Random & infrequent BSOD

Our small church has a PowerSpec computer that we use to audio record our services. The pastor got a good deal from his son-in-law for the PC.
The computer is usually left on, with only the screen blanking out after a while. It may go for weeks without problems, then BSOD or completely freeze multiple times.

Windows 10 ver 1909
I have attached the V2 log collector file.
I've been fighting this for quite a while. I formatted & reinstalled Windows in the past, but it didn't help.
I have run Windows updates. Tried to find driver updates, but may have missed some.
Used KCSoftwares SUMO to show what programs need updating, then updated manually.

Here are some of the things I have tried recently:
1. Only have keyboard, mouse, monitor, and network cable connected.
2. Link State Power Management – was already off
3. Turned Off Fast Startup
4. sfc /scannow – Didn’t find any problems
5. Reset the Winsock Catalog
6. Replaced HDD SATA cable
7. Removed CPU heat sink. Blew out dust & put on new heat sink compound.
8. BSOD again
9. Ran Seagate Sea Tools for Windows long generic test in Safe Mode with networking. Test ok.
10. Ran the following:
1. Dism /online /cleanup-image /checkhealth - No component store corruption detected.
2. Dism /online /cleanup-image /scanhealth - No component store corruption detected.
3. Dism /online /cleanup-image /restorehealth - The restore operation completed successfully.
11. MS Disk Cleanup
12. MS chkdsk /r. Found & fixed some problems, but had a BSOD overnight after that.

Thanks for any help you can give,
Ken

When you formatted and reinstalled Windows - did you install any 3rd party software?
If so, what (to the best of your recall)?

Don't run Disk Cleanup while we're troubleshooting. It may delete some needed reports.
Only 1 memory dump in the uploaded reports. It dates from January 2020
The reports say that there's also one from 20 May - can you check the C:\Windows\Minidump folder to see if it's still there? If so, zip it up and upload it with your next post (may have to copy it to the Desktop in order to zip it).

Your BIOS version P05 dates from 2011. Please:
- visit the PowerSpec support site for your system (or the ECS site for your motherboard) and see if there is a more current, stable version of the BIOS available
- check the site to determine if the system is compatible with Windows 10
- as long as you're at the site, update your chipset drivers and see if there are any updates available for drivers/software that came with the system.

Visit Windows Update and check to ensure that you have ALL available updates

Focusrite USB audio drivers date from 2016/2017.
Please disconnect/unplug the USB audio device (this is temporary) and uninstall it's software.
Test for further BSOD's.

If you need to reinstall the Focusrite software and the USB audio device, please be sure to download the latest, Windows 10 compatible version from the manufacturer's support website.
FYI - if the system isn't fully compatible w/Windows 10, then you may continue to have errors despite being fully updated.

I'm unfamiliar with the SUMO software. I use PatchMyPC for my personal computer.
Despite having used SUMO, there's a lot of drivers that need updating:

Please update these older drivers. Links are provided in order to assist you with looking up the source of the drivers.
If unable to find an update, please uninstall the program that is responsible for that driver.

DO NOT manually delete/rename the driver as it may make the system unbootable!!!:

HECIx64.sys Mon Jul 2 15:14:58 2012 (4FF21D62)
Intel Management Engine Interface Drivers & Software

nvhda64v.sys Thu Nov 28 05:38:09 2013 (52974741)
nVidia HDMI Audio Device (nForce chipset driver) Download Drivers | NVIDIA

igdkmd64.sys Thu May 19 10:45:17 2016 (573DFBAD)
Intel Graphics driver Drivers & Software

rt640x64.sys Thu Jul 14 02:04:28 2016 (5787559C)
Realtek NICDRV 8169 PCIe GBE Family Controller driver [br] http://www.realtek.com.tw/downloads/...;GetDown=false[br][br]Unofficial Realtek update site for older drivers -[br][br]https://www.realtek.cz/download-RTL8101E-network-driver-for-Windows7-64bit.html

nvlddmkm.sys Mon Nov 14 01:42:35 2016 (5829870B)
nVidia Video drivers Download Drivers | NVIDIA[br]Get from OEM for laptops

FocusriteUSBAudio.sys Thu Jun 8 05:02:21 2017 (59393CCD)
Focus Rite USB audio drivers Downloads | Customer Portal

FocusriteUSBMidi.sys Thu Jun 8 05:02:24 2017 (59393CD0)


FocusriteUSBSwRoot.sys Thu Jun 8 05:02:32 2017 (59393CD8)


FocusriteUSB.sys Thu Jun 8 05:02:38 2017 (59393CDE)

Update Realtek LAN driver - Realtek PCIe FE / GBE / 2.5G / Gaming Ethernet Family Controller Software - REALTEK

Steps / tests that were done may be repeated.

Please make sure images for all steps / tests are posted into the thread:

Take Screenshot in Windows 10
https://support.microsoft.com/en-gb/...re-screenshots
How to Upload and Post Screenshots and Files at Ten Forums

1) Open administrative command prompt and type or copy and paste:
2) sfc /scannow
3) dism /online /cleanup-image /scanhealth
4) dism /online /cleanup-image /restorehealth
5) sfc /scannow
6) chkdsk /scan
7) wmic recoveros set autoreboot = false
8) wmic recoveros set DebugInfoType = 7
9) wmic recoveros get autoreboot
10) wmic recoveros get DebugInfoType
11) bcdedit /enum {badmemory}

12) When these have completed > right click on the top bar or title bar of the administrative command prompt box > left click on edit then select all > right click on the top bar again > left click on edit then copy > paste into the thread

Use this link as needed when posting results:
How to Change Post Editor to Source or WYSIWYG Mode at TenForums.com


13) Make sure that there is no over clocking while troubleshooting

14) In the left lower corner search type: system or system control > open system control panel > on the left pane click advanced system settings

a) > on the advanced tab under startup and recovery > click settings > post an image of the startup and recovery window into the thread

b) > on the advanced tab under performance > click on settings > on the performance options window > click on the advanced tab > under virtual memory > click on change > post an image of the virtual memory window into the thread

15) If the computer has Ccleaner (do not install the software if it is not already installed) > click windows tab or custom clean > scroll down to system and advanced > post an image into the thread

16) Open administrative command prompt and type or copy and paste:
chkdsk /b /v
This may take hours to run so plan to run overnight and the next day.
Run on all drives using the syntax: chkdsk /b /v C: or chkdsk /b /v D: changing the drive letter to the applicable drive.

C:\Windows\system32>chkdsk /b /v
The type of the file system is NTFS.
Cannot lock current drive.

Chkdsk cannot run because the volume is in use by another
process. Would you like to schedule this volume to be
checked the next time the system restarts? (Y/N)

Type: Y
reboot


17) Use the information in this link to find the chkdsk report in the event viewer.
Copy and paste into notepad > save to desktop > post into the thread using one drive or drop box share link:
Read Chkdsk Log in Event Viewer in Windows 10 Windows 10 Performance Maintenance Tutorials
Read Chkdsk Log in Event Viewer in Windows 10

18) Run HD Tune (free version) (all drives)
HD Tune website
Post images into the thread for results on these tabs:
a) Health
b) Benchmark
c) Full error scan


19) Run Sea Tools for Windows
long generic test
Post an image of the test result into the thread
SeaTools for Windows |
Seagate
How to use SeaTools for Windows | Seagate Support US


20) Open disk management > by default some columns are compressed > widen each Status and Volume > make sure the contents within the parenthesis are in full view and that none of the characters are cutoff > view disk 0 > widen this row as needed so that all of the characters are in full view > post an image into the thread
Disk Management - How to Post a Screenshot of

21) Download and install Minitool Partition Wizard > click launch > post an image of the results into this thread
MiniTool Partition Wizard Free Edition - Free download and software reviews - CNET Download.com
https://www.partitionwizard.com/part...ion-magic.html
22) For any BSOD:

a) run the V2 log collector to collect new log files

b) open file explorer> this PC > C: > in the right upper corner search for: C:\Windows\memory.dmp
> if the file size is < 1.5 GB then zip > post a separate share link into the thread using one drive, drop box, or google drive

Code:

Event[76]:
  Log Name: System
  Source: Microsoft-Windows-StartupRepair
  Date: 2020-05-19T12:38:29.261
  Event ID: 1121
  Task: N/A
  Level: Information
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: PowerSpec-PC
  Description: 
The following file necessary for Windows startup was corrupt: E:\WINDOWS\system32\ntoskrnl.exe

The 0 byte file is simply that Windows tried to save a memory dump - but it wasn't able to for some reason.
How about the memory dump located at C:\Windows\MEMORY.DMP?
- What date is it?
- What size is it?
If it's a large size, try zipping it up and uploading it to a free file hosting service (I prefer OneDrive or Google Drive).
Then post a link to it here so we can download it.

The problem with a compatibility issue is that it may simply be one line of code that's incompatible. So the system sits and works perfectly until the one line of code gets called - and then all heck breaks loose.

Also, I've found (over the years) that USB sound devices are very touchy and prone to spitting out BSOD's
I haven't found much available to fix them (other than using a PCIe sound card instead).

Let's start by ensuring that all of the programs that date from 2017 (in the Word document that you attached) are fully updated. If unable to update, please uninstall them.

Then we wait and see what happens..................................

- - - Updated - - -

Just remembered the report in the Crash Dump folder that shows the dumps (doh!)
The C:\Windows\MEMORY.DMP file is from 20 May and is 754+ mB in size.
Zip it up and upload it to a free file hosting service (I prefer OneDrive or Google Drive).
Then post a link to it here so we can download it.

[Update - Came back to the PC a little while ago, and it had a BSOD - Will post another V2 log collector & Memory dump. The new BSOD didn't seem to create a new C:\Windows\MEMORY.DMP file, so I am linking the one from 05/20/20]

MEMORY.zip - Google Drive

Here are some of the test results.

The system completely froze about 8:30 a.m. on 05-25. Still had image on screen, but no response from kbd, or mouse, or when I tried to connect to it thru Teamviewer. Forced restart.

I have not uninstalled the Focusrite drivers yet, but will do that soon.

I checked for updated programs. Some I were able to update, but some of the audio codecs don't have newer versions. For those, I reinstalled them as much as possible.
Not sure if I posted earlier, but I uninstalled a few unneeded programs & have attached a new program listing from CCleaner.

Chkdsk & DISM
Microsoft Windows [Version 10.0.18363.836]
(c) 2019 Microsoft Corporation. All rights reserved.

C:\WINDOWS\system32>sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection found corrupt files and successfully repaired them.
For online repairs, details are included in the CBS log file located at
windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log. For offline
repairs, details are included in the log file provided by the /OFFLOGFILE flag.

C:\WINDOWS\system32>dism /online /cleanup-image /scanhealth

Deployment Image Servicing and Management tool
Version: 10.0.18362.1

Image Version: 10.0.18363.836

[==========================100.0%==========================] No component store corruption detected.
The operation completed successfully.

C:\WINDOWS\system32>dism /online /cleanup-image /restorehealth

Deployment Image Servicing and Management tool
Version: 10.0.18362.1

Image Version: 10.0.18363.836

[==========================100.0%==========================] The restore operation completed successfully.
The operation completed successfully.

C:\WINDOWS\system32>sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.

C:\WINDOWS\system32>chkdsk /scan
The type of the file system is NTFS.

Stage 1: Examining basic file system structure ...
809216 file records processed.
File verification completed.
8678 large file records processed.
0 bad file records processed.

Stage 2: Examining file name linkage ...
30141 reparse records processed.
936552 index entries processed.
Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered to lost and found.
30141 reparse records processed.

Stage 3: Examining security descriptors ...
Security descriptor verification completed.
63669 data files processed.
CHKDSK is verifying Usn Journal...
36497120 USN bytes processed.
Usn Journal verification completed.

Windows has scanned the file system and found no problems.
No further action is required.

1952412622 KB total disk space.
331336252 KB in 398179 files.
201760 KB in 63670 indexes.
44 KB in bad sectors.
979302 KB in use by the system.
65536 KB occupied by the log file.
1619895264 KB available on disk.

4096 bytes in each allocation unit.
488103155 total allocation units on disk.
404973816 allocation units available on disk.

C:\WINDOWS\system32>wmic recoveros set autoreboot = false
Updating property(s) of '\\POWERSPEC-PC\ROOT\CIMV2:Win32_OSRecoveryConfiguration.Name="Microsoft Windows 10 Pro|C:\\WINDOWS|\\Device\\Harddisk0\\Partition2"'
Property(s) update successful.

C:\WINDOWS\system32>wmic recoveros set DebugInfoType = 7
Updating property(s) of '\\POWERSPEC-PC\ROOT\CIMV2:Win32_OSRecoveryConfiguration.Name="Microsoft Windows 10 Pro|C:\\WINDOWS|\\Device\\Harddisk0\\Partition2"'
Property(s) update successful.

C:\WINDOWS\system32>wmic recoveros get autoreboot
AutoReboot
FALSE


C:\WINDOWS\system32>wmic recoveros get DebugInfoType
DebugInfoType
7


C:\WINDOWS\system32>bcdedit /enum {badmemory}

RAM Defects
-----------
identifier {badmemory}

C:\WINDOWS\system32>chkdsk /b /v C:
The type of the file system is NTFS.
Cannot lock current drive.

Chkdsk cannot run because the volume is in use by another
process. Would you like to schedule this volume to be
checked the next time the system restarts? (Y/N) y

This volume will be checked the next time the system restarts.

C:\WINDOWS\system32>

Virtual Memory, Startup and Recovery
Attachment 280331
Attachment 280330

Attachment 280328Attachment 280329

CCleaner
Attachment 280333

Chkdsk results
Chkdsk was executed in scan mode on a volume snapshot.

Checking file system on C:
The type of the file system is NTFS.

Stage 1: Examining basic file system structure ...
809216 file records processed. File verification completed.
8678 large file records processed. 0 bad file records processed.
Stage 2: Examining file name linkage ...
30141 reparse records processed. 936552 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered to lost and found. 30141 reparse records processed.
Stage 3: Examining security descriptors ...
Security descriptor verification completed.
63669 data files processed. CHKDSK is verifying Usn Journal...
36497120 USN bytes processed. Usn Journal verification completed.

Windows has scanned the file system and found no problems.
No further action is required.

1952412622 KB total disk space.
331336252 KB in 398179 files.
201760 KB in 63670 indexes.
44 KB in bad sectors.
979302 KB in use by the system.
65536 KB occupied by the log file.
1619895264 KB available on disk.

4096 bytes in each allocation unit.
488103155 total allocation units on disk.
404973816 allocation units available on disk.

----------------------------------------------------------------------


Stage 1: Examining basic file system structure ...

Stage 2: Examining file name linkage ...

Stage 3: Examining security descriptors ...
----------------------------------------------------


Wininit results:

Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.

Stage 1: Examining basic file system structure ...
Cleaning up instance tags for file 0x6900.
809216 file records processed.
File verification completed.
8678 large file records processed.
0 bad file records processed.

Stage 2: Examining file name linkage ...
30144 reparse records processed.
936548 index entries processed.
Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered to lost and found.
30144 reparse records processed.

Stage 3: Examining security descriptors ...
Cleaning up 2754 unused index entries from index $SII of file 0x9.
Cleaning up 2754 unused index entries from index $SDH of file 0x9.
Cleaning up 2754 unused security descriptors.
CHKDSK is compacting the security descriptor stream
Security descriptor verification completed.
63667 data files processed.
CHKDSK is verifying Usn Journal...
Usn Journal verification completed.
Removing B clusters from the Bad Clusters File.

Stage 4: Looking for bad clusters in user file data ...
809200 files processed.
File data verification completed.

Stage 5: Looking for bad, free clusters ...
405519019 free clusters processed.
Free space verification is complete.
Correcting errors in the Volume Bitmap.

Windows has made corrections to the file system.
No further action is required.

1952412622 KB total disk space.
329197148 KB in 398143 files.
201096 KB in 63670 indexes.
0 KB in bad sectors.
938302 KB in use by the system.
65536 KB occupied by the log file.
1622076076 KB available on disk.

4096 bytes in each allocation unit.
488103155 total allocation units on disk.
405519019 allocation units available on disk.

Internal Info:
00 59 0c 00 c9 0b 07 00 8d 94 0b 00 00 00 00 00 .Y..............
45 02 00 00 7b 73 00 00 00 00 00 00 00 00 00 00 E...{s..........

Windows has finished checking your disk.
Please wait while your computer restarts.


HD Tune Results - System froze during the error check, & had to be restarted.

Attachment 280336Attachment 280334Attachment 280335

Sea Tools
Attachment 280337

Disk Management - Disk & Volume Views
Attachment 280328Attachment 280329

Mini Tool Partition Wizard
Attachment 280340

Let me know if I forgot anything, or you need additional info.
Ken

First scannow:

Code:

Windows Resource Protection found corrupt files and successfully repaired them.

Second scannow:

Code:

Windows Resource Protection did not find any integrity violations.

Chkdsk switches:

Code:

Correcting errors in the Volume Bitmap.

1) See if you can find the drive E:
When available please post results for chkdsk /b /v E:

2) Run Crystal Disk standard edition:
CrystalDiskInfo – Crystal Dew World
Post images into the thread.

3) Run HD Sentinel: (free or trial edition)
Hard Disk Sentinel - HDD health and temperature monitoring
Hard Disk Sentinel - HDD health and temperature monitoring
For each drive post images of these tabs into the thread:
Overview tab
Temperature
SMART
Disk performance


4) Read these links on Windows driver verifier:

a) learn how to use the Windows Recovery Environment (RE) commands: reset and bootmode to turn off the tool

b) do not use the tool until it is communicated in the thread


Enable and Disable Driver Verifier in Windows 10
https://answers.microsoft.com/en-us/...3-c48669e4c983

Drive E: was showing in Disk Management as a USB device with no media installed. That may have been leftover from a flash drive that was plugged in at some time. I removed it in Device Manager & refreshed. The generic compact flash device was reinstalled. Drive E: is no longer listed.


I uninstalled Focusrite USB 4.36.1.485 per instructions on Focusrite's support page and installed the newest USB drivers, Focusrite USB 4.36.5.0.

Crystal Disk

Attachment 280430

HD Sentinel
Attachment 280431
Attachment 280433
Attachment 280434
Attachment 280432

I read the Driver Verifier information, and will wait for your instructions before using.

Nice progress.

Windows driver verifier is designed to stress test drivers.

If there are misbehaving drivers the computer will crash.

If dump files are created they can be debugged.

Misbehaving drivers are then uninstalled and reinstalled.

The tool is run for approximately 48 hours and then an additional 36 hours after the last BSOD.

If there are no further BSOD this concludes the use of the tool.

After each BSOD you must turn off the tool in order to return to the desktop.

Learn the Windows RE commands reset and bootmode.

These are ran in safe mode or safe mode with command prompt.

In case these fail the next option is system restore.

If system restore fails you can restore a backup image or use registry commands.

Start the tool with the 3 customized test settings in the Ten Forums link.

Increase the simultaneous customized test settings by 3 - 5 / hour up to the 19 customized test settings in the Microsoft link.

There can be performance problems and / or slow boot while using the tool.

If necessary the customized test settings can be modified.

Summary:
a) make a new restore point
b) test all non-Microsoft drivers
c) test no Microsoft drivers
d) start with the 3 customized test settings in the Ten Forums link
e) increase the customized test settings by 3 - 5 / hour up to the 19 customized test settings in the Microsoft link


Enable and Disable Driver Verifier in Windows 10
https://answers.microsoft.com/en-us/...3-c48669e4c983

Create System Restore Point in Windows 10


For any BSOD:

a) run the V2 log collector to collect new log files

b) open file explorer> this PC > C: > in the right upper corner search for: C:\Windows\memory.dmp
> if the file size is < 1.5 GB then zip > post a separate share link into the thread using one drive, drop box, or google drive