ntoskrnl.exe and amdppm.sys causing BSODs

xcraft02 · 22 Nov 2020

Hi all,

Please help me. I've been having random BSODs for a while now and I don't know what to do any more. I had KMODE_EXCEPTION_NOT_HANDLED (caused by ntoskrnel.exe according to BlueScreenView) and UNEXPECTED_KERNEL_MODE_TRAP (amdppm.sys). Sometimes I can go 2-3 days without BSOD but there are times where I am hit twice on the same day.

It's always either of the two and sometimes my pc will just reboot with no error or BSOD.

What I did so far before posting:
Chkdisk, SFC = all returned okay.
Updated BIOS.
Updated outdated drivers
Memtest - 8 passes all OK.
Prime95 - 7 hours running, no error.
DriverVerifier - instant BSOD at boot so didn't continue. I don't know what to do.

Built the unit just almost 2 years ago. I don't have any issues when on Linux (Ubuntu). I don't overclock.

V2 Logger and minidumps of the latest two crashes are attached. Please let me know if you still need anything. Thank you.

philc43 · 22 Nov 2020

The crash dumps are not revealing a lot to help. Given all the tests you have already run I am working on the assumption that it is driver or software related.

For now can you please uninstall MSI Afterburner and see if this makes a difference.

xcraft02 · 22 Nov 2020

Hi,

Thank you, will do that and observe. Will report back what happens.

zbook · 22 Nov 2020

There were many log entries indicating possible problems.

There was a misbehaving driver using Windows Driver Verifier.

1) Please uninstall ScpVBus.sys

2) Uninstall and reinstall: rt640x64.sys
Realtek PCIe GbE Family Controller
https://answers.microsoft.com/en-us/...0-8d22254aa1c1

3) Restart Windows Driver Verifier WDV to find the next misbehaving driver.

4) Run HD Tune (free version) (all drives)
HD Tune website
Post images into the thread for results on these tabs:
a) Health
b) Benchmark
c) Full error scan

5) Run Sea Tools for Windows
long generic test
Post an image of the test result into the thread
SeaTools for Windows |
Seagate
How to use SeaTools for Windows | Seagate Support US

6) Run:
Tuneup.bat - Click here to go to the BSOD batch repository to download and run this batch file.

7) Open administrative command prompt and type or copy and paste:
chkdsk /r /v
This may take hours to run so plan to run overnight.
Run on all drives using the syntax: chkdsk /r /v C: or chkdsk /r /v D: changing the drive letter to the applicable drive.

C:\Windows\system32>chkdsk /r /v
The type of the file system is NTFS.
Cannot lock current drive.

Chkdsk cannot run because the volume is in use by another
process. Would you like to schedule this volume to be
checked the next time the system restarts? (Y/N)

Type: Y
reboot

8) Use the information in this link to find the chkdsk report in the event viewer.
Copy and paste into notepad > save to desktop > post into the thread using a one drive, drop box, or google drive share link:
Read Chkdsk Log in Event Viewer in Windows 10 Windows 10 Performance Maintenance Tutorials
Read Chkdsk Log in Event Viewer in Windows 10

Code:

Name	[00000006] Realtek PCIe GbE Family Controller
Adapter Type	Not Available
Product Type	Realtek PCIe GbE Family Controller
Installed	Yes
PNP Device ID	Not Available
Last Reset	22/11/2020 6:47 PM
Index	6
Service Name	rt640x64
IP Address	Not Available
IP Subnet	Not Available
Default IP Gateway	Not Available
DHCP Enabled	Yes
DHCP Server	Not Available
DHCP Lease Expires	Not Available
DHCP Lease Obtained	Not Available
MAC Address	Not Available

Code:

rt640x64	Realtek RT640 NT Driver	c:\windows\system32\drivers\rt640x64.sys	Kernel Driver	Yes	Manual	Running	OK	Normal	No	Yes

Code:

scpvbus    Scp Virtual Bus Driver    c:\windows\system32\drivers\scpvbus.sys    Kernel Driver    Yes    Manual    Running    OK    Normal    No    Yes

Code:

ScpVBus.sys  Sun May  5 16:31:26 2013 (5186CFAE)

Code:

rt640x64.sys Thu Mar  7 01:53:18 2019 (5C80CDEE)

xcraft02 · 22 Nov 2020

zbook said:

There were many log entries indicating possible problems.

There was a misbehaving driver using Windows Driver Verifier.

1) Please uninstall ScpVBus.sys

2) Uninstall and reinstall: rt640x64.sys
Realtek PCIe GbE Family Controller
https://answers.microsoft.com/en-us/...0-8d22254aa1c1

3) Restart Windows Driver Verifier WDV to find the next misbehaving driver.

4) Run HD Tune (free version) (all drives)
HD Tune website
Post images into the thread for results on these tabs:
a) Health
b) Benchmark
c) Full error scan

5) Run Sea Tools for Windows
long generic test
Post an image of the test result into the thread
SeaTools for Windows |
Seagate
How to use SeaTools for Windows | Seagate Support US

6) Run:
Tuneup.bat - Click here to go to the BSOD batch repository to download and run this batch file.

7) Open administrative command prompt and type or copy and paste:
chkdsk /r /v
This may take hours to run so plan to run overnight.
Run on all drives using the syntax: chkdsk /r /v C: or chkdsk /r /v D: changing the drive letter to the applicable drive.

C:\Windows\system32>chkdsk /r /v
The type of the file system is NTFS.
Cannot lock current drive.

Chkdsk cannot run because the volume is in use by another
process. Would you like to schedule this volume to be
checked the next time the system restarts? (Y/N)

Type: Y
reboot

8) Use the information in this link to find the chkdsk report in the event viewer.
Copy and paste into notepad > save to desktop > post into the thread using a one drive, drop box, or google drive share link:
Read Chkdsk Log in Event Viewer in Windows 10 Windows 10 Performance Maintenance Tutorials
Read Chkdsk Log in Event Viewer in Windows 10

Code:

Name	[00000006] Realtek PCIe GbE Family Controller
Adapter Type	Not Available
Product Type	Realtek PCIe GbE Family Controller
Installed	Yes
PNP Device ID	Not Available
Last Reset	22/11/2020 6:47 PM
Index	6
Service Name	rt640x64
IP Address	Not Available
IP Subnet	Not Available
Default IP Gateway	Not Available
DHCP Enabled	Yes
DHCP Server	Not Available
DHCP Lease Expires	Not Available
DHCP Lease Obtained	Not Available
MAC Address	Not Available

Code:

rt640x64	Realtek RT640 NT Driver	c:\windows\system32\drivers\rt640x64.sys	Kernel Driver	Yes	Manual	Running	OK	Normal	No	Yes

Code:

scpvbus    Scp Virtual Bus Driver    c:\windows\system32\drivers\scpvbus.sys    Kernel Driver    Yes    Manual    Running    OK    Normal    No    Yes

Code:

ScpVBus.sys  Sun May  5 16:31:26 2013 (5186CFAE)

Code:

rt640x64.sys Thu Mar  7 01:53:18 2019 (5C80CDEE)

Thanks.. I'll get back to you once I'm done with everything.

So far, done with 1-3. Verifier crashed again on Boot pointing to diskpt.sys.. Google search tells me it is related to Shadow Defender so uninstalled the program. PC now boots while verifier is enabled. How long should I run it?

zbook · 22 Nov 2020

Please upload a new V2 after any BSOD.

For WDV if there are no performance problems or very slow boot then increase the number of customized tests.

See these links;

Enable and Disable Driver Verifier in Windows 10
https://answers.microsoft.com/en-us/...3-c48669e4c983

The TF link starts with 3 customized tests.
The Microsoft link has 19 customized tests.

For the BSOD related to ScpVBus.sys there were 9 simultaneous customized tests.

Eventually you will expose all non-Microsoft drivers to all customized tests except Randomized low resources simulation.

These is a routine post: (sometimes modified)

Read these links on Windows driver verifier:

a) learn how to use the Windows Recovery Environment (RE) commands: reset and bootmode to turn off the tool

b) do not use the tool until it is communicated in the thread

Enable and Disable Driver Verifier in Windows 10
https://answers.microsoft.com/en-us/...3-c48669e4c983

Windows driver verifier is designed to stress test drivers.

If there are misbehaving drivers the computer will crash.

If dump files are created they can be debugged.

Misbehaving drivers are then uninstalled or uninstalled and reinstalled.

The tool is run for approximately 48 hours and then an additional 36 hours after the last BSOD.

If there are no further BSOD this concludes the use of the tool.

After each BSOD you must turn off the tool in order to return to the desktop.

Learn the Windows RE commands reset and bootmode.

These are ran in safe mode or safe mode with command prompt.

In case these fail the next option is system restore.

If system restore fails you can restore a backup image or use registry commands.

Start the tool with the 3 customized test settings in the Ten Forums link.

Increase the simultaneous customized test settings by 3 - 5 / hour up to the 19 customized test settings in the Microsoft link.

There can be performance problems and / or slow boot while using the tool.

If necessary the customized test settings can be modified.

Summary:
a) make a new restore point
b) test all non-Microsoft drivers
c) test no Microsoft drivers
d) after each BSOD use the reset command to turn off the tool
e) if the reset command does not work then use the bootmode command
f) only if both reset and bootmode command fail to turn off the tool then use restore
g) start with the 3 customized test settings in the Ten Forums link
h) increase the customized test settings up to the 19 customized test settings in the Microsoft link
i) report any performance problems or very slow boot so that the customized settings can be modified

So if there are no performance problems with the 9 customized tests add 5 additional customized tests now.

If there is no immediate BSOD then open administrative command prompt (ACP) and type or copy and paste:

verifier /querysettings

When these have completed > right click on the top bar or title bar of the administrative command prompt box > left click on edit then select all > right click on the top bar again > left click on edit then copy > paste into the thread

Use this link as needed when posting results:
How to Change Post Editor to Source or WYSIWYG Mode at TenForums.com

The logs had many entries related to a drive.
So all drives should be tested with each HD tune, Sea Tools and Chkdsk /r /v.

When available post the results for tuneup.bat (it can be ran when WDV is off and before the new customized tests are added).

For any BSOD:

a) run the V2 log collector to collect new log files

b) open file explorer> this PC > C: > in the right upper corner search for: C:\Windows\memory.dmp
> if the file size is < 1.5 GB then zip > post a separate share link into the thread using one drive, drop box, or google drive

Plan to use all customized tests with the exception of Randomized low resources simulation.
So the 19 displayed on the Microsoft link, with DDI, and DDI compliance checking (additional).

Create a new restore point:
Create System Restore Point in Windows 10

xcraft02 · 22 Nov 2020

Thanks for a very detailed instruction. Here's the V2 after the diskpt.sys BSOD with Driver Verifier
ESROM-PC-(2020-11-23_08-25-26)
Memory dump

Can I run HD Tune and Sea Tools while Driver Verifier is enabled?

zbook · 22 Nov 2020

The HD Tune Full error scan and Sea Tools long generic testing can take several hours each.
If they are interrupted by a WDV BSOD then they will need to be restarted.
So you can run them with that understanding.
And you can plan to run some test overnight.

1) When available post results from:

a) Tuneup.bat - Click here to go to the BSOD batch repository to download and run this batch file.

b) verifier /querysettings

2) The dump file was 1.6 GB so wait for any new BSOD memory.dmp.

3) Files used for troubleshooting were cleaned.
Please do not clean files during the troubleshooting.
Please identify whether it was windows cleanup or third party software
For example: Ccleaner, Wise cleaner, Glary utilities, etc.

Code:

diskpt	diskpt	c:\windows\system32\drivers\diskpt.sys	Kernel Driver	Yes	Boot	Running	OK	Normal	No	Yes

Code:

diskpt.sys   Fri Oct 13 03:47:45 2017 (59E099D1)

xcraft02 · 23 Nov 2020

zbook said:

The HD Tune Full error scan and Sea Tools long generic testing can take several hours each.
If they are interrupted by a WDV BSOD then they will need to be restarted.
So you can run them with that understanding.
And you can plan to run some test overnight.

1) When available post results from:

a) [FONT="]Tuneup.bat[/FONT][FONT="] - Click here to go to the BSOD batch repository to download and run this batch file.

b) verifier /querysettings

2) The dump file was 1.6 GB so wait for any new BSOD memory.dmp.[/FONT]

3) Files used for troubleshooting were cleaned.
Please do not clean files during the troubleshooting.
Please identify whether it was windows cleanup or third party software
For example: Ccleaner, Wise cleaner, Glary utilities, etc.

Code:

diskpt	diskpt	c:\windows\system32\drivers\diskpt.sys	Kernel Driver	Yes	Boot	Running	OK	Normal	No	Yes

Code:

diskpt.sys   Fri Oct 13 03:47:45 2017 (59E099D1)

Hi, you're fast!

I run Tuneup.nat and here's the result:

Code:

###########################################################
# The following commands will be run in sequence.         #
# The first 5 will take quite a while to run, be patient. #
###########################################################

sfc /scannow
dism /online /cleanup-image /scanhealth
dism /online /cleanup-image /restorehealth
sfc /scannow

chkdsk /scan

wmic recoveros get autoreboot
wmic recoveros set autoreboot = false
wmic recoveros get autoreboot
wmic recoveros get DebugInfoType
wmic recoveros set DebugInfoType = 7
wmic recoveros get DebugInfoType

wmic pagefile list /format:list
wmic Computersystem where name="ESROM-PC" get AutomaticManagedPagefile
wmic Computersystem where name="ESROM-PC" set AutomaticManagedPagefile=True
wmic Computersystem where name="ESROM-PC" get AutomaticManagedPagefile

bcdedit /enum {badmemory}


C:\WINDOWS\system32>sfc /scannow

Beginning system scan.  This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.

C:\WINDOWS\system32>dism /online /cleanup-image /scanhealth

Deployment Image Servicing and Management tool
Version: 10.0.19041.572

Image Version: 10.0.19041.630

[==========================100.0%==========================] No component store corruption detected.
The operation completed successfully.

C:\WINDOWS\system32>dism /online /cleanup-image /restorehealth

Deployment Image Servicing and Management tool
Version: 10.0.19041.572

Image Version: 10.0.19041.630

[==========================100.0%==========================] The restore operation completed successfully.
The operation completed successfully.

C:\WINDOWS\system32>sfc /scannow

Beginning system scan.  This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.

C:\WINDOWS\system32>chkdsk /scan
The type of the file system is NTFS.

Stage 1: Examining basic file system structure ...
  730624 file records processed.
File verification completed.
 Phase duration (File record verification): 7.55 seconds.
  11859 large file records processed.
    Found unused file metadata marked as used

C:\WINDOWS\system32>wmic recoveros get autoreboot
AutoReboot
TRUE


C:\WINDOWS\system32>wmic recoveros set autoreboot = false
Updating property(s) of '\\ESROM-PC\ROOT\CIMV2:Win32_OSRecoveryConfiguration.Name="Microsoft Windows 10 Pro|C:\\WINDOWS|\\Device\\Harddisk0\\Partition4"'
Property(s) update successful.

C:\WINDOWS\system32>wmic recoveros get autoreboot
AutoReboot
FALSE


C:\WINDOWS\system32>wmic recoveros get DebugInfoType
DebugInfoType
7


C:\WINDOWS\system32>wmic recoveros set DebugInfoType = 7
Updating property(s) of '\\ESROM-PC\ROOT\CIMV2:Win32_OSRecoveryConfiguration.Name="Microsoft Windows 10 Pro|C:\\WINDOWS|\\Device\\Harddisk0\\Partition4"'
Property(s) update successful.

C:\WINDOWS\system32>wmic recoveros get DebugInfoType
DebugInfoType
7


C:\WINDOWS\system32>wmic pagefile list /format:list


AllocatedBaseSize=2937
CurrentUsage=0
Description=D:\pagefile.sys
InstallDate=20201123031326.522936+480
Name=D:\pagefile.sys
PeakUsage=1
Status=
TempPageFile=FALSE




C:\WINDOWS\system32>wmic Computersystem where name="ESROM-PC" get AutomaticManagedPagefile
AutomaticManagedPagefile
FALSE


C:\WINDOWS\system32>wmic Computersystem where name="ESROM-PC" set AutomaticManagedPagefile=True
Updating property(s) of '\\ESROM-PC\ROOT\CIMV2:Win32_ComputerSystem.Name="ESROM-PC"'
Property(s) update successful.

C:\WINDOWS\system32>wmic Computersystem where name="ESROM-PC" get AutomaticManagedPagefile
AutomaticManagedPagefile
TRUE


C:\WINDOWS\system32>bcdedit /enum {badmemory}

RAM Defects
-----------
identifier              {badmemory}
Press any key to continue . . .

I run it after reaching 16 customized settings in WDV (ran them fine for an hour). I followed the instruction of adding 3-5 customized settings every hour. Before running 19 customized settings (including the last three at the bottom). I disabled WDV then run Tuneup.bat.

Also during those WDV runs, I managed to run HD Tune as well on all my 3 drives here are the results. I uploaded the screenshots in a folder, one for each drives.
Kingston SUV5002
ST500DM002
WD3200

Oh, I didn't clean the troubleshooting files nor do I have any third party software that might delete it. I used system restore point in order to normal boot after the diskpt.sys BSOD, maybe that's it? The restore point was 5 days old, sorry about that.

On to run 19 customized settings for 24-36 hours now.

zbook · 23 Nov 2020

Move the page file from D: to C: during the troubleshooting.
Make sure that the box is checked to Automatically manage page file size for all drives.
Reboot to maintain these settings.

In the left lower corner search type: system or system control > open system control panel > on the left pane click advanced system settings

a) > on the advanced tab under startup and recovery > click settings > post an image of the startup and recovery window into the thread

b) > on the advanced tab under performance > click on settings > on the performance options window > click on the advanced tab > under virtual memory > click on change > post an image of the virtual memory window into the thread

Once WDV is restarted and there is no immediate BSOD:

Open administrative command prompt (ACP) and type or copy and paste:

verifier /querysettings

When these have completed > right click on the top bar or title bar of the administrative command prompt box > left click on edit then select all > right click on the top bar again > left click on edit then copy > paste into the thread

Use this link as needed when posting results:
How to Change Post Editor to Source or WYSIWYG Mode at TenForums.com
How to Change Post Editor to Source or WYSIWYG Mode at TenForums.com

For any BSOD use the reset command.
If the reset command fails then use the bootmode command (see the Ten Forums link).
Only if these two commands fail then use system restore.
Using system restore first is discouraged as it may lead to the disappearance of the newest dump file.
Without the dump file there is less progress in the troubleshooting.

Plan to run WDV with 21 customized test settings for 36 hours after the last BSOD.
Add DDI tests to the Microsoft link.

Run HD Sentinel: (free or trial edition)
Hard Disk Sentinel - HDD health and temperature monitoring
Hard Disk Sentinel - HDD health and temperature monitoring
For each drive post images of these tabs into the thread:
Overview tab
Temperature
SMART
Disk performance