BSOD: My PC has gone crazy  

Win 10 Pro ver: 1909 (Compilation SO 18363.535)
Good night.
A pleasure to greet you all.
About 6 months ago I mounted the PC, everything has gone perfect: Rendering with After Effects, Davinci, etc ... everything perfect.

Daily work with Photoshop, stack files, hard processes, everything perfect.

3 days ago all the problems began.

I started BSOD when I played TESO (The Elder Scroll Online)

It started to happen constantly.

Yesterday format the computer, install windows in clean, and today the PC has literally gone crazy.

It has given me a BSOD when I was in the recovery part of windows when the system boots.

There was a moment that I was not able to enter windows, or do anything.
So I put the memory without the XMP profile, now run to 2400


I have updated all the drivers, windows.
I have passed the Eset thoroughly.
I have passed the kaspersky tdsskiller, Kaspersky removal tool online, SuperantiSpyware.
Eset found two infected files in the game Sekiro.
This game has given me a BSOD too.

I leave the link to the file.

https://mega.nz/#!NM8R0AgA!YHAJhdiaw...pSQ41AcE3wrFXQ


I thank you infinitely for your help.

Hello and welcome to TenForums.

I need to ask you where did you get your version of Windows from and how was it activated? We can't help unless we know everything on your PC is legitimate. See Forum rule no 4.

According to one of the crash dumps, ESET is to blame:
The KMODE_EXCEPTION_NOT_HANDLED bug check has a value of 0x0000001E. This indicates that a kernel-mode program generated an exception which the error handler did not catch.
1st parameter = 0xc00005 - A memory access violation occurred. (Parameter 4 of the bug check is the address that the driver attempted to access.)

Code:

Microsoft (R) Windows Debugger Version 10.0.19528.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\mrpep\AppData\Local\Temp\Temp1_DESKTOP-IPMRF1S-(2020-01-14_23-03-44).zip\Crash Dumps\011420-28906-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*
Symbol search path is: srv*
Executable search path is: 
Windows 10 Kernel Version 18362 MP (16 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
18362.1.amd64fre.19h1_release.190318-1202
Machine Name:
Kernel base = 0xfffff802`2d800000 PsLoadedModuleList = 0xfffff802`2dc48130
Debug session time: Tue Jan 14 13:43:54.186 2020 (UTC + 1:00)
System Uptime: 0 days 0:00:31.836
Loading Kernel Symbols
...............................................................
................................................................
.......................................................
Loading User Symbols
Loading unloaded module list
.......
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff802`2d9c14e0 48894c2408      mov     qword ptr [rsp+8],rcx ss:fffff209`73108a10=000000000000001e
11: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8022fae8042, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.Sec
    Value: 5

    Key  : Analysis.DebugAnalysisProvider.CPP
    Value: Create: 8007007e on DESKTOP-QO9C72C

    Key  : Analysis.DebugData
    Value: CreateObject

    Key  : Analysis.DebugModel
    Value: CreateObject

    Key  : Analysis.Elapsed.Sec
    Value: 11

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 71

    Key  : Analysis.System
    Value: CreateObject


ADDITIONAL_XML: 1

BUGCHECK_CODE:  1e

BUGCHECK_P1: ffffffffc0000005

BUGCHECK_P2: fffff8022fae8042

BUGCHECK_P3: 0

BUGCHECK_P4: ffffffffffffffff

READ_ADDRESS: fffff8022dd733b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff8022dc2a3c8: Unable to get Flags value from nt!KdVersionBlock
fffff8022dc2a3c8: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
 ffffffffffffffff 

EXCEPTION_PARAMETER2:  ffffffffffffffff

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  svchost.exe

STACK_TEXT:  
fffff209`73108a08 fffff802`2da2fda7 : 00000000`0000001e ffffffff`c0000005 fffff802`2fae8042 00000000`00000000 : nt!KeBugCheckEx
fffff209`73108a10 fffff802`2d9d341d : ffff988b`b3461470 ffff0006`bf8c0001 00000000`00000000 00000000`00000000 : nt!KiDispatchException+0x1689d7
fffff209`731090c0 fffff802`2d9cf1a2 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0x11d
fffff209`731092a0 fffff802`2fae8042 : ffffae89`b6ace570 fffff209`00000000 ffffae89`00000001 ffffae89`b69fc0b8 : nt!KiGeneralProtectionFault+0x322
fffff209`73109430 fffff802`2fae7b2a : ffffae89`b69fc060 ffffae89`b69fc060 ffffae89`b69fc060 fffff209`73109510 : FLTMGR!GetContextFromStreamList+0x62
fffff209`731094a0 fffff802`396f52da : ffffae89`b69fc060 fffff209`731095a8 ffffae89`adfe0010 ffffae89`b05fcc00 : FLTMGR!FltGetStreamHandleContext+0x4a
fffff209`731094e0 ffffae89`b69fc060 : fffff209`731095a8 ffffae89`adfe0010 ffffae89`b05fcc00 ffffae89`bfa9c080 : eamonm+0x152da
fffff209`731094e8 fffff209`731095a8 : ffffae89`adfe0010 ffffae89`b05fcc00 ffffae89`bfa9c080 fffff802`396e6a68 : 0xffffae89`b69fc060
fffff209`731094f0 ffffae89`adfe0010 : ffffae89`b05fcc00 ffffae89`bfa9c080 fffff802`396e6a68 fffff209`00000004 : 0xfffff209`731095a8
fffff209`731094f8 ffffae89`b05fcc00 : ffffae89`bfa9c080 fffff802`396e6a68 fffff209`00000004 00000000`00000000 : 0xffffae89`adfe0010
fffff209`73109500 ffffae89`bfa9c080 : fffff802`396e6a68 fffff209`00000004 00000000`00000000 ffffae89`b5ccac30 : 0xffffae89`b05fcc00
fffff209`73109508 fffff802`396e6a68 : fffff209`00000004 00000000`00000000 ffffae89`b5ccac30 fffff209`731095e9 : 0xffffae89`bfa9c080
fffff209`73109510 fffff209`00000004 : 00000000`00000000 ffffae89`b5ccac30 fffff209`731095e9 ffffae89`adfe0198 : eamonm+0x6a68
fffff209`73109518 00000000`00000000 : ffffae89`b5ccac30 fffff209`731095e9 ffffae89`adfe0198 fffff802`2fae4a5c : 0xfffff209`00000004


SYMBOL_NAME:  eamonm+152da

MODULE_NAME: eamonm

IMAGE_NAME:  eamonm.sys

STACK_COMMAND:  .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET:  152da

FAILURE_BUCKET_ID:  0x1E_c0000005_R_eamonm!unknown_function

OS_VERSION:  10.0.18362.1

BUILDLAB_STR:  19h1_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {9e653097-789d-213d-ce1d-4d3af41e6bd3}

Followup:     MachineOwner
---------

11: kd> .load pde
=========================================================================================
 PDE v11.3 - Copyright 2017 Andrew Richards
=========================================================================================
11: kd> !dpx
Start memory scan  : 0xfffff20973108a08 ($csp)
End memory scan    : 0xfffff2097310a000 (Kernel Stack Base)

0xfffff20973108a20 : 0xfffff8022fae8042 : FLTMGR!GetContextFromStreamList+0x62
0xfffff20973108aa8 : 0xfffff8022fc43592 : CI!CipQueryPolicyInformation+0x42
0xfffff20973108ab0 : 0xfffff20973109758 : 0xfffff8022d831f79 : nt!IofCallDriver+0x59
0xfffff20973108b08 : 0xfffff8022d839cf0 : nt!ExAcquirePushLockSharedEx
0xfffff20973108b38 : 0xfffff8022fae8042 : FLTMGR!GetContextFromStreamList+0x62
0xfffff20973108b68 : 0xffff988bb528d970 :  !da ""Advapi  ""
0xfffff20973108b98 : 0xfffff8022d872659 : nt!SepAccessCheck+0x319
0xfffff20973108ba0 : 0xffff988bb528d970 :  !da ""Advapi  ""
0xfffff20973108ba8 : 0xffff988bb528d970 :  !da ""Advapi  ""
0xfffff20973108cf8 : 0xfffff8022d870f57 : nt!SeAccessCheckWithHintWithAdminlessChecks+0x3d7
0xfffff20973108e08 : 0xfffff8022de1e431 : nt!SeOpenObjectAuditAlarmWithTransaction+0xe1
0xfffff20973108e98 : 0xfffff8022d8c6e34 : nt!RtlGetExtendedContextLength2+0x3c
0xfffff20973108ea8 : 0xfffff8022d86e951 : nt!SeAccessCheck+0xd1
0xfffff20973108ed8 : 0xfffff8022d8c6d2d : nt!RtlGetExtendedContextLength+0x2d
0xfffff20973108f38 : 0xfffff8022de27ddf : nt!CmpWalkOneLevel+0x44f
0xfffff20973108f70 : 0xfffff20973109758 : 0xfffff8022d831f79 : nt!IofCallDriver+0x59
0xfffff20973108fb8 : 0xfffff8022d891d02 : nt!KiUnstackDetachProcess+0x172
0xfffff209731090b8 : 0xfffff8022d9d341d : nt!KiExceptionDispatch+0x11d
0xfffff20973109208 : 0xfffff8022fae8042 : FLTMGR!GetContextFromStreamList+0x62
0xfffff20973109268 : 0xfffff8022dc6a3c0 : nt!MiSystemPartition
0xfffff20973109298 : 0xfffff8022d9cf1a2 : nt!KiGeneralProtectionFault+0x322
0xfffff209731092f8 : 0xfffff8022d839cf0 : nt!ExAcquirePushLockSharedEx
0xfffff20973109398 : 0xfffff8022fc43592 : CI!CipQueryPolicyInformation+0x42
0xfffff209731093a0 : 0xfffff20973109758 : 0xfffff8022d831f79 : nt!IofCallDriver+0x59
0xfffff209731093b8 : 0xfffff8022d839ddd : nt!ExAcquirePushLockSharedEx+0xed
0xfffff209731093e8 : 0xfffff8022d839ddd : nt!ExAcquirePushLockSharedEx+0xed
0xfffff20973109408 : 0xfffff8022fae8042 : FLTMGR!GetContextFromStreamList+0x62
0xfffff20973109498 : 0xfffff8022fae7b2a : FLTMGR!FltGetStreamHandleContext+0x4a
*** WARNING: Unable to verify timestamp for eamonm.sys
0xfffff20973109538 : 0xfffff8022fae4a5c : FLTMGR!FltpPerformPreCallbacks+0x2fc
0xfffff20973109578 : 0xfffff8022d851b54 : nt!MiFinishMdlForMappedFileFault+0x1c4
0xfffff20973109648 : 0xfffff8022fae45a0 : FLTMGR!FltpPassThroughInternal+0x90
0xfffff20973109678 : 0xfffff8022fae4112 : FLTMGR!FltpPassThrough+0x162
0xfffff209731096f8 : 0xfffff8022fae3efe : FLTMGR!FltpDispatch+0x9e
0xfffff20973109708 : 0xfffff8022d87a4a8 : nt!MiResolveProtoPteFault+0xaf8
0xfffff20973109758 : 0xfffff8022d831f79 : nt!IofCallDriver+0x59
0xfffff20973109768 : 0xfffff8022d85463b : nt!IopSetDriverFlagsExtension+0x13
0xfffff20973109798 : 0xfffff8022d854223 : nt!IoPageReadEx+0x1d3
0xfffff20973109808 : 0xfffff8022d88e055 : nt!MiIssueHardFaultIo+0xc1
0xfffff20973109858 : 0xfffff8022d88d7a9 : nt!MiIssueHardFault+0x489
0xfffff20973109878 : 0xfffff8022d874ef6 : nt!MiUnlockWorkingSetShared+0x66
0xfffff20973109958 : 0xfffff8022d872fab : nt!MmAccessFault+0x40b
0xfffff20973109ab8 : 0xfffff8022ddf6900 : nt!NtQueryKey+0x700
0xfffff20973109af0 : 0xfffff20973109b80 :  !du "gramData"
0xfffff20973109af8 : 0xfffff8022d9cf520 : nt!KiPageFault+0x360
0xfffff20973109b00 : 0xffffae89bfa9c080 :  Trap @ fffff20973109b00
0xfffff20973109b80 : 0x006d006100720067 :  !du "gramData"

11: kd> lmvm eamonm
Browse full module list
start             end                 module name
fffff802`396e0000 fffff802`39704000   eamonm   T (no symbols)           
    Loaded symbol image file: eamonm.sys
    Image path: \SystemRoot\system32\DRIVERS\eamonm.sys
    Image name: eamonm.sys
    Browse all global symbols  functions  data
    Timestamp:        Thu Oct  3 11:21:28 2019 (5D95BD98)
    CheckSum:         000313C1
    ImageSize:        00024000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:

So it's worth updating to the latest version
The MEMORY_MANAGEMENT bug check has a value of 0x0000001A. This indicates that a severe memory management error occurred.
1st parameter = 0x3470 - unknown bugcheck (I have already reported feedback to Microsoft)

Code:

Microsoft (R) Windows Debugger Version 10.0.19528.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\mrpep\AppData\Local\Temp\Temp1_DESKTOP-IPMRF1S-(2020-01-14_23-03-44).zip\Crash Dumps\011420-29468-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*
Symbol search path is: srv*
Executable search path is: 
Windows 10 Kernel Version 18362 MP (16 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
18362.1.amd64fre.19h1_release.190318-1202
Machine Name:
Kernel base = 0xfffff806`56400000 PsLoadedModuleList = 0xfffff806`56848130
Debug session time: Tue Jan 14 19:07:15.616 2020 (UTC + 1:00)
System Uptime: 0 days 0:04:48.270
Loading Kernel Symbols
...............................................................
................................................................
................................................................

Loading User Symbols
Loading unloaded module list
........
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff806`565c14e0 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:fffff68f`98369810=000000000000001a
10: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000003470, The subtype of the bugcheck.
Arg2: fffff68f9c341000
Arg3: ff06ccffffd2f584
Arg4: 3f06ccffffd2f584

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.Sec
    Value: 4

    Key  : Analysis.DebugAnalysisProvider.CPP
    Value: Create: 8007007e on DESKTOP-QO9C72C

    Key  : Analysis.DebugData
    Value: CreateObject

    Key  : Analysis.DebugModel
    Value: CreateObject

    Key  : Analysis.Elapsed.Sec
    Value: 5

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 73

    Key  : Analysis.System
    Value: CreateObject


ADDITIONAL_XML: 1

BUGCHECK_CODE:  1a

BUGCHECK_P1: 3470

BUGCHECK_P2: fffff68f9c341000

BUGCHECK_P3: ff06ccffffd2f584

BUGCHECK_P4: 3f06ccffffd2f584

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  svchost.exe

STACK_TEXT:  
fffff68f`98369808 fffff806`56609a98 : 00000000`0000001a 00000000`00003470 fffff68f`9c341000 ff06ccff`ffd2f584 : nt!KeBugCheckEx
fffff68f`98369810 fffff806`5646a0aa : 00000000`00000012 fffff68f`98369900 00000000`00000001 00000000`00000000 : nt!MmCreateKernelStack+0x19d888
fffff68f`983698b0 fffff806`56469f6c : fffff806`5b363260 fffff68f`98369aa8 00001000`8408ac01 00000100`00000000 : nt!KiExpandKernelStackAndCalloutOnStackSegment+0xca
fffff68f`98369950 fffff806`56469de3 : fffff68f`98369be0 fffff68f`98369cb0 00000000`00000000 fffff68f`98369ea8 : nt!KiExpandKernelStackAndCalloutSwitchStack+0xdc
fffff68f`983699c0 fffff806`56469d9d : fffff806`5b363260 fffff68f`98369aa8 00000000`00000001 ffff8903`8e395a18 : nt!KeExpandKernelStackAndCalloutInternal+0x33
fffff68f`98369a30 fffff806`5b351690 : ffff8903`8e395a18 ffff8903`8f0d4a30 fffff68f`98369b20 ffff8903`8f0d4a30 : nt!KeExpandKernelStackAndCalloutEx+0x1d
fffff68f`98369a70 fffff806`5b350229 : fffff68f`98369b20 ffff8903`8e395a18 00000000`062ef000 00000000`062ee000 : Ntfs!NtfsMultipleAsync+0x110
fffff68f`98369ae0 fffff806`5b356e58 : fffff68f`98369f80 00000000`00008000 00000000`00000001 ffff8903`8f0d4a30 : Ntfs!NtfsNonCachedIo+0x3f9
fffff68f`98369d90 fffff806`5b35641c : fffff68f`9836b168 ffff8903`8f0d4a30 fffff68f`9836b168 ffff8903`8e395a18 : Ntfs!NtfsCommonRead+0x828
fffff68f`98369f50 fffff806`56431f79 : ffff8903`92ab0010 ffff8903`8f0d4a30 ffff8903`8f0d4e60 ffff8903`83ecad00 : Ntfs!NtfsFsdRead+0x20c
fffff68f`9836a010 fffff806`5a8e55de : 00000000`00000000 fffff68f`9836a0f0 ffff8903`8f0d4a30 fffff68f`9836a100 : nt!IofCallDriver+0x59
fffff68f`9836a050 fffff806`5a8e3f16 : fffff68f`9836a0f0 fffff806`5647a4a8 fffff68f`9836a201 ffffe48f`01041770 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x15e
fffff68f`9836a0d0 fffff806`56431f79 : ffff8903`8f0d4a30 fffff806`56454321 ffff8903`8417da80 00000000`00000000 : FLTMGR!FltpDispatch+0xb6
fffff68f`9836a130 fffff806`56454223 : 00000000`00000000 ffff8903`8f0d4a30 ffff8903`8e9851d0 ffff8903`8e985290 : nt!IofCallDriver+0x59
fffff68f`9836a170 fffff806`5648e055 : ffff8903`8e985180 00000000`00000000 ffff8903`8e9851e0 ffff8903`8e9851a0 : nt!IoPageReadEx+0x1d3
fffff68f`9836a1e0 fffff806`5648d7a9 : 00000000`00000002 fffff68f`9836a2c0 fffff68f`9836a428 fffff806`56474ef6 : nt!MiIssueHardFaultIo+0xc1
fffff68f`9836a230 fffff806`56472fab : 00000000`c0033333 00000000`00000000 ffffa004`1f9ae000 ffffa004`1f9ae000 : nt!MiIssueHardFault+0x489
fffff68f`9836a330 fffff806`5647fe23 : ffff8903`7d9ee928 00000030`64555410 00000000`0000001d 00000000`00000000 : nt!MmAccessFault+0x40b
fffff68f`9836a4d0 fffff806`5647eb0d : fffff68f`9836a7c8 00000000`00000003 00000000`00000014 fffff68f`9836aa18 : nt!MmCheckCachedPageStates+0x1243
fffff68f`9836a6d0 fffff806`56a1f1f4 : ffff8903`00000001 00000000`00000001 fffff68f`9836a701 fffff68f`00000000 : nt!CcMapAndRead+0xdd
fffff68f`9836a730 fffff806`5b445a98 : ffff8903`7d9ee928 ffff8903`92ce3a78 ffff8903`84161180 00000000`00011c00 : nt!CcMapData+0x94
fffff68f`9836a7a0 fffff806`5b4456af : 00000000`00000000 ffffffff`ffffffff fffff68f`9836a9d0 fffff806`56433294 : Ntfs!NtfsReadMftRecord+0xf8
fffff68f`9836a8b0 fffff806`5b44529c : 00000000`00000000 00000000`00000000 00000000`000000e0 00000000`000000c0 : Ntfs!NtfsReadFileRecord+0xcf
fffff68f`9836a9c0 fffff806`5b443ca5 : ffffe48f`0c8805a0 fffff68f`9836b430 ffffe48f`0c8805a8 fffff806`5640204f : Ntfs!NtfsLookupInFileRecord+0x7c
fffff68f`9836aa70 fffff806`5b431742 : fffff68f`9836b190 ffffe48f`0c8805a4 00000000`00000000 ffffe48f`0c8805a0 : Ntfs!NtfsUpdateFcbInfoFromDisk+0x115
fffff68f`9836ac10 fffff806`5b455129 : ffffe48f`031b47c0 fffff68f`9836b190 fffff68f`9836b430 00000000`00000000 : Ntfs!NtfsOpenFile+0x462
fffff68f`9836aed0 fffff806`5b457ffe : ffff8903`92ce3a78 fffff68f`9836b190 ffff8903`92ce3a78 ffff8903`8f28b8a0 : Ntfs!NtfsCommonCreate+0x979
fffff68f`9836b0c0 fffff806`56431f79 : ffff8903`84161030 ffff8903`8f28b8a0 ffff8903`7efd3000 ffff8903`8410d010 : Ntfs!NtfsFsdCreate+0x1fe
fffff68f`9836b2f0 fffff806`5a8e55de : ffff8903`8f28b8a0 ffff8903`8f28bd00 ffff8903`8f28b8a0 ffff8903`91aab350 : nt!IofCallDriver+0x59
fffff68f`9836b330 fffff806`5a91cd27 : fffff68f`9836b3f0 00000000`00000110 00000000`00000001 00000000`00000000 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x15e
fffff68f`9836b3b0 fffff806`56431f79 : 00000000`00000000 fffff806`569e5b05 00000000`00000000 00000000`00000000 : FLTMGR!FltpCreate+0x307
fffff68f`9836b460 fffff806`56431024 : 00000000`00000003 00000000`00000000 00000000`00000000 fffff806`564317e3 : nt!IofCallDriver+0x59
fffff68f`9836b4a0 fffff806`569e61eb : fffff68f`9836b760 fffff806`569e5b05 fffff68f`9836b6d0 ffff8903`8b2307b0 : nt!IoCallDriverWithTracing+0x34
fffff68f`9836b4f0 fffff806`569ed1bf : ffff8903`83ebe8f0 ffff8903`83ebe805 ffff8903`93b8e3e0 00000000`00000001 : nt!IopParseDevice+0x62b
fffff68f`9836b660 fffff806`569eb621 : ffff8903`93b8e300 fffff68f`9836b8a8 00000000`00000040 ffff8903`7d316140 : nt!ObpLookupObjectName+0x78f
fffff68f`9836b820 fffff806`56a30df0 : 00000000`00000001 000000ad`c1b7e238 00000000`00000001 00000000`00000000 : nt!ObOpenObjectByNameEx+0x201
fffff68f`9836b960 fffff806`56a305b9 : 000000ad`c1b7e1e0 0041006c`c0100080 000000ad`c1b7e238 000000ad`c1b7e1f8 : nt!IopCreateFile+0x820
fffff68f`9836ba00 fffff806`565d2d18 : 00000000`0000046c 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtCreateFile+0x79
fffff68f`9836ba90 00007ffa`0a23cb64 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
000000ad`c1b7e168 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`0a23cb64


SYMBOL_NAME:  nt!MmCreateKernelStack+19d888

MODULE_NAME: nt

IMAGE_VERSION:  10.0.18362.535

STACK_COMMAND:  .thread ; .cxr ; kb

IMAGE_NAME:  memory_corruption

BUCKET_ID_FUNC_OFFSET:  19d888

FAILURE_BUCKET_ID:  0x1a_3470_nt!MmCreateKernelStack

OS_VERSION:  10.0.18362.1

BUILDLAB_STR:  19h1_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {256772af-f873-c222-8342-d7891b60cf7b}

Followup:     MachineOwner
---------

10: kd> .load pde
=========================================================================================
 PDE v11.3 - Copyright 2017 Andrew Richards
=========================================================================================
10: kd> !dpx
Start memory scan  : 0xfffff68f98369808 ($csp)
End memory scan    : 0xfffff68f9836c000 (Kernel Stack Base)

0xfffff68f983698a8 : 0xfffff8065646a0aa : nt!KiExpandKernelStackAndCalloutOnStackSegment+0xca
0xfffff68f983698f8 : 0xfffff8065b351d99 : Ntfs!NtfsPrepareSimpleBuffers+0x359
0xfffff68f98369908 : 0xfffff8065b363260 : Ntfs!NtfsStorageDriverCallout
0xfffff68f98369938 : 0xfffff68f98369950 : 0xfffff8065b363260 : Ntfs!NtfsStorageDriverCallout
0xfffff68f98369948 : 0xfffff80656469f6c : nt!KiExpandKernelStackAndCalloutSwitchStack+0xdc
0xfffff68f98369950 : 0xfffff8065b363260 : Ntfs!NtfsStorageDriverCallout
0xfffff68f98369978 : 0xfffff8065b36405b : Ntfs!NtfsMapUserBufferNoRaise+0x4b
0xfffff68f983699a0 : 0xfffff8065b363260 : Ntfs!NtfsStorageDriverCallout
0xfffff68f983699b8 : 0xfffff80656469de3 : nt!KeExpandKernelStackAndCalloutInternal+0x33
0xfffff68f98369a28 : 0xfffff80656469d9d : nt!KeExpandKernelStackAndCalloutEx+0x1d
0xfffff68f98369a30 : 0xfffff8065b363260 : Ntfs!NtfsStorageDriverCallout
0xfffff68f98369a68 : 0xfffff8065b351690 : Ntfs!NtfsMultipleAsync+0x110
0xfffff68f98369ad8 : 0xfffff8065b350229 : Ntfs!NtfsNonCachedIo+0x3f9
0xfffff68f98369d38 : 0xfffff8065a8e7bd2 : FLTMGR!FltGetStreamContext+0x42
0xfffff68f98369d88 : 0xfffff8065b356e58 : Ntfs!NtfsCommonRead+0x828
0xfffff68f98369e98 : 0xfffff8065646b53d : nt!KeQueryCurrentStackInformationEx+0x6d
0xfffff68f98369f48 : 0xfffff8065b35641c : Ntfs!NtfsFsdRead+0x20c
0xfffff68f9836a008 : 0xfffff80656431f79 : nt!IofCallDriver+0x59
0xfffff68f9836a048 : 0xfffff8065a8e55de : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x15e
0xfffff68f9836a0c8 : 0xfffff8065a8e3f16 : FLTMGR!FltpDispatch+0xb6
0xfffff68f9836a0d8 : 0xfffff8065647a4a8 : nt!MiResolveProtoPteFault+0xaf8
0xfffff68f9836a128 : 0xfffff80656431f79 : nt!IofCallDriver+0x59
0xfffff68f9836a138 : 0xfffff80656454321 : nt!MmIsFileObjectAPagingFile+0x59
0xfffff68f9836a168 : 0xfffff80656454223 : nt!IoPageReadEx+0x1d3
0xfffff68f9836a1d8 : 0xfffff8065648e055 : nt!MiIssueHardFaultIo+0xc1
0xfffff68f9836a228 : 0xfffff8065648d7a9 : nt!MiIssueHardFault+0x489
0xfffff68f9836a248 : 0xfffff80656474ef6 : nt!MiUnlockWorkingSetShared+0x66
0xfffff68f9836a328 : 0xfffff80656472fab : nt!MmAccessFault+0x40b
0xfffff68f9836a3e8 : 0xfffff80656439c1d : nt!ExAcquirePushLockExclusiveEx+0xed
0xfffff68f9836a488 : 0xfffff8065640ca6f : nt!MmMapViewInSystemCache+0x2bf
0xfffff68f9836a578 : 0xfffff80656439302 : nt!ExAcquireFastMutex+0xe2
0xfffff68f9836a598 : 0xfffff8065643a614 : nt!ExReleaseFastMutex+0x44
0xfffff68f9836a5a8 : 0xfffff8065686a3c0 : nt!MiSystemPartition
0xfffff68f9836a5f8 : 0xfffff8065640c505 : nt!CcGetVacbMiss+0x181
0xfffff68f9836a648 : 0xfffff80656439ddd : nt!ExAcquirePushLockSharedEx+0xed
0xfffff68f9836a688 : 0xfffff8065647e90b : nt!CcGetVirtualAddress+0x33b
0xfffff68f9836a6c8 : 0xfffff8065647eb0d : nt!CcMapAndRead+0xdd
0xfffff68f9836a728 : 0xfffff80656a1f1f4 : nt!CcMapData+0x94
0xfffff68f9836a760 : 0xfffff80656400000 : "nt!SeConvertSecurityDescriptorToStringSecurityDescriptor <PERF> (nt+0x0)"
0xfffff68f9836a768 : 0xfffff80656433966 : nt!RtlpHpLfhSlotAllocate+0x126
0xfffff68f9836a798 : 0xfffff8065b445a98 : Ntfs!NtfsReadMftRecord+0xf8
0xfffff68f9836a858 : 0xffffe48f0d8ee030 :  !da "UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU..."
0xfffff68f9836a8a8 : 0xfffff8065b4456af : Ntfs!NtfsReadFileRecord+0xcf
0xfffff68f9836a8c8 : 0xfffff80656433294 : nt!ExAllocateHeapPool+0xb94
0xfffff68f9836a908 : 0xfffff80656433294 : nt!ExAllocateHeapPool+0xb94
0xfffff68f9836a9b8 : 0xfffff8065b44529c : Ntfs!NtfsLookupInFileRecord+0x7c
0xfffff68f9836aa08 : 0xfffff8065676f06d : nt!ExAllocatePoolWithTag+0x5d
0xfffff68f9836aa68 : 0xfffff8065b443ca5 : Ntfs!NtfsUpdateFcbInfoFromDisk+0x115
0xfffff68f9836aa88 : 0xfffff8065640204f : nt!RtlInsertElementGenericTableFullAvl+0xcf
0xfffff68f9836ac08 : 0xfffff8065b431742 : Ntfs!NtfsOpenFile+0x462
0xfffff68f9836aec8 : 0xfffff8065b455129 : Ntfs!NtfsCommonCreate+0x979
0xfffff68f9836aff0 : 0xffffe48f0d3284ec :  !du "Microsoft-Windows-Fault-Tolerant-Heap%4Operational.evtx"
0xfffff68f9836b0b8 : 0xfffff8065b457ffe : Ntfs!NtfsFsdCreate+0x1fe
0xfffff68f9836b198 : 0xffffe48f0d3284b0 :  !du "\Windows\System32\winevt\Logs\Microsoft-Windows-Fault-Tolerant-Heap%4Operational..."
0xfffff68f9836b1a8 : 0xffffe48f0d3284b0 :  !du "\Windows\System32\winevt\Logs\Microsoft-Windows-Fault-Tolerant-Heap%4Operational..."
0xfffff68f9836b2e8 : 0xfffff80656431f79 : nt!IofCallDriver+0x59
0xfffff68f9836b328 : 0xfffff8065a8e55de : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x15e
0xfffff68f9836b358 : 0xfffff8065a909060 : FLTMGR!WPP_GLOBAL_Control
0xfffff68f9836b390 : 0xfffff8065a909060 : FLTMGR!WPP_GLOBAL_Control
0xfffff68f9836b3a8 : 0xfffff8065a91cd27 : FLTMGR!FltpCreate+0x307
0xfffff68f9836b3e8 : 0xfffff8065a8fbc92 :  !du "$Volume"
0xfffff68f9836b458 : 0xfffff80656431f79 : nt!IofCallDriver+0x59
0xfffff68f9836b468 : 0xfffff806569e5b05 : nt!IopCheckBackupRestorePrivilege+0x115
0xfffff68f9836b498 : 0xfffff80656431024 : nt!IoCallDriverWithTracing+0x34
0xfffff68f9836b4b8 : 0xfffff806564317e3 : nt!RtlCopyUnicodeString+0x43
0xfffff68f9836b4e8 : 0xfffff806569e61eb : nt!IopParseDevice+0x62b
0xfffff68f9836b4f8 : 0xfffff806569e5b05 : nt!IopCheckBackupRestorePrivilege+0x115
0xfffff68f9836b548 : 0xffffe48f0d316e60 :  !du "HarddiskVolume4\Windows\System32\Winevt\Logs\Microsoft-Windows-Fault-Tolerant-He..."
0xfffff68f9836b618 : 0xfffff80656439ddd : nt!ExAcquirePushLockSharedEx+0xed
0xfffff68f9836b650 : 0xfffff806569e5bc0 : nt!IopParseDevice
0xfffff68f9836b658 : 0xfffff806569ed1bf : nt!ObpLookupObjectName+0x78f
0xfffff68f9836b6d8 : 0xffffe48f0d316e7e :  !du "\Windows\System32\Winevt\Logs\Microsoft-Windows-Fault-Tolerant-Heap%4Operational..."
0xfffff68f9836b718 : 0xffffe48f0d316e60 :  !du "HarddiskVolume4\Windows\System32\Winevt\Logs\Microsoft-Windows-Fault-Tolerant-He..."
0xfffff68f9836b818 : 0xfffff806569eb621 : nt!ObOpenObjectByNameEx+0x201
0xfffff68f9836b8b0 : 0xffffe48f0d316e50 :  !du "\Device\HarddiskVolume4\Windows\System32\Winevt\Logs\Microsoft-Windows-Fault-Tol..."
0xfffff68f9836b8d8 : 0xffffe48f046ce060 :  !da ""Advapi  .""
0xfffff68f9836b958 : 0xfffff80656a30df0 : nt!IopCreateFile+0x820
0xfffff68f9836b9f8 : 0xfffff80656a305b9 : nt!NtCreateFile+0x79
0xfffff68f9836ba80 : 0xfffff80656a30540 : nt!NtCreateFile
0xfffff68f9836ba88 : 0xfffff806565d2d18 : nt!KiSystemServiceCopyEnd+0x28
0xfffff68f9836baf8 : 0xfffff806565d2d18 : nt!KiSystemServiceCopyEnd+0x28
0xfffff68f9836bb00 : 0x0000022d79262480 :  Trap @ fffff68f9836bb00

@MrPepka

The logs displayed piracy for windows and non-Microsoft software.

philc43 referred to piracy in post #2.

https://www.tenforums.com/misc.php?do=showrules

No piracy or discussion of piracy allowed at all. Such as software, music, videos and other intellectual property violations (e.g. downloading youtube videos locally etc) - it is forum policy that no help shall be given to people who knowingly steal software or services.

Well, until OP can not deal with it (with this activation) I suggest closing the topic

Good afternoon.
First of all, sincerely apologize because I did not know the issue of licenses.

In the company we use Windows Enterprisa, and to see if the failures persist install win 10 Pro.

Activate it in a "non-conventional" way
I apologize.


After reading your requirement, go to the administration to buy me a win 20 pro license.

I already have it installed.
If you are so kind as to tell me the way, it will be a pleasure to upload the evidence that this is so.


Update:

After reading in multiple places that the motherboard depending on the Bios gives many problems and BSOD, I bought another motherboard.

When I bought the gigabyte auros and started the PC really the feelings I had were not good.

I bought one:

MSI X570-A Pro

@MrPepka greatly appreciate your effort and apologize for the license, I was just testing.

You recommend that I install ESET or leave Windows Defender.

We have a corporate version of Eset Cloud, and in the rest of the teams (about 40) we have not had problems.

I have serious doubts about the Gigabyte Auorus since when a BSOD came out and the system rebooted, the board was frozen with the RAM fault LED.

Bios reset to normal parameters and already started.

Thank you all and excuse the issue of the license, if you are so kind, tell me how I do to show that my team is now up to date with the licenses.

Attachment 263319

Barman58 said:

One of the main reasons that we insist on licence compliance, is because due to the changes that have to be made to the original base code, to allow the Licence requirement to be removed, there is a strong chance that the install will not "play nice" with other software.

This can mean that until the Unconventional Operating System Install is fully removed from the system, and replaced with a valid licenced copy we cannot be sure that the faults are not caused by the non standard code. Best thing is to remove and re-install the OS apply the licence to the new install, and re generate a new set of logs

The specialists here can then work on a known good system to ensure you get the best results going forward

Good afternoon.
They are its norms, and I accept them with pleasure. I will never question them. You are the specialists.
I'm sorry I didn't read all the rules, it's a language issue more than anything.

I have proceeded to change the board, and install windows from scratch. Now everything seems to be perfect.

I only have the fear of installing the Eset End Point linked to our Eset Cloud.
Thanks for your attention.