BSOD since 23/07, Critical Error Kernel Power- event ID 41

Ash123 · 27 Jul 2019

Morning/Evening All,

New to the forums here but I was really hoping someone could help me. Since the 23/07/19, my laptop has suddenly started to suffer random BSODs. It will suddenly turn off, and then attempt to turn on again every two seconds but crash again after reaching windows, before I manually turn it off. If I do so, I must leave the computer for approximately 10 minutes before it will reach windows without crashing.

If I start the laptop immediately after forcing it to end the crash-turn on cycle, it will open the BIOS in an attempt to repair itself, but will fail to do so. Whilst in the BIOS, it will not crash. However, as soon as I try to run windows 10 it will crash, which leads me to believe it is a software problem, although I have minimal experience with computers.

If I leave the laptop then restart it after 10 minutes, it will run normally again until its next crash. It has so far crashed 5 times, 4 of those during playing a game ( it was 2 different games that it occured in so I don't believe the game is causing it) and once without ( which leads me to believe the video card might not be causing it). When a game runs, the laptop has crashed anywhere between 5 to 20 minutes from running the programme, whilst it crashed without after approximately 3 hours.

I have updated video card drivers, run sfc /scannow and used windows 10 debloater in an attempt to stop this, but it has not prevented it. After using event viewer I noticed that, each time it crashes, it displays the same processes immediately prior to doing so:

Log Name: System
Source: Microsoft-Windows-Kernel-Power
Date: 27/07/2019 18:11:10
Event ID: 41
Task Category: (63)
Level: Critical
Keywords: (70368744177664),(2)
User: SYSTEM
Computer: Ash-PC
Description:
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" />
<EventID>41</EventID>
<Version>6</Version>
<Level>1</Level>
<Task>63</Task>
<Opcode>0</Opcode>
<Keywords>0x8000400000000002</Keywords>
<TimeCreated SystemTime="2019-07-27T17:11:10.322159900Z" />
<EventRecordID>71783</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>Ash-PC</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="BugcheckCode">0</Data>
<Data Name="BugcheckParameter1">0x0</Data>
<Data Name="BugcheckParameter2">0x0</Data>
<Data Name="BugcheckParameter3">0x0</Data>
<Data Name="BugcheckParameter4">0x0</Data>
<Data Name="SleepInProgress">0</Data>
<Data Name="PowerButtonTimestamp">0</Data>
<Data Name="BootAppStatus">0</Data>
<Data Name="Checkpoint">0</Data>
<Data Name="ConnectedStandbyInProgress">false</Data>
<Data Name="SystemSleepTransitionsToOn">0</Data>
<Data Name="CsEntryScenarioInstanceId">0</Data>
<Data Name="BugcheckInfoFromEFI">false</Data>
<Data Name="CheckpointStatus">0</Data>
</EventData>
</Event>

Log Name: System
Source: Microsoft-Windows-FilterManager
Date: 27/07/2019 18:11:10
Event ID: 6
Task Category: None
Level: Information
Keywords:
User: SYSTEM
Computer: Ash-PC
Description:
File System Filter 'npsvctrig' (10.0, ‎2094‎-‎02‎-‎20T11:14:30.000000000Z) has successfully loaded and registered with Filter Manager.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-FilterManager" Guid="{F3C5E28E-63F6-49C7-A204-E48A1BC4B09D}" />
<EventID>6</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2019-07-27T17:11:10.285430400Z" />
<EventRecordID>71782</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>Ash-PC</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="FinalStatus">0x0</Data>
<Data Name="DeviceVersionMajor">10</Data>
<Data Name="DeviceVersionMinor">0</Data>
<Data Name="DeviceNameLength">9</Data>
<Data Name="DeviceName">npsvctrig</Data>
<Data Name="DeviceTime">2094-02-20T11:14:30.000000000Z</Data>
</EventData>
</Event>

Log Name: System
Source: Microsoft-Windows-FilterManager
Date: 27/07/2019 18:11:10
Event ID: 6
Task Category: None
Level: Information
Keywords:
User: SYSTEM
Computer: Ash-PC
Description:
File System Filter 'BdSpy' (6.3, ‎2015‎-‎09‎-‎23T09:06:40.000000000Z) has successfully loaded and registered with Filter Manager.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-FilterManager" Guid="{F3C5E28E-63F6-49C7-A204-E48A1BC4B09D}" />
<EventID>6</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2019-07-27T17:11:10.212179400Z" />
<EventRecordID>71781</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>Ash-PC</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="FinalStatus">0x0</Data>
<Data Name="DeviceVersionMajor">6</Data>
<Data Name="DeviceVersionMinor">3</Data>
<Data Name="DeviceNameLength">5</Data>
<Data Name="DeviceName">BdSpy</Data>
<Data Name="DeviceTime">2015-09-23T09:06:40.000000000Z</Data>
</EventData>
</Event>

Log Name: System
Source: Microsoft-Windows-FilterManager
Date: 27/07/2019 18:11:10
Event ID: 6
Task Category: None
Level: Information
Keywords:
User: SYSTEM
Computer: Ash-PC
Description:
File System Filter 'BdAgent' (10.0, ‎2016‎-‎05‎-‎17T10:30:50.000000000Z) has successfully loaded and registered with Filter Manager.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-FilterManager" Guid="{F3C5E28E-63F6-49C7-A204-E48A1BC4B09D}" />
<EventID>6</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2019-07-27T17:11:10.208957000Z" />
<EventRecordID>71780</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>Ash-PC</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="FinalStatus">0x0</Data>
<Data Name="DeviceVersionMajor">10</Data>
<Data Name="DeviceVersionMinor">0</Data>
<Data Name="DeviceNameLength">7</Data>
<Data Name="DeviceName">BdAgent</Data>
<Data Name="DeviceTime">2016-05-17T10:30:50.000000000Z</Data>
</EventData>
</Event>

Log Name: System
Source: Microsoft-Windows-FilterManager
Date: 27/07/2019 18:11:10
Event ID: 6
Task Category: None
Level: Information
Keywords:
User: SYSTEM
Computer: Ash-PC
Description:
File System Filter 'FileCrypt' (10.0, ‎2070‎-‎12‎-‎16T00:13:56.000000000Z) has successfully loaded and registered with Filter Manager.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-FilterManager" Guid="{F3C5E28E-63F6-49C7-A204-E48A1BC4B09D}" />
<EventID>6</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2019-07-27T17:11:10.203850800Z" />
<EventRecordID>71779</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>Ash-PC</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="FinalStatus">0x0</Data>
<Data Name="DeviceVersionMajor">10</Data>
<Data Name="DeviceVersionMinor">0</Data>
<Data Name="DeviceNameLength">9</Data>
<Data Name="DeviceName">FileCrypt</Data>
<Data Name="DeviceTime">2070-12-16T00:13:56.000000000Z</Data>
</EventData>
</Event>

These same events have occured during exactly the same second each time it has crashed. Right now I am unsure how to solve the problem. I am half-convinced that it was a windows update that has gone wrong but, due to my poor contingency planning, I haven't got a restore point anywhere near this date and so cannot try to restore my laptop to before it. Please let me know if any of you require any further information, and I will try to provide it as best I can. Any help will be gratefully appreciated and thank you in advance to all who reply.

Kind Regards
Ash

zbook · 27 Jul 2019

Hi Ash123 ,

Welcome to the Ten Forums BSOD forum.

1) Update the specs in the "My Computer" section:

System Specs - Fill in at Ten Forums
In the left corner below in your post you find 'My System Specs'.
After clicking it you can find a link a little below that says 'Update your System Spec', click on this link to get to the page where you can fill in your system specs.
System Info - See Your System Specs - Windows 7 Help Forums

Include PSU. cooler, case, peripherals and anything attached to the computer by wired or wireless (mouse, keyboard, headset, printer, xbox, USB wireless network card, etc.)

2) Open the website for the notebook manufacturer > enter the product or serial number or model > select the operating system > view drivers > post a URL or hyperlink into the thread

3) Create a new restore point:
Create System Restore Point in Windows 10

4) Make a backup image using Macrium:
Macrium Software | Your Image is Everything

5) Save the backup image to another disk drive or to the cloud ( not another partition on the same drive)

6) The Windows build is 17134 or 1803.
a) Were there failed upgrades?
b) Had you blocked upgrades?
c) Had you troubleshooted failure to upgrade?
d) Do you want to upgrade to 1903 or 1809?

7) Open administrative command prompt and type or copy and paste:
8) sfc /scannow
9) dism /online /cleanup-image /restorehealth
10) chkdsk /scan
11) wmic recoveros set autoreboot = false
12) Powercfg -h off
13) When these have completed > right click on the top bar or title bar of the administrative command prompt box > left click on edit then select all > right click on the top bar again > left click on edit then copy > paste into the thread

14) In the left lower corner search type: system or system control > open system control panel > on the left pane click advanced system settings

a) > on the advanced tab under startup and recovery > click settings > post an image of the startup and recovery window into the thread

b) > on the advanced tab under performance > click on settings > on the performance options window > click on the advanced tab > under virtual memory > click on change > post an image of the virtual memory window into the thread

15) If the computer has Ccleaner (do not install the software if it is not already installed) > click windows tab > scroll down to system and advanced > post an image into the thread

16) Run memtest86+ version 5.01 for at least 8 passes.
Memtest86+ - Advanced Memory Diagnostic Tool

This may take hours so plan to run it overnight.

a) Please make sure you use the Memtest86+ version 5.01 with the link below.
Memtest86+ - Advanced Memory Diagnostic Tool

The testing is done not by time but by passes.
The more passes the better the testing conditions.

There are a significant number of false negatives if fewer than 8 passes are made.
A false negative is a test pass when there is malfunctioning RAM.

There is 16 GB of RAM on the computer.
Memtest86+ version 5.01 testing takes approximately 1 - 2 hours /GB RAM

Just 1 error is a fail and you can abort testing.
Then test 1 RAM module at a time in the same DIMM each for 8 or more passes.

b) When Memtest86+ version 5.01 has completed 8 or more passes use a camera or smart phone camera to take a picture and post an image into the thread.

https://answers.microsoft.com/en-us/...f-ecc7b7ff6461

MemTest86+ - Test RAM

17) Read these links on Windows driver verifier: (do not use the tool until it is communicated in the thread)
Enable and Disable Driver Verifier in Windows 10
https://answers.microsoft.com/en-us/...3-c48669e4c983

18) For any BSOD:

a) run the V2 log collector to collect new log files

b) open file explorer> this PC > C: > in the right upper corner search for: C:\Windows\memory.dmp
> if the file size is < 1.5 GB then zip > post a separate share link into the thread using one drive, drop box, or google drive

19) Open disk management > by default some columns are compressed > widen each Status and Volume > make sure the contents within the parenthesis are in full view and that none of the characters are cutoff > view disk 0 > widen this row as needed so that all of the characters are in full view > post an image into the thread
Disk Management - How to Post a Screenshot of

20) List all non-Microsoft antivirus software
(This includes always on and manual software.)

21) List all non-Microsoft firewall software

22) List all Microsoft and non-Microsoft drive encryption software.

23) Download and install: Everything
https://www.voidtools.com/

24) Launch the application > search for: NDIS-20190721-1622.dmp > zip > post a share link into the thread using one drive, drop box, or google drive

Code:

Name                   LastWriteTime       Size (MB)
----                   -------------       ---------
NDIS-20190721-1622.dmp 21/07/2019 16:22:41   1669.59

Code:

Event[6124]:
  Log Name: System
  Source: Microsoft-Windows-StartupRepair
  Date: 2019-07-27T08:36:59.321
  Event ID: 1121
  Task: N/A
  Level: Information
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: Ash-PC
  Description: 
The following file necessary for Windows start-up was corrupt: c:\efi\microsoft\boot\resources\custom\bootres.dll

Code:

Event[6174]:
  Log Name: System
  Source: volmgr
  Date: 2019-07-27T08:51:50.822
  Event ID: 161
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: Ash-PC
  Description: 
Dump file creation failed due to error during dump creation.

Code:

Event[5001]:
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2019-07-24T23:59:30.820
  Event ID: 16
  Task: N/A
  Level: Error
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: Ash-PC
  Description: 
Windows failed to resume from hibernate with error status 0xC0000411.

Code:

27/07/2019 07:52	Windows Error Reporting	Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: c2
P2: 7
P3: 63526442
P4: 4110002
P5: ffffc10cfa8c0f00
P6: 10_0_17134
P7: 0_0
P8: 768_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\072719-8406-01.dmp
\\?\C:\WINDOWS\TEMP\WER-35671-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD9A6.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD9D6.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERDA23.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERDD22.tmp.txt

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_c2_ebf2ba253851b44d4cbf7f1bb13d5e60484d98e9_00000000_cab_2e9ce4b2

Analysis symbol: 
Rechecking for solution: 0
Report Id: ae1649ca-c466-4b15-b7e5-b662eeaa2844
Report Status: 2049
Hashed bucket: 
Cab Guid: 0
27/07/2019 07:52	Windows Error Reporting	Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: c2
P2: 7
P3: 63526442
P4: 4110002
P5: ffffc10cfa8c0f00
P6: 10_0_17134
P7: 0_0
P8: 768_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\072719-8406-01.dmp
\\?\C:\WINDOWS\TEMP\WER-35671-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD9A6.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD9D6.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERDA23.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERDD22.tmp.txt

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_c2_ebf2ba253851b44d4cbf7f1bb13d5e60484d98e9_00000000_03a4dd21

Analysis symbol: 
Rechecking for solution: 0
Report Id: ae1649ca-c466-4b15-b7e5-b662eeaa2844
Report Status: 4
Hashed bucket: 
Cab Guid: 0

Ash123 · 28 Jul 2019

zbook,

Thank you very much for your reply. I am sorry I haven't posted back but my system has crashed 3 times today, each within about 10 minutes of turning on, so I have been unable to complete any of your list now. I will update as I complete them, and attach the latest V2 log after the crash.

Kind Regards
Ash

Edit 1:
1) Completed as best I can.
2) PCSPECIALIST - Login
3) Completed
4) Completed
5) Completed
6) I have used windows update to check but it says that my system is not ready for the update and it will roll out once it is. However, it provides no warning or troubleshoot option, merely telling me that no action needs to be taken at this time.
20+ 21) Bullguard home protection and malwarebytes free.

edit 2:
7-9) Completed:
Microsoft Windows [Version 10.0.17134.915]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\WINDOWS\system32>sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.

C:\WINDOWS\system32>dism /online /clean-up imamge /restorehealth

Error: 87

DISM doesn't recognize the command-line option "imamge".
For more information, refer to the help by running DISM.exe /?.

The DISM log file can be found at C:\WINDOWS\Logs\DISM\dism.log

C:\WINDOWS\system32>dism /online /cleanup-image /restorehealth

Deployment Image Servicing and Management tool
Version: 10.0.17134.1

Image Version: 10.0.17134.915

[==========================100.0%==========================] The restore operation completed successfully.
The operation completed successfully.

C:\WINDOWS\system32>

I will do 10-12 as soon as I am able

zbook · 28 Jul 2019

1) Place the computer in safe mode, safe mode with command prompt, or safe mode with networking:
Boot into Safe Mode on Windows 10

2) Most of the steps in the prior post can be performed in safe mode.

3) Please comment if there are any BSOD while in safe mode

4) Uninstall Bullguard using the applicable uninstall tool:
Uninstall BullGuard Desktop Protection - Uninstall - BullGuard

5) Uninstall Malwarebytes using the applicable uninstall tool:
https://downloads.malwarebytes.com/file/mb_clean

6) Make sure Windows defender is on

7) Find a flash drive that you can format (> or = 8 GB)

8) Create a bootable Windows 10 iso 1903:
https://www.microsoft.com/en-us/soft...load/windows10
Download Windows 10 ISO File

9) Sometimes there are problems in the bios that produce bsod.

The BIOS: Version/Date American Megatrends Inc. 4.6.5, 14/02/2014

10) Please check to see if this is the most up to date version.

Ash123 · 29 Jul 2019

Zbook,

Thankyou very much for your reply. In relation to your first post, I have carried out steps 10-22 (apart from step 15, I will attempt to leave it running with this tonight). The screenshots are attached. I have also uninstalled the programmes detailed above. Unfortunately, as my laptop is a custom built from PCSpecialist, they do not provide BIOS updates anywhere easily accessible. I will phoen them today and see if there are any updates.

Kind Regards
AshAttachment 241603 Attachment 241604

zbook · 29 Jul 2019

When available please post an image of the results for Mem86+ version 5.0.

Indicate whether the computer is / was in safe mode (time duration) and whether the computer was stable or had crashes (unexpected shutdowns / restarts).