BSOD: My PC has gone crazy  


  1. Posts : 22
    WIN 10 PRO
       #1

    BSOD: My PC has gone crazy


    Win 10 Pro ver: 1909 (Compilation SO 18363.535)
    Good night.
    A pleasure to greet you all.
    About 6 months ago I mounted the PC, everything has gone perfect: Rendering with After Effects, Davinci, etc ... everything perfect.

    Daily work with Photoshop, stack files, hard processes, everything perfect.

    3 days ago all the problems began.

    I started BSOD when I played TESO (The Elder Scroll Online)

    It started to happen constantly.

    Yesterday format the computer, install windows in clean, and today the PC has literally gone crazy.

    It has given me a BSOD when I was in the recovery part of windows when the system boots.

    There was a moment that I was not able to enter windows, or do anything.
    So I put the memory without the XMP profile, now run to 2400


    I have updated all the drivers, windows.
    I have passed the Eset thoroughly.
    I have passed the kaspersky tdsskiller, Kaspersky removal tool online, SuperantiSpyware.
    Eset found two infected files in the game Sekiro.
    This game has given me a BSOD too.

    I leave the link to the file.

    https://mega.nz/#!NM8R0AgA!YHAJhdiaw...pSQ41AcE3wrFXQ


    I thank you infinitely for your help.
      My Computer


  2. Posts : 5,169
    64bit Win 10 Pro ver 21H2
       #2

    Hello and welcome to TenForums.

    I need to ask you where did you get your version of Windows from and how was it activated? We can't help unless we know everything on your PC is legitimate. See Forum rule no 4.
      My Computers


  3. Posts : 1,538
    Windows 8.1 Enterprise x64
       #3

    According to one of the crash dumps, ESET is to blame:
    The KMODE_EXCEPTION_NOT_HANDLED bug check has a value of 0x0000001E. This indicates that a kernel-mode program generated an exception which the error handler did not catch.
    1st parameter = 0xc00005 - A memory access violation occurred. (Parameter 4 of the bug check is the address that the driver attempted to access.)
    Code:
    Microsoft (R) Windows Debugger Version 10.0.19528.1000 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [C:\Users\mrpep\AppData\Local\Temp\Temp1_DESKTOP-IPMRF1S-(2020-01-14_23-03-44).zip\Crash Dumps\011420-28906-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    
    ************* Path validation summary **************
    Response                         Time (ms)     Location
    Deferred                                       srv*
    Symbol search path is: srv*
    Executable search path is: 
    Windows 10 Kernel Version 18362 MP (16 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    18362.1.amd64fre.19h1_release.190318-1202
    Machine Name:
    Kernel base = 0xfffff802`2d800000 PsLoadedModuleList = 0xfffff802`2dc48130
    Debug session time: Tue Jan 14 13:43:54.186 2020 (UTC + 1:00)
    System Uptime: 0 days 0:00:31.836
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    .......................................................
    Loading User Symbols
    Loading unloaded module list
    .......
    For analysis of this file, run !analyze -v
    nt!KeBugCheckEx:
    fffff802`2d9c14e0 48894c2408      mov     qword ptr [rsp+8],rcx ss:fffff209`73108a10=000000000000001e
    11: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    KMODE_EXCEPTION_NOT_HANDLED (1e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Arguments:
    Arg1: ffffffffc0000005, The exception code that was not handled
    Arg2: fffff8022fae8042, The address that the exception occurred at
    Arg3: 0000000000000000, Parameter 0 of the exception
    Arg4: ffffffffffffffff, Parameter 1 of the exception
    
    Debugging Details:
    ------------------
    
    
    KEY_VALUES_STRING: 1
    
        Key  : Analysis.CPU.Sec
        Value: 5
    
        Key  : Analysis.DebugAnalysisProvider.CPP
        Value: Create: 8007007e on DESKTOP-QO9C72C
    
        Key  : Analysis.DebugData
        Value: CreateObject
    
        Key  : Analysis.DebugModel
        Value: CreateObject
    
        Key  : Analysis.Elapsed.Sec
        Value: 11
    
        Key  : Analysis.Memory.CommitPeak.Mb
        Value: 71
    
        Key  : Analysis.System
        Value: CreateObject
    
    
    ADDITIONAL_XML: 1
    
    BUGCHECK_CODE:  1e
    
    BUGCHECK_P1: ffffffffc0000005
    
    BUGCHECK_P2: fffff8022fae8042
    
    BUGCHECK_P3: 0
    
    BUGCHECK_P4: ffffffffffffffff
    
    READ_ADDRESS: fffff8022dd733b8: Unable to get MiVisibleState
    Unable to get NonPagedPoolStart
    Unable to get NonPagedPoolEnd
    Unable to get PagedPoolStart
    Unable to get PagedPoolEnd
    fffff8022dc2a3c8: Unable to get Flags value from nt!KdVersionBlock
    fffff8022dc2a3c8: Unable to get Flags value from nt!KdVersionBlock
    unable to get nt!MmSpecialPagesInUse
     ffffffffffffffff 
    
    EXCEPTION_PARAMETER2:  ffffffffffffffff
    
    CUSTOMER_CRASH_COUNT:  1
    
    PROCESS_NAME:  svchost.exe
    
    STACK_TEXT:  
    fffff209`73108a08 fffff802`2da2fda7 : 00000000`0000001e ffffffff`c0000005 fffff802`2fae8042 00000000`00000000 : nt!KeBugCheckEx
    fffff209`73108a10 fffff802`2d9d341d : ffff988b`b3461470 ffff0006`bf8c0001 00000000`00000000 00000000`00000000 : nt!KiDispatchException+0x1689d7
    fffff209`731090c0 fffff802`2d9cf1a2 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0x11d
    fffff209`731092a0 fffff802`2fae8042 : ffffae89`b6ace570 fffff209`00000000 ffffae89`00000001 ffffae89`b69fc0b8 : nt!KiGeneralProtectionFault+0x322
    fffff209`73109430 fffff802`2fae7b2a : ffffae89`b69fc060 ffffae89`b69fc060 ffffae89`b69fc060 fffff209`73109510 : FLTMGR!GetContextFromStreamList+0x62
    fffff209`731094a0 fffff802`396f52da : ffffae89`b69fc060 fffff209`731095a8 ffffae89`adfe0010 ffffae89`b05fcc00 : FLTMGR!FltGetStreamHandleContext+0x4a
    fffff209`731094e0 ffffae89`b69fc060 : fffff209`731095a8 ffffae89`adfe0010 ffffae89`b05fcc00 ffffae89`bfa9c080 : eamonm+0x152da
    fffff209`731094e8 fffff209`731095a8 : ffffae89`adfe0010 ffffae89`b05fcc00 ffffae89`bfa9c080 fffff802`396e6a68 : 0xffffae89`b69fc060
    fffff209`731094f0 ffffae89`adfe0010 : ffffae89`b05fcc00 ffffae89`bfa9c080 fffff802`396e6a68 fffff209`00000004 : 0xfffff209`731095a8
    fffff209`731094f8 ffffae89`b05fcc00 : ffffae89`bfa9c080 fffff802`396e6a68 fffff209`00000004 00000000`00000000 : 0xffffae89`adfe0010
    fffff209`73109500 ffffae89`bfa9c080 : fffff802`396e6a68 fffff209`00000004 00000000`00000000 ffffae89`b5ccac30 : 0xffffae89`b05fcc00
    fffff209`73109508 fffff802`396e6a68 : fffff209`00000004 00000000`00000000 ffffae89`b5ccac30 fffff209`731095e9 : 0xffffae89`bfa9c080
    fffff209`73109510 fffff209`00000004 : 00000000`00000000 ffffae89`b5ccac30 fffff209`731095e9 ffffae89`adfe0198 : eamonm+0x6a68
    fffff209`73109518 00000000`00000000 : ffffae89`b5ccac30 fffff209`731095e9 ffffae89`adfe0198 fffff802`2fae4a5c : 0xfffff209`00000004
    
    
    SYMBOL_NAME:  eamonm+152da
    
    MODULE_NAME: eamonm
    
    IMAGE_NAME:  eamonm.sys
    
    STACK_COMMAND:  .thread ; .cxr ; kb
    
    BUCKET_ID_FUNC_OFFSET:  152da
    
    FAILURE_BUCKET_ID:  0x1E_c0000005_R_eamonm!unknown_function
    
    OS_VERSION:  10.0.18362.1
    
    BUILDLAB_STR:  19h1_release
    
    OSPLATFORM_TYPE:  x64
    
    OSNAME:  Windows 10
    
    FAILURE_ID_HASH:  {9e653097-789d-213d-ce1d-4d3af41e6bd3}
    
    Followup:     MachineOwner
    ---------
    
    11: kd> .load pde
    =========================================================================================
     PDE v11.3 - Copyright 2017 Andrew Richards
    =========================================================================================
    11: kd> !dpx
    Start memory scan  : 0xfffff20973108a08 ($csp)
    End memory scan    : 0xfffff2097310a000 (Kernel Stack Base)
    
    0xfffff20973108a20 : 0xfffff8022fae8042 : FLTMGR!GetContextFromStreamList+0x62
    0xfffff20973108aa8 : 0xfffff8022fc43592 : CI!CipQueryPolicyInformation+0x42
    0xfffff20973108ab0 : 0xfffff20973109758 : 0xfffff8022d831f79 : nt!IofCallDriver+0x59
    0xfffff20973108b08 : 0xfffff8022d839cf0 : nt!ExAcquirePushLockSharedEx
    0xfffff20973108b38 : 0xfffff8022fae8042 : FLTMGR!GetContextFromStreamList+0x62
    0xfffff20973108b68 : 0xffff988bb528d970 :  !da ""Advapi  ""
    0xfffff20973108b98 : 0xfffff8022d872659 : nt!SepAccessCheck+0x319
    0xfffff20973108ba0 : 0xffff988bb528d970 :  !da ""Advapi  ""
    0xfffff20973108ba8 : 0xffff988bb528d970 :  !da ""Advapi  ""
    0xfffff20973108cf8 : 0xfffff8022d870f57 : nt!SeAccessCheckWithHintWithAdminlessChecks+0x3d7
    0xfffff20973108e08 : 0xfffff8022de1e431 : nt!SeOpenObjectAuditAlarmWithTransaction+0xe1
    0xfffff20973108e98 : 0xfffff8022d8c6e34 : nt!RtlGetExtendedContextLength2+0x3c
    0xfffff20973108ea8 : 0xfffff8022d86e951 : nt!SeAccessCheck+0xd1
    0xfffff20973108ed8 : 0xfffff8022d8c6d2d : nt!RtlGetExtendedContextLength+0x2d
    0xfffff20973108f38 : 0xfffff8022de27ddf : nt!CmpWalkOneLevel+0x44f
    0xfffff20973108f70 : 0xfffff20973109758 : 0xfffff8022d831f79 : nt!IofCallDriver+0x59
    0xfffff20973108fb8 : 0xfffff8022d891d02 : nt!KiUnstackDetachProcess+0x172
    0xfffff209731090b8 : 0xfffff8022d9d341d : nt!KiExceptionDispatch+0x11d
    0xfffff20973109208 : 0xfffff8022fae8042 : FLTMGR!GetContextFromStreamList+0x62
    0xfffff20973109268 : 0xfffff8022dc6a3c0 : nt!MiSystemPartition
    0xfffff20973109298 : 0xfffff8022d9cf1a2 : nt!KiGeneralProtectionFault+0x322
    0xfffff209731092f8 : 0xfffff8022d839cf0 : nt!ExAcquirePushLockSharedEx
    0xfffff20973109398 : 0xfffff8022fc43592 : CI!CipQueryPolicyInformation+0x42
    0xfffff209731093a0 : 0xfffff20973109758 : 0xfffff8022d831f79 : nt!IofCallDriver+0x59
    0xfffff209731093b8 : 0xfffff8022d839ddd : nt!ExAcquirePushLockSharedEx+0xed
    0xfffff209731093e8 : 0xfffff8022d839ddd : nt!ExAcquirePushLockSharedEx+0xed
    0xfffff20973109408 : 0xfffff8022fae8042 : FLTMGR!GetContextFromStreamList+0x62
    0xfffff20973109498 : 0xfffff8022fae7b2a : FLTMGR!FltGetStreamHandleContext+0x4a
    *** WARNING: Unable to verify timestamp for eamonm.sys
    0xfffff20973109538 : 0xfffff8022fae4a5c : FLTMGR!FltpPerformPreCallbacks+0x2fc
    0xfffff20973109578 : 0xfffff8022d851b54 : nt!MiFinishMdlForMappedFileFault+0x1c4
    0xfffff20973109648 : 0xfffff8022fae45a0 : FLTMGR!FltpPassThroughInternal+0x90
    0xfffff20973109678 : 0xfffff8022fae4112 : FLTMGR!FltpPassThrough+0x162
    0xfffff209731096f8 : 0xfffff8022fae3efe : FLTMGR!FltpDispatch+0x9e
    0xfffff20973109708 : 0xfffff8022d87a4a8 : nt!MiResolveProtoPteFault+0xaf8
    0xfffff20973109758 : 0xfffff8022d831f79 : nt!IofCallDriver+0x59
    0xfffff20973109768 : 0xfffff8022d85463b : nt!IopSetDriverFlagsExtension+0x13
    0xfffff20973109798 : 0xfffff8022d854223 : nt!IoPageReadEx+0x1d3
    0xfffff20973109808 : 0xfffff8022d88e055 : nt!MiIssueHardFaultIo+0xc1
    0xfffff20973109858 : 0xfffff8022d88d7a9 : nt!MiIssueHardFault+0x489
    0xfffff20973109878 : 0xfffff8022d874ef6 : nt!MiUnlockWorkingSetShared+0x66
    0xfffff20973109958 : 0xfffff8022d872fab : nt!MmAccessFault+0x40b
    0xfffff20973109ab8 : 0xfffff8022ddf6900 : nt!NtQueryKey+0x700
    0xfffff20973109af0 : 0xfffff20973109b80 :  !du "gramData"
    0xfffff20973109af8 : 0xfffff8022d9cf520 : nt!KiPageFault+0x360
    0xfffff20973109b00 : 0xffffae89bfa9c080 :  Trap @ fffff20973109b00
    0xfffff20973109b80 : 0x006d006100720067 :  !du "gramData"
    
    11: kd> lmvm eamonm
    Browse full module list
    start             end                 module name
    fffff802`396e0000 fffff802`39704000   eamonm   T (no symbols)           
        Loaded symbol image file: eamonm.sys
        Image path: \SystemRoot\system32\DRIVERS\eamonm.sys
        Image name: eamonm.sys
        Browse all global symbols  functions  data
        Timestamp:        Thu Oct  3 11:21:28 2019 (5D95BD98)
        CheckSum:         000313C1
        ImageSize:        00024000
        Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
        Information from resource tables:
    So it's worth updating to the latest version
    The MEMORY_MANAGEMENT bug check has a value of 0x0000001A. This indicates that a severe memory management error occurred.
    1st parameter = 0x3470 - unknown bugcheck (I have already reported feedback to Microsoft)
    Code:
    Microsoft (R) Windows Debugger Version 10.0.19528.1000 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [C:\Users\mrpep\AppData\Local\Temp\Temp1_DESKTOP-IPMRF1S-(2020-01-14_23-03-44).zip\Crash Dumps\011420-29468-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    
    ************* Path validation summary **************
    Response                         Time (ms)     Location
    Deferred                                       srv*
    Symbol search path is: srv*
    Executable search path is: 
    Windows 10 Kernel Version 18362 MP (16 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    18362.1.amd64fre.19h1_release.190318-1202
    Machine Name:
    Kernel base = 0xfffff806`56400000 PsLoadedModuleList = 0xfffff806`56848130
    Debug session time: Tue Jan 14 19:07:15.616 2020 (UTC + 1:00)
    System Uptime: 0 days 0:04:48.270
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ................................................................
    
    Loading User Symbols
    Loading unloaded module list
    ........
    For analysis of this file, run !analyze -v
    nt!KeBugCheckEx:
    fffff806`565c14e0 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:fffff68f`98369810=000000000000001a
    10: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    MEMORY_MANAGEMENT (1a)
        # Any other values for parameter 1 must be individually examined.
    Arguments:
    Arg1: 0000000000003470, The subtype of the bugcheck.
    Arg2: fffff68f9c341000
    Arg3: ff06ccffffd2f584
    Arg4: 3f06ccffffd2f584
    
    Debugging Details:
    ------------------
    
    
    KEY_VALUES_STRING: 1
    
        Key  : Analysis.CPU.Sec
        Value: 4
    
        Key  : Analysis.DebugAnalysisProvider.CPP
        Value: Create: 8007007e on DESKTOP-QO9C72C
    
        Key  : Analysis.DebugData
        Value: CreateObject
    
        Key  : Analysis.DebugModel
        Value: CreateObject
    
        Key  : Analysis.Elapsed.Sec
        Value: 5
    
        Key  : Analysis.Memory.CommitPeak.Mb
        Value: 73
    
        Key  : Analysis.System
        Value: CreateObject
    
    
    ADDITIONAL_XML: 1
    
    BUGCHECK_CODE:  1a
    
    BUGCHECK_P1: 3470
    
    BUGCHECK_P2: fffff68f9c341000
    
    BUGCHECK_P3: ff06ccffffd2f584
    
    BUGCHECK_P4: 3f06ccffffd2f584
    
    CUSTOMER_CRASH_COUNT:  1
    
    PROCESS_NAME:  svchost.exe
    
    STACK_TEXT:  
    fffff68f`98369808 fffff806`56609a98 : 00000000`0000001a 00000000`00003470 fffff68f`9c341000 ff06ccff`ffd2f584 : nt!KeBugCheckEx
    fffff68f`98369810 fffff806`5646a0aa : 00000000`00000012 fffff68f`98369900 00000000`00000001 00000000`00000000 : nt!MmCreateKernelStack+0x19d888
    fffff68f`983698b0 fffff806`56469f6c : fffff806`5b363260 fffff68f`98369aa8 00001000`8408ac01 00000100`00000000 : nt!KiExpandKernelStackAndCalloutOnStackSegment+0xca
    fffff68f`98369950 fffff806`56469de3 : fffff68f`98369be0 fffff68f`98369cb0 00000000`00000000 fffff68f`98369ea8 : nt!KiExpandKernelStackAndCalloutSwitchStack+0xdc
    fffff68f`983699c0 fffff806`56469d9d : fffff806`5b363260 fffff68f`98369aa8 00000000`00000001 ffff8903`8e395a18 : nt!KeExpandKernelStackAndCalloutInternal+0x33
    fffff68f`98369a30 fffff806`5b351690 : ffff8903`8e395a18 ffff8903`8f0d4a30 fffff68f`98369b20 ffff8903`8f0d4a30 : nt!KeExpandKernelStackAndCalloutEx+0x1d
    fffff68f`98369a70 fffff806`5b350229 : fffff68f`98369b20 ffff8903`8e395a18 00000000`062ef000 00000000`062ee000 : Ntfs!NtfsMultipleAsync+0x110
    fffff68f`98369ae0 fffff806`5b356e58 : fffff68f`98369f80 00000000`00008000 00000000`00000001 ffff8903`8f0d4a30 : Ntfs!NtfsNonCachedIo+0x3f9
    fffff68f`98369d90 fffff806`5b35641c : fffff68f`9836b168 ffff8903`8f0d4a30 fffff68f`9836b168 ffff8903`8e395a18 : Ntfs!NtfsCommonRead+0x828
    fffff68f`98369f50 fffff806`56431f79 : ffff8903`92ab0010 ffff8903`8f0d4a30 ffff8903`8f0d4e60 ffff8903`83ecad00 : Ntfs!NtfsFsdRead+0x20c
    fffff68f`9836a010 fffff806`5a8e55de : 00000000`00000000 fffff68f`9836a0f0 ffff8903`8f0d4a30 fffff68f`9836a100 : nt!IofCallDriver+0x59
    fffff68f`9836a050 fffff806`5a8e3f16 : fffff68f`9836a0f0 fffff806`5647a4a8 fffff68f`9836a201 ffffe48f`01041770 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x15e
    fffff68f`9836a0d0 fffff806`56431f79 : ffff8903`8f0d4a30 fffff806`56454321 ffff8903`8417da80 00000000`00000000 : FLTMGR!FltpDispatch+0xb6
    fffff68f`9836a130 fffff806`56454223 : 00000000`00000000 ffff8903`8f0d4a30 ffff8903`8e9851d0 ffff8903`8e985290 : nt!IofCallDriver+0x59
    fffff68f`9836a170 fffff806`5648e055 : ffff8903`8e985180 00000000`00000000 ffff8903`8e9851e0 ffff8903`8e9851a0 : nt!IoPageReadEx+0x1d3
    fffff68f`9836a1e0 fffff806`5648d7a9 : 00000000`00000002 fffff68f`9836a2c0 fffff68f`9836a428 fffff806`56474ef6 : nt!MiIssueHardFaultIo+0xc1
    fffff68f`9836a230 fffff806`56472fab : 00000000`c0033333 00000000`00000000 ffffa004`1f9ae000 ffffa004`1f9ae000 : nt!MiIssueHardFault+0x489
    fffff68f`9836a330 fffff806`5647fe23 : ffff8903`7d9ee928 00000030`64555410 00000000`0000001d 00000000`00000000 : nt!MmAccessFault+0x40b
    fffff68f`9836a4d0 fffff806`5647eb0d : fffff68f`9836a7c8 00000000`00000003 00000000`00000014 fffff68f`9836aa18 : nt!MmCheckCachedPageStates+0x1243
    fffff68f`9836a6d0 fffff806`56a1f1f4 : ffff8903`00000001 00000000`00000001 fffff68f`9836a701 fffff68f`00000000 : nt!CcMapAndRead+0xdd
    fffff68f`9836a730 fffff806`5b445a98 : ffff8903`7d9ee928 ffff8903`92ce3a78 ffff8903`84161180 00000000`00011c00 : nt!CcMapData+0x94
    fffff68f`9836a7a0 fffff806`5b4456af : 00000000`00000000 ffffffff`ffffffff fffff68f`9836a9d0 fffff806`56433294 : Ntfs!NtfsReadMftRecord+0xf8
    fffff68f`9836a8b0 fffff806`5b44529c : 00000000`00000000 00000000`00000000 00000000`000000e0 00000000`000000c0 : Ntfs!NtfsReadFileRecord+0xcf
    fffff68f`9836a9c0 fffff806`5b443ca5 : ffffe48f`0c8805a0 fffff68f`9836b430 ffffe48f`0c8805a8 fffff806`5640204f : Ntfs!NtfsLookupInFileRecord+0x7c
    fffff68f`9836aa70 fffff806`5b431742 : fffff68f`9836b190 ffffe48f`0c8805a4 00000000`00000000 ffffe48f`0c8805a0 : Ntfs!NtfsUpdateFcbInfoFromDisk+0x115
    fffff68f`9836ac10 fffff806`5b455129 : ffffe48f`031b47c0 fffff68f`9836b190 fffff68f`9836b430 00000000`00000000 : Ntfs!NtfsOpenFile+0x462
    fffff68f`9836aed0 fffff806`5b457ffe : ffff8903`92ce3a78 fffff68f`9836b190 ffff8903`92ce3a78 ffff8903`8f28b8a0 : Ntfs!NtfsCommonCreate+0x979
    fffff68f`9836b0c0 fffff806`56431f79 : ffff8903`84161030 ffff8903`8f28b8a0 ffff8903`7efd3000 ffff8903`8410d010 : Ntfs!NtfsFsdCreate+0x1fe
    fffff68f`9836b2f0 fffff806`5a8e55de : ffff8903`8f28b8a0 ffff8903`8f28bd00 ffff8903`8f28b8a0 ffff8903`91aab350 : nt!IofCallDriver+0x59
    fffff68f`9836b330 fffff806`5a91cd27 : fffff68f`9836b3f0 00000000`00000110 00000000`00000001 00000000`00000000 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x15e
    fffff68f`9836b3b0 fffff806`56431f79 : 00000000`00000000 fffff806`569e5b05 00000000`00000000 00000000`00000000 : FLTMGR!FltpCreate+0x307
    fffff68f`9836b460 fffff806`56431024 : 00000000`00000003 00000000`00000000 00000000`00000000 fffff806`564317e3 : nt!IofCallDriver+0x59
    fffff68f`9836b4a0 fffff806`569e61eb : fffff68f`9836b760 fffff806`569e5b05 fffff68f`9836b6d0 ffff8903`8b2307b0 : nt!IoCallDriverWithTracing+0x34
    fffff68f`9836b4f0 fffff806`569ed1bf : ffff8903`83ebe8f0 ffff8903`83ebe805 ffff8903`93b8e3e0 00000000`00000001 : nt!IopParseDevice+0x62b
    fffff68f`9836b660 fffff806`569eb621 : ffff8903`93b8e300 fffff68f`9836b8a8 00000000`00000040 ffff8903`7d316140 : nt!ObpLookupObjectName+0x78f
    fffff68f`9836b820 fffff806`56a30df0 : 00000000`00000001 000000ad`c1b7e238 00000000`00000001 00000000`00000000 : nt!ObOpenObjectByNameEx+0x201
    fffff68f`9836b960 fffff806`56a305b9 : 000000ad`c1b7e1e0 0041006c`c0100080 000000ad`c1b7e238 000000ad`c1b7e1f8 : nt!IopCreateFile+0x820
    fffff68f`9836ba00 fffff806`565d2d18 : 00000000`0000046c 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtCreateFile+0x79
    fffff68f`9836ba90 00007ffa`0a23cb64 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
    000000ad`c1b7e168 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`0a23cb64
    
    
    SYMBOL_NAME:  nt!MmCreateKernelStack+19d888
    
    MODULE_NAME: nt
    
    IMAGE_VERSION:  10.0.18362.535
    
    STACK_COMMAND:  .thread ; .cxr ; kb
    
    IMAGE_NAME:  memory_corruption
    
    BUCKET_ID_FUNC_OFFSET:  19d888
    
    FAILURE_BUCKET_ID:  0x1a_3470_nt!MmCreateKernelStack
    
    OS_VERSION:  10.0.18362.1
    
    BUILDLAB_STR:  19h1_release
    
    OSPLATFORM_TYPE:  x64
    
    OSNAME:  Windows 10
    
    FAILURE_ID_HASH:  {256772af-f873-c222-8342-d7891b60cf7b}
    
    Followup:     MachineOwner
    ---------
    
    10: kd> .load pde
    =========================================================================================
     PDE v11.3 - Copyright 2017 Andrew Richards
    =========================================================================================
    10: kd> !dpx
    Start memory scan  : 0xfffff68f98369808 ($csp)
    End memory scan    : 0xfffff68f9836c000 (Kernel Stack Base)
    
    0xfffff68f983698a8 : 0xfffff8065646a0aa : nt!KiExpandKernelStackAndCalloutOnStackSegment+0xca
    0xfffff68f983698f8 : 0xfffff8065b351d99 : Ntfs!NtfsPrepareSimpleBuffers+0x359
    0xfffff68f98369908 : 0xfffff8065b363260 : Ntfs!NtfsStorageDriverCallout
    0xfffff68f98369938 : 0xfffff68f98369950 : 0xfffff8065b363260 : Ntfs!NtfsStorageDriverCallout
    0xfffff68f98369948 : 0xfffff80656469f6c : nt!KiExpandKernelStackAndCalloutSwitchStack+0xdc
    0xfffff68f98369950 : 0xfffff8065b363260 : Ntfs!NtfsStorageDriverCallout
    0xfffff68f98369978 : 0xfffff8065b36405b : Ntfs!NtfsMapUserBufferNoRaise+0x4b
    0xfffff68f983699a0 : 0xfffff8065b363260 : Ntfs!NtfsStorageDriverCallout
    0xfffff68f983699b8 : 0xfffff80656469de3 : nt!KeExpandKernelStackAndCalloutInternal+0x33
    0xfffff68f98369a28 : 0xfffff80656469d9d : nt!KeExpandKernelStackAndCalloutEx+0x1d
    0xfffff68f98369a30 : 0xfffff8065b363260 : Ntfs!NtfsStorageDriverCallout
    0xfffff68f98369a68 : 0xfffff8065b351690 : Ntfs!NtfsMultipleAsync+0x110
    0xfffff68f98369ad8 : 0xfffff8065b350229 : Ntfs!NtfsNonCachedIo+0x3f9
    0xfffff68f98369d38 : 0xfffff8065a8e7bd2 : FLTMGR!FltGetStreamContext+0x42
    0xfffff68f98369d88 : 0xfffff8065b356e58 : Ntfs!NtfsCommonRead+0x828
    0xfffff68f98369e98 : 0xfffff8065646b53d : nt!KeQueryCurrentStackInformationEx+0x6d
    0xfffff68f98369f48 : 0xfffff8065b35641c : Ntfs!NtfsFsdRead+0x20c
    0xfffff68f9836a008 : 0xfffff80656431f79 : nt!IofCallDriver+0x59
    0xfffff68f9836a048 : 0xfffff8065a8e55de : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x15e
    0xfffff68f9836a0c8 : 0xfffff8065a8e3f16 : FLTMGR!FltpDispatch+0xb6
    0xfffff68f9836a0d8 : 0xfffff8065647a4a8 : nt!MiResolveProtoPteFault+0xaf8
    0xfffff68f9836a128 : 0xfffff80656431f79 : nt!IofCallDriver+0x59
    0xfffff68f9836a138 : 0xfffff80656454321 : nt!MmIsFileObjectAPagingFile+0x59
    0xfffff68f9836a168 : 0xfffff80656454223 : nt!IoPageReadEx+0x1d3
    0xfffff68f9836a1d8 : 0xfffff8065648e055 : nt!MiIssueHardFaultIo+0xc1
    0xfffff68f9836a228 : 0xfffff8065648d7a9 : nt!MiIssueHardFault+0x489
    0xfffff68f9836a248 : 0xfffff80656474ef6 : nt!MiUnlockWorkingSetShared+0x66
    0xfffff68f9836a328 : 0xfffff80656472fab : nt!MmAccessFault+0x40b
    0xfffff68f9836a3e8 : 0xfffff80656439c1d : nt!ExAcquirePushLockExclusiveEx+0xed
    0xfffff68f9836a488 : 0xfffff8065640ca6f : nt!MmMapViewInSystemCache+0x2bf
    0xfffff68f9836a578 : 0xfffff80656439302 : nt!ExAcquireFastMutex+0xe2
    0xfffff68f9836a598 : 0xfffff8065643a614 : nt!ExReleaseFastMutex+0x44
    0xfffff68f9836a5a8 : 0xfffff8065686a3c0 : nt!MiSystemPartition
    0xfffff68f9836a5f8 : 0xfffff8065640c505 : nt!CcGetVacbMiss+0x181
    0xfffff68f9836a648 : 0xfffff80656439ddd : nt!ExAcquirePushLockSharedEx+0xed
    0xfffff68f9836a688 : 0xfffff8065647e90b : nt!CcGetVirtualAddress+0x33b
    0xfffff68f9836a6c8 : 0xfffff8065647eb0d : nt!CcMapAndRead+0xdd
    0xfffff68f9836a728 : 0xfffff80656a1f1f4 : nt!CcMapData+0x94
    0xfffff68f9836a760 : 0xfffff80656400000 : "nt!SeConvertSecurityDescriptorToStringSecurityDescriptor <PERF> (nt+0x0)"
    0xfffff68f9836a768 : 0xfffff80656433966 : nt!RtlpHpLfhSlotAllocate+0x126
    0xfffff68f9836a798 : 0xfffff8065b445a98 : Ntfs!NtfsReadMftRecord+0xf8
    0xfffff68f9836a858 : 0xffffe48f0d8ee030 :  !da "UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU..."
    0xfffff68f9836a8a8 : 0xfffff8065b4456af : Ntfs!NtfsReadFileRecord+0xcf
    0xfffff68f9836a8c8 : 0xfffff80656433294 : nt!ExAllocateHeapPool+0xb94
    0xfffff68f9836a908 : 0xfffff80656433294 : nt!ExAllocateHeapPool+0xb94
    0xfffff68f9836a9b8 : 0xfffff8065b44529c : Ntfs!NtfsLookupInFileRecord+0x7c
    0xfffff68f9836aa08 : 0xfffff8065676f06d : nt!ExAllocatePoolWithTag+0x5d
    0xfffff68f9836aa68 : 0xfffff8065b443ca5 : Ntfs!NtfsUpdateFcbInfoFromDisk+0x115
    0xfffff68f9836aa88 : 0xfffff8065640204f : nt!RtlInsertElementGenericTableFullAvl+0xcf
    0xfffff68f9836ac08 : 0xfffff8065b431742 : Ntfs!NtfsOpenFile+0x462
    0xfffff68f9836aec8 : 0xfffff8065b455129 : Ntfs!NtfsCommonCreate+0x979
    0xfffff68f9836aff0 : 0xffffe48f0d3284ec :  !du "Microsoft-Windows-Fault-Tolerant-Heap%4Operational.evtx"
    0xfffff68f9836b0b8 : 0xfffff8065b457ffe : Ntfs!NtfsFsdCreate+0x1fe
    0xfffff68f9836b198 : 0xffffe48f0d3284b0 :  !du "\Windows\System32\winevt\Logs\Microsoft-Windows-Fault-Tolerant-Heap%4Operational..."
    0xfffff68f9836b1a8 : 0xffffe48f0d3284b0 :  !du "\Windows\System32\winevt\Logs\Microsoft-Windows-Fault-Tolerant-Heap%4Operational..."
    0xfffff68f9836b2e8 : 0xfffff80656431f79 : nt!IofCallDriver+0x59
    0xfffff68f9836b328 : 0xfffff8065a8e55de : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x15e
    0xfffff68f9836b358 : 0xfffff8065a909060 : FLTMGR!WPP_GLOBAL_Control
    0xfffff68f9836b390 : 0xfffff8065a909060 : FLTMGR!WPP_GLOBAL_Control
    0xfffff68f9836b3a8 : 0xfffff8065a91cd27 : FLTMGR!FltpCreate+0x307
    0xfffff68f9836b3e8 : 0xfffff8065a8fbc92 :  !du "$Volume"
    0xfffff68f9836b458 : 0xfffff80656431f79 : nt!IofCallDriver+0x59
    0xfffff68f9836b468 : 0xfffff806569e5b05 : nt!IopCheckBackupRestorePrivilege+0x115
    0xfffff68f9836b498 : 0xfffff80656431024 : nt!IoCallDriverWithTracing+0x34
    0xfffff68f9836b4b8 : 0xfffff806564317e3 : nt!RtlCopyUnicodeString+0x43
    0xfffff68f9836b4e8 : 0xfffff806569e61eb : nt!IopParseDevice+0x62b
    0xfffff68f9836b4f8 : 0xfffff806569e5b05 : nt!IopCheckBackupRestorePrivilege+0x115
    0xfffff68f9836b548 : 0xffffe48f0d316e60 :  !du "HarddiskVolume4\Windows\System32\Winevt\Logs\Microsoft-Windows-Fault-Tolerant-He..."
    0xfffff68f9836b618 : 0xfffff80656439ddd : nt!ExAcquirePushLockSharedEx+0xed
    0xfffff68f9836b650 : 0xfffff806569e5bc0 : nt!IopParseDevice
    0xfffff68f9836b658 : 0xfffff806569ed1bf : nt!ObpLookupObjectName+0x78f
    0xfffff68f9836b6d8 : 0xffffe48f0d316e7e :  !du "\Windows\System32\Winevt\Logs\Microsoft-Windows-Fault-Tolerant-Heap%4Operational..."
    0xfffff68f9836b718 : 0xffffe48f0d316e60 :  !du "HarddiskVolume4\Windows\System32\Winevt\Logs\Microsoft-Windows-Fault-Tolerant-He..."
    0xfffff68f9836b818 : 0xfffff806569eb621 : nt!ObOpenObjectByNameEx+0x201
    0xfffff68f9836b8b0 : 0xffffe48f0d316e50 :  !du "\Device\HarddiskVolume4\Windows\System32\Winevt\Logs\Microsoft-Windows-Fault-Tol..."
    0xfffff68f9836b8d8 : 0xffffe48f046ce060 :  !da ""Advapi  .""
    0xfffff68f9836b958 : 0xfffff80656a30df0 : nt!IopCreateFile+0x820
    0xfffff68f9836b9f8 : 0xfffff80656a305b9 : nt!NtCreateFile+0x79
    0xfffff68f9836ba80 : 0xfffff80656a30540 : nt!NtCreateFile
    0xfffff68f9836ba88 : 0xfffff806565d2d18 : nt!KiSystemServiceCopyEnd+0x28
    0xfffff68f9836baf8 : 0xfffff806565d2d18 : nt!KiSystemServiceCopyEnd+0x28
    0xfffff68f9836bb00 : 0x0000022d79262480 :  Trap @ fffff68f9836bb00
      My Computer


  4. Posts : 41,291
    windows 10 professional version 1607 build 14393.969 64 bit
       #4

    @MrPepka

    The logs displayed piracy for windows and non-Microsoft software.

    philc43 referred to piracy in post #2.

    https://www.tenforums.com/misc.php?do=showrules

    No piracy or discussion of piracy allowed at all. Such as software, music, videos and other intellectual property violations (e.g. downloading youtube videos locally etc) - it is forum policy that no help shall be given to people who knowingly steal software or services.
      My Computer


  5. Posts : 1,538
    Windows 8.1 Enterprise x64
       #5

    Well, until OP can not deal with it (with this activation) I suggest closing the topic
      My Computer


  6. Posts : 22
    WIN 10 PRO
    Thread Starter
       #6

    Good afternoon.
    First of all, sincerely apologize because I did not know the issue of licenses.

    In the company we use Windows Enterprisa, and to see if the failures persist install win 10 Pro.

    Activate it in a "non-conventional" way
    I apologize.


    After reading your requirement, go to the administration to buy me a win 20 pro license.

    I already have it installed.
    If you are so kind as to tell me the way, it will be a pleasure to upload the evidence that this is so.


    Update:

    After reading in multiple places that the motherboard depending on the Bios gives many problems and BSOD, I bought another motherboard.

    When I bought the gigabyte auros and started the PC really the feelings I had were not good.

    I bought one:

    MSI X570-A Pro

    @MrPepka greatly appreciate your effort and apologize for the license, I was just testing.

    You recommend that I install ESET or leave Windows Defender.

    We have a corporate version of Eset Cloud, and in the rest of the teams (about 40) we have not had problems.

    I have serious doubts about the Gigabyte Auorus since when a BSOD came out and the system rebooted, the board was frozen with the RAM fault LED.

    Bios reset to normal parameters and already started.

    Thank you all and excuse the issue of the license, if you are so kind, tell me how I do to show that my team is now up to date with the licenses.

    Attachment 263319
      My Computer


  7. Posts : 4,201
    Windows 10 Pro x64 Latest RP
       #7

    One of the main reasons that we insist on licence compliance, is because due to the changes that have to be made to the original base code, to allow the Licence requirement to be removed, there is a strong chance that the install will not "play nice" with other software.

    This can mean that until the Unconventional Operating System Install is fully removed from the system, and replaced with a valid licenced copy we cannot be sure that the faults are not caused by the non standard code. Best thing is to remove and re-install the OS apply the licence to the new install, and re generate a new set of logs

    The specialists here can then work on a known good system to ensure you get the best results going forward
      My Computers


  8. Posts : 22
    WIN 10 PRO
    Thread Starter
       #8

    Barman58 said:
    One of the main reasons that we insist on licence compliance, is because due to the changes that have to be made to the original base code, to allow the Licence requirement to be removed, there is a strong chance that the install will not "play nice" with other software.

    This can mean that until the Unconventional Operating System Install is fully removed from the system, and replaced with a valid licenced copy we cannot be sure that the faults are not caused by the non standard code. Best thing is to remove and re-install the OS apply the licence to the new install, and re generate a new set of logs

    The specialists here can then work on a known good system to ensure you get the best results going forward

    Good afternoon.
    They are its norms, and I accept them with pleasure. I will never question them. You are the specialists.
    I'm sorry I didn't read all the rules, it's a language issue more than anything.

    I have proceeded to change the board, and install windows from scratch. Now everything seems to be perfect.

    I only have the fear of installing the Eset End Point linked to our Eset Cloud.
    Thanks for your attention.
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 02:08.
Find Us




Windows 10 Forums