6CDF.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6CFF.tmp.txt

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_192_f6f0494bc98320d863f25421347f9515582be29_00000000_cab_2f74de3a

Analysis symbol: 
Rechecking for solution: 0
Report Id: 394c76ef-1521-4296-b57f-f7596049cf96
Report Status: 2049
Hashed bucket: 
Cab Guid: 0
1/15/2019 4:27 AM	Windows Error Reporting	Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: 192
P2: ffffa9888f313080
P3: ffffa98885d08648
P4: 2
P5: 0
P6: 10_0_17134
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\011419-14609-01.dmp
\\?\C:\WINDOWS\TEMP\WER-21187-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6CCF.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6CE0.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6CDF.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6CFF.tmp.txt

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_192_f6f0494bc98320d863f25421347f9515582be29_00000000_03c86cf2

Analysis symbol: 
Rechecking for solution: 0
Report Id: 394c76ef-1521-4296-b57f-f7596049cf96
Report Status: 4
Hashed bucket: 
Cab Guid: 0
11/28/2018 3:31 AM	Windows Error Reporting	Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: 192
P2: ffffab8f9014c080
P3: ffffab8f8060a648
P4: 2
P5: 0
P6: 10_0_17134
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\112718-13156-01.dmp
\\?\C:\WINDOWS\TEMP\WER-19468-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER678A.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER67AA.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER67D8.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6837.tmp.txt

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_192_3d7fbfe08be54a42af2e837fea5ca33dc97597_00000000_cab_2518aac6

Analysis symbol: 
Rechecking for solution: 0
Report Id: 7ab73f53-4515-4648-a0af-889daefe67ef
Report Status: 2049
Hashed bucket: 
Cab Guid: 0
11/28/2018 3:30 AM	Windows Error Reporting	Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: 192
P2: ffffab8f9014c080
P3: ffffab8f8060a648
P4: 2
P5: 0
P6: 10_0_17134
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\112718-13156-01.dmp
\\?\C:\WINDOWS\TEMP\WER-19468-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER678A.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER67AA.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER67D8.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6837.tmp.txt

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_192_3d7fbfe08be54a42af2e837fea5ca33dc97597_00000000_03b4682f

Analysis symbol: 
Rechecking for solution: 0
Report Id: 7ab73f53-4515-4648-a0af-889daefe67ef
Report Status: 4
Hashed bucket: 
Cab Guid: 0
1/2/2019 12:19 AM	Windows Error Reporting	Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: 192
P2: ffffde80f27da080
P3: ffffde80e8ddd648
P4: 2
P5: 0
P6: 10_0_17134
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\010119-12234-01.dmp
\\?\C:\WINDOWS\TEMP\WER-19140-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER612F.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6140.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER613F.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER614F.tmp.txt

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_192_c011822ce4bde1968947115b16c19f71cb8736ab_00000000_cab_2ab4b40d

Analysis symbol: 
Rechecking for solution: 0
Report Id: a213b311-877a-48a0-bf9a-dbc1f00dadfa
Report Status: 2049
Hashed bucket: 
Cab Guid: 0
1/2/2019 12:19 AM	Windows Error Reporting	Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: 192
P2: ffffde80f27da080
P3: ffffde80e8ddd648
P4: 2
P5: 0
P6: 10_0_17134
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\010119-12234-01.dmp
\\?\C:\WINDOWS\TEMP\WER-19140-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER612F.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6140.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER613F.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER614F.tmp.txt

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_192_c011822ce4bde1968947115b16c19f71cb8736ab_00000000_03c8613a

Analysis symbol: 
Rechecking for solution: 0
Report Id: a213b311-877a-48a0-bf9a-dbc1f00dadfa
Report Status: 4
Hashed bucket: 
Cab Guid: 0

1) The above was the initial post before the piracy was seen.

2) The second zip displayed deletion of the memory dump file.

3) Windows driver verifer is a tool used to find misbehaving drivers.

4) Do not use the tool until it is communicated in the thread.

5) Before using the tool perform the following steps:

a) Make a backup image using Macrium
Macrium Software | Your Image is Everything

b) Save the backup image to another drive or to the cloud

c) Make a brand new restore point
Create System Restore Point in Windows 10 | Tutorials

d) Learn the methods to turn off and recover from using the tool

Enable and Disable Driver Verifier in Windows 10 | Tutorials

6) The customized simultaneous tests may be modified.

7) Plan to use the tool for 48 hours.
And then an additional 36 hours after the last BSOD.

8) After each BSOD:
a) Post a BETA zip
b) Post a zipped memory dump (C:\windows\memory.dmp) if the file size is < 1.5 GB

9) Uninstall Drop Box > reinstall Drop Box

10) Find a flash drive that you can format ( > or = 8 GB)

11) Create a bootable Windows 10 iso:
Download Windows 10
Download Windows 10 ISO File | Tutorials

Code:

Event[6338]:
  Log Name: Application
  Source: DbxSvc
  Date: 2019-01-17T13:56:25.663
  Event ID: 300
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: DESKTOP-UA4AM8J
  Description: 
ReadEventLog failed: (1500) The event log file is corrupted.

mudslag · 18 Jan 2019

Im having trouble finding the memory.dmp, it's not showing up when I search for it.

Here is the command prompt output

Microsoft Windows [Version 10.0.17134.523]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\WINDOWS\system32>sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.

C:\WINDOWS\system32>dism /online /cleanup-image /restorehealth

Deployment Image Servicing and Management tool
Version: 10.0.17134.1

Image Version: 10.0.17134.523

[==========================100.0%==========================] The restore operation completed successfully.
The operation completed successfully.

C:\WINDOWS\system32>chkdsk /scan
The type of the file system is NTFS.
Volume label is Evo 850.

Stage 1: Examining basic file system structure ...
931840 file records processed.
File verification completed.
17676 large file records processed.
0 bad file records processed.

Stage 2: Examining file name linkage ...
2140 reparse records processed.
1092624 index entries processed.
Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered to lost and found.
2140 reparse records processed.

Stage 3: Examining security descriptors ...
Security descriptor verification completed.
80393 data files processed.
CHKDSK is verifying Usn Journal...
35547424 USN bytes processed.
Usn Journal verification completed.

Windows has scanned the file system and found no problems.
No further action is required.

487805951 KB total disk space.
286035568 KB in 624505 files.
346624 KB in 80394 indexes.
0 KB in bad sectors.
1056031 KB in use by the system.
65536 KB occupied by the log file.
200367728 KB available on disk.

4096 bytes in each allocation unit.
121951487 total allocation units on disk.
50091932 allocation units available on disk.

C:\WINDOWS\system32>wmic RecoverOS set AutoReboot = False
Updating property(s) of '\\DESKTOP-UA4AM8J\ROOT\CIMV2:Win32_OSRecoveryConfiguration.Name="Microsoft Windows 10 Pro|C:\\WINDOWS|\\Device\\Harddisk0\\Partition4"'
Property(s) update successful.

C:\WINDOWS\system32>

Attachment 221303
Attachment 221304
Attachment 221305

I believe the USB is a plantronics USB headset that is showing that error
Attachment 221306

zbook · 18 Jan 2019

1) For Ccleaner uncheck:
a) Memory Dumps
b) Windows Log Files

2) The memory dump was displayed in the first zip and image in post #6.
It is likely that Ccleaner was ran as the memory dump file disappeared in the second zip

Code:

Crash dump found at C:\WINDOWS\MEMORY.DMP
Creation date: 01/17/2019 06:25:51
Size on disk: 996 MB

Code:

Crash dump found at C:\WINDOWS\Minidump
Creation date: 01/17/2019 06:25:54
Size on disk: 0 MB
C:\WINDOWS\Memory.dmp was not found

3) Open administrative command prompt and type or copy and paste: chkdsk /r /v C:
Run this command on all drives using the syntax: chkdsk /r /v C: or chkdsk /r /v D: or chkdsk /r /v E: etc.
This command may take many hours so plan to run the windows drive overnight.
The other drives can be run at any time.

Code:

------------------------
Disk & DVD/CD-ROM Drives
------------------------
      Drive: C:
 Free Space: 189.5 GB
Total Space: 476.4 GB
File System: NTFS
      Model: Samsung SSD 850 EVO 500GB

      Drive: D:
 Free Space: 177.8 GB
Total Space: 488.4 GB
File System: NTFS
      Model: NVMe Samsung SSD 950

      Drive: E:
 Free Space: 1369.4 GB
Total Space: 1907.6 GB
File System: NTFS
      Model: WDC WD20EFRX-68EUZN0

      Drive: F:
 Free Space: 141.1 GB
Total Space: 143.1 GB
File System: NTFS
      Model: WDC WD1500HLFS-01G6U0

      Drive: H:
 Free Space: 50.7 GB
Total Space: 114.5 GB
File System: NTFS
      Model: Samsung SSD 840 Series

C:\WINDOWS\system32>chkdsk /r /v C:
The type of the file system is NTFS.
Cannot lock current drive.

Chkdsk cannot run because the volume is in use by another
process. Would you like to schedule this volume to be
checked the next time the system restarts? (Y/N)

Type: Y
reboot

4) Use the text and images in this link to find the chkdsk reports in the event viewer > copy and paste > notepad > post share links into the thread

Read Chkdsk Log in Event Viewer in Windows 10 | Tutorials

5) Use these links to fix the yellow triangles with black exclamation marks or unknown devices:
https://www.howtogeek.com/193798/how...evice-manager/
How to easily find drivers for Unknown Devices in Windows | PCWorld

6) Did you want to upgrade to Windows 1809 or remain with 1803?

7) List all non-Microsoft antivirus software (always on and manual) that had been installed or uninstalled since the last successful Windows upgrade.

8) List all non-Microsoft firewall software that had been installed or uninstalled since the last successful Windows upgrade.

9) List all non-Microsoft drive encryption software that had been installed or uninstalled since the last successful Windows upgrade.

10) Uninstall Grand Theft Auto > reinstall grand theft auto

11) The command in the earlier post changed startup and recovery system failure.
The Windows default setting is with automatically restart checked.
Automatically restart is now unchecked.
When automatically restart is checked it can be easy to miss BSOD.
When there is a BSOD with automatically restart unchecked you should see a BSOD window with bugcheck and : (
Sometimes you may see a misbehaving driver in the form *.sys
At the very beginning of a BSOD you may see a % counter.
If you see the % counter allow it to rise to 100% before rebooting so that there is sufficient time for dump file creation.

mudslag · 19 Jan 2019

Chkdsk share link

chkdsk - Google Drive

I did chkdsk for C drive first and both times it shows up as Wininit in event viewer. Also both times on reboot it says it's checking/repairing and gets stuck at 14% for like 20 mins then completes.

Im also having trouble fixing the usb (device descriptor requested failed) in device mngr. I think it's linked to my Plantronics. If I uninstall it and plug my headset in, it pops up again.

6. I thought I was on the latest windows version. If not I have no issue upgrading, just not sure what I need to do to do it.

7. I had avast but have since uninstalled, otherwise I just use windows defender

8/9. none

Iv had 2 crashes in the last 24 hrs. On one of those crashes, I had what seemed like a video card error, on the attempted restart I got this static screen. Iv never had that happen before and not sure if it was some random glitch or some new issue that's happening. Im monitoring my video card temps to make sure no heating issue but that happened a few hrs ago so Ill need time to monitor it. Thanks again for all the help you're providing.

https://i.imgur.com/uVRDcGZ.jpg

zbook · 19 Jan 2019

For several drives the chkdsk report displayed cleaning.

On the Windows drive it displayed:

Code:

CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.

Windows has made corrections to the file system.

When the chkdsk switches are run the displayed % generally rises to a low level in the teens until it completes the scan, fix, and recovery.

There were three unknown devices in the prior image of device manager.
One had a yellow triangle with black exclamation mark.
Were two of the three able to be fixed using the links?

Problems with drivers or unknown entries in device manager can interfere with windows upgrades.

If the Plantronics hardware and unknown entry can be removed then this hardware/driver may be able to be troubleshooted after the windows upgrade.

The Windows 10 iso that was created in step #11 will be used for the Windows upgrade.

Were you able to uninstall and reinstall each drop box and grand theft auto?
Were you able to make a brand new restore point and a backup image using Macrium?

For Windows driver verifier the link has information on how to turn off and recover from using the tool.
To open the Windows advanced troubleshooting menu you can:
a) use the power menu click restart while holding down the shift key
b) use administrative command prompt and type: shutdown /r /o /f /t 00

When using Windows driver verifier after each BSOD you will need to use the Windows advanced troubleshooting menu to turn off the tool to return to the desktop. On the desktop you will uninstall or uninstall and reinstall drivers. Then the tool will be restarted to find the next misbehaving driver.

Become familiar with each of the methods to turn off the tool:
Enable and Disable Driver Verifier in Windows 10 | Tutorials

If there are spontaneous BSOD they can be debugged.
If there are no spontaneous BSOD or if the BSOD debugging does not display misbehaving drivers the windows driver verifier tool can be used to create more frequent BSOD for debugging.

Once you have made a backup image using Macrium and have saved the image to another drive or cloud, made a brand new restore point and are comfortable with the Windows advanced troubleshooting menu you can turn on the tool.

Run the applicable Avast uninstall tool to make sure that there are no residual files in the registry:
Avast Uninstall Utility | Download aswClear for Avast Removal

Boot into Safe Mode on Windows 10 | Tutorials

BSOD are most commonly caused by:
a) misbehaving software and hardware drivers
b) malfunctioning hardware

Dump files are needed to workup the BSOD crashes.

For any BSOD:
a) Run the BETA log collector > post a new zip into the thread
b) Open file explorer > this PC > C: > in the right upper corner search for: C:\windows\memory.dmp > if the file size is < 1.5 GB the zip and post a share link into the thread using one drive, drop box, or google drive