Alright here is the memory dump
Gofile
And here is the check disk result
Paste.ee - chkdsk results
EDIT: I also swapped the SSD out for a new one and formatted it, still getting the same kind of errors, so it's def. not the disk.
I think the fact ubuntu works on it perfectly fine is really important to figuring out what the issue is but dunno how
Last edited by DeadlyChef; 01 Jul 2020 at 05:30.
Can you just paste the chkdsk results in your post here. When I try to look at them on paste.ee I get this:
Attachment 286093
and this
Attachment 286091
Got the dump okay though.
The MEMORY.DMP shows a lot of Intel video activity just prior to the crashdump occurring.
Try the Intel® Driver & Support Assistant (Intel® DSA). See if it finds any updates you may need.
The Intel® Driver & Support Assistant keeps your system up-to-date by providing tailored support and hassle-free updates for most of your Intel hardware. View a list of driver & software exclusions.
Note: This application is supported on Microsoft Windows 7, Windows 8, Windows 8.1, and Windows® 10 using Chrome, Firefox, or Edge* (version 44.17763/18.17763 or newer) browsers.
Yeah sure, here is the chkdsk log (some tools report paste.ee as phising and such, because people posted pastes containing passwords etc. and site got reported, but it is safe)
I'll try using the tool you posted
EDIT: I just can't get the forum formatting to work so I reposted the log on pastebin
Wrap code or noparse tags around it (# or Attachment 286247 ).
Run chkdsk again since it found and corrected quite a few errors. Make sure you geta a clean run.
I have installed all the driver updates with Intel® Driver & Support Assistant (Intel® DSA) (there was only 1 for display driver)
After the update the crashes still occur.
I also installed a new SSD, done a clean format with it and installed all windows updates, here is the check disk log :
#
Checking file system on C:
The type of the file system is NTFS.
A disk check has been scheduled.
Windows will now check the disk.
Stage 1: Examining basic file system structure ...
189696 file records processed.
File verification completed.
4712 large file records processed.
0 bad file records processed.
Stage 2: Examining file name linkage ...
150 reparse records processed.
281724 index entries processed.
Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered to lost and found.
150 reparse records processed.
Stage 3: Examining security descriptors ...
Cleaning up 511 unused index entries from index $SII of file 0x9.
Cleaning up 511 unused index entries from index $SDH of file 0x9.
Cleaning up 511 unused security descriptors.
Security descriptor verification completed.
46015 data files processed.
CHKDSK is verifying Usn Journal...
39311952 USN bytes processed.
Usn Journal verification completed.
Stage 4: Looking for bad clusters in user file data ...
189680 files processed.
File data verification completed.
Stage 5: Looking for bad, free clusters ...
52085485 free clusters processed.
Free space verification is complete.
Windows has scanned the file system and found no problems.
No further action is required.
233835519 KB total disk space.
25088236 KB in 137961 files.
102276 KB in 46016 indexes.
0 KB in bad sectors.
303063 KB in use by the system.
65536 KB occupied by the log file.
208341944 KB available on disk.
4096 bytes in each allocation unit.
58458879 total allocation units on disk.
52085486 allocation units available on disk.
Internal Info:
00 e5 02 00 b4 ce 02 00 8a 80 05 00 00 00 00 00 ................
3d 00 00 00 59 00 00 00 00 00 00 00 00 00 00 00 =...Y...........
Windows has finished checking your disk.
Please wait while your computer restarts.
#
I have also tried checking the crash dump myself with a free tool called whocrashed but it didn't bring anything useful, here are the results from analyzing all the crash dumps on the PC:
#
Crash Dump Analysis
Crash dumps
are enabled on your computer.
Crash dump directories:
C:\Windows
C:\Windows\Minidump
On Mon 06/07/2020 13:49:56 your computer
crashed or a problem was reported
crash dump file:
C:\Windows\Minidump\070620-4046-02.dmp
This was probably caused by the
following module: ntoskrnl.exe (nt+0x1C23A0)
Bugcheck code: 0x3B
(0x80000003, 0xFFFFF8030E70C0C8, 0xFFFFDF8B04155120, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path:
C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel &
System
Bug check description: This indicates that an exception happened while
executing a routine that transitions from non-privileged code to privileged
code.
This appears to be a typical software driver bug and is not likely to
be caused by a hardware problem.
The crash took place in the Windows kernel.
Possibly this problem is caused by another driver that cannot be identified at
this time.
On Mon 06/07/2020 13:49:56 your computer crashed or a
problem was reported
crash dump file: C:\Windows\MEMORY.DMP
This was
probably caused by the following module: ntkrnlmp.exe (nt!setjmpex+0x81C9)
Bugcheck code:
0x3B (0x80000003, 0xFFFFF8030E70C0C8, 0xFFFFDF8B04155120, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
Bug check description: This
indicates that an exception happened while executing a routine that transitions
from non-privileged code to privileged code.
This appears to be a typical
software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused
by another driver that cannot be identified at this time.
On
Mon 06/07/2020 13:37:33 your computer crashed or a problem was
reported
crash dump file: C:\Windows\Minidump\070620-3984-01.dmp
This
was probably caused by the following module: ntoskrnl.exe (nt+0x1C23A0)
Bugcheck code: 0xD1
(0x0, 0x2, 0x8, 0x0)
Error: DRIVER_IRQL_NOT_LESS_OR_EQUAL
file path:
C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel &
System
Bug check description: This indicates that a kernel-mode driver
attempted to access pageable memory at a process IRQL that was too high.
This bug check belongs to the crash dump test that you have performed with
WhoCrashed or other software. It means that a crash dump file was properly
written out.
The crash took place in the Windows kernel. Possibly this
problem is caused by another driver that cannot be identified at this time.
On
Mon 06/07/2020 13:19:05 your computer crashed or a problem was
reported
crash dump file: C:\Windows\Minidump\070620-4953-01.dmp
This
was probably caused by the following module: ntoskrnl.exe (nt+0x1C23A0)
Bugcheck code: 0x1E
(0xFFFFFFFFC0000005, 0x0, 0x8, 0x0)
Error: KMODE_EXCEPTION_NOT_HANDLED
file path:
C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel &
System
Bug check description: This indicates that a kernel-mode program
generated an exception which the error handler did not catch.
This might be
a case of memory corruption. This may be because of a hardware issue such as
faulty RAM, overheating (thermal issue) or because of a buggy driver.
The
crash took place in the Windows kernel. Possibly this problem is caused by
another driver that cannot be identified at this time.
On
Mon 06/07/2020 13:13:59 your computer crashed or a problem was
reported
crash dump file: C:\Windows\Minidump\070620-4765-01.dmp
This
was probably caused by the following module: ntoskrnl.exe (nt+0x1C1220)
Bugcheck code: 0xD1
(0x4, 0x2, 0x8, 0x4)
Error: DRIVER_IRQL_NOT_LESS_OR_EQUAL
file path:
C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel &
System
Bug check description: This indicates that a kernel-mode driver
attempted to access pageable memory at a process IRQL that was too high.
This bug check belongs to the crash dump test that you have performed with
WhoCrashed or other software. It means that a crash dump file was properly
written out.
The crash took place in the Windows kernel. Possibly this
problem is caused by another driver that cannot be identified at this time.
On
Mon 06/07/2020 12:58:10 your computer crashed or a problem was
reported
crash dump file: C:\Windows\Minidump\070620-5671-01.dmp
This
was probably caused by the following module: ntoskrnl.exe (nt+0x1C1220)
Bugcheck code: 0xD1
(0x4, 0x2, 0x8, 0x4)
Error: DRIVER_IRQL_NOT_LESS_OR_EQUAL
file path:
C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel &
System
Bug check description: This indicates that a kernel-mode driver
attempted to access pageable memory at a process IRQL that was too high.
This bug check belongs to the crash dump test that you have performed with
WhoCrashed or other software. It means that a crash dump file was properly
written out.
The crash took place in the Windows kernel. Possibly this
problem is caused by another driver that cannot be identified at this time.
#
You should run V2 again.
IMO, the best tool for analyzing crash dumps is WinDbg.
https://docs.microsoft.com/en-us/win...download-tools
There is a learning curve, but worth it.
Didn't have much chance to deal with this..
Here is the new log Attachment 288375
I have also been trying to use the windbg but it has a pretty steep learning curve yeah
Here is some info I got from the dumps found on the PC while using it, I have also tried to look at those memory references in dissasembly but I don't understand it sadly..
-------------------------------
PAGE_FAULT_IN_NONPAGED_AREA (50)
Could not read faulting driver nameInvalid system memory was referenced.
This cannot be protected by try-except.Typically the address is just plain bad or it is pointing at freed memory.
PROCESS_NAME: csrss.exe
FAILURE_BUCKET_ID: AV_INVALID_BAD_IP_nt!MiSystemFault
-------------------------------
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: 0000000000000008, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception
PROCESS_NAME: csrss.exe
FAILURE_BUCKET_ID: 0x1E_nt!KiDispatchException
-------------------------------
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 0000000080000003, Exception code that caused the bugcheck
Arg2: fffff8030e70c0c8, Address of the instruction which caused the bugcheck
Arg3: ffffdf8b04155120, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
PROCESS_NAME: WhoCrashedEx.exe
FAILURE_BUCKET_ID: 0x3B_80000003_nt!KeCheckStackAndTargetAddress
-------------------------------
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000008, value 0 = read operation, 1 = write operation
Arg4: 0000000000000000, address which referenced memory
READ_ADDRESS: fffff806109733b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff8061082a3c8: Unable to get Flags value from nt!KdVersionBlock
fffff8061082a3c8: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
0000000000000000
PROCESS_NAME: cpuz.exe
FAILED_INSTRUCTION_ADDRESS:
+0
00000000`00000000 ?? ???
STACK_TEXT:
fffff806`16072568 fffff806`105d41e9 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000008 : nt!KeBugCheckEx
fffff806`16072570 fffff806`105d0529 : fffff806`0e660180 fffff806`104b0985 ffffe209`d19e1820 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff806`160726b0 00000000`00000000 : 00000000`00000000 fffff806`16072939 ffffe209`d19d4000 00000000`ffffffff : nt!KiPageFault+0x469
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
MEMORY_CORRUPTOR: LARGE
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE
-------------------------------
SYSTEM_SERVICE_EXCEPTION (3b)An exception happened while executing a system service routine.
Arguments:
Arg1: 0000000080000003, Exception code that caused the bugcheck
Arg2: fffff8036a50c0c8, Address of the instruction which caused the bugcheck
Arg3: fffffc801e212e40, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
fffff803`6a50c0c8 cc int 3
fffffc80`1e212e40 0000 add byte ptr [rax], al
PROCESS_NAME: cpuz.exe
-------------------------------
At this point I believe it is a hardware issue but it works fine with linux!
I will try installing windows 7 next just as a test..
Even though memtest86+ ran okay, you could still have bad memory. The best memory tester there is unfortunately is the operating system.
Another possibility is still a driver. Once you get back to Windows 10, try Driver Verifier, see what it shows:
Run Driver Verifier
Driver Verifier-- tracking down a mis-behaving driver.
Following the instructions in the above link will check for problems in all non-Microsoft drivers.
What we're looking for is a verifier generated BSOD with a mini dump that will tell us what driver caused it. If you get a BSOD, rerun the V2 log collector as soon as possible and upload the resulting zip file. Also see if there is a new C:\Windows \MEMORY.DMP file. If there is, copy it to another location then zip it an upload to a file sharing site like OneDrive and post a link to it here.
To check if verifier is active, open a Command Prompt and enter:
verifier /query
If not active it will respond with
No drivers are currently verified.
If you have questions, see this additional tutorial which may help to clear things up.
Enable and Disable Driver Verifier in Windows 10
I didn't manage to install windows 7, seems to be missing some drivers in the ISO I have, didn't bother too much with it.
So I turned on the driver verifier, enabled the suggested settings and after starting a CPU burn with CPU-Z not even 1 min later there is a BSOD.
I have attached the V2 logs Attachment 288800
Also here is the full memory dump
There are not many drivers besides the microsoft ones, only the audio drivers, storage and video.
Another thing I noticed is that before one BSOD (not one posted here, one shortly after) my screen got all checkered out before the crash, like the graphics drivers crashed.
Quote