BSOD leading to spontaneous restart

[Edit: Sorry I did not read the posting instructions first. I've now added the "zip" file of the V2 results as instructed. I've left the rest of my post "as is" just in case any of it is also useful - Barry]
Attachment 339264

I'm not sure where to begin but I'll hope some kind souls will tell me what info I should post in order to troubleshoot this.

As the subject states, my Lenovo Desktop T7i is experiencing periodic BSODs which lead to a spontaneous restart with no intervention on my part.

I've attached two screenshots of the latest Event Viewer record for the issue which most recently occurred. Please let me know what else I need to post in order to get this resolved. Thanks.

I'll add that I did the Windows Memory Diagnostic which restarted the machine, ran two cycles, and reported all was okay before the machine restarted back to the login screen.

I have CPU-Z so if there's some info from there that would be helpful, just advise. I'm running Windows 10 Home 21H1 "Windows Feature Experience Pack 120.2212.3530.0".

Barry


- - - Updated - - -

I managed to run Windbg and, in the app, I saw a recommendation I run a particular command; I did so. Below is the original text that appeared followed by the command's results.

I am hopeful someone might provide some clarity. Thanks

Microsoft (R) Windows Debugger Version 10.0.21349.1004 AMD64Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Barry Levine\Desktop\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.
************* Path validation summary **************
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (20 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff806`73800000 PsLoadedModuleList = 0xfffff806`7442a290
Debug session time: Tue Jun 29 18:14:40.121 2021 (UTC - 6:00)
System Uptime: 0 days 1:32:18.891
Loading Kernel Symbols
...............................................................
......Page 41d037 not present in the dump file. Type ".hh dbgerr004" for details
..........................................................
................................................................
.......................
Loading User Symbols
PEB is paged out (Peb.Ldr = 000000da`63d3f018). Type ".hh dbgerr001" for details
Loading unloaded module list
.............
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff806`73bf6b90 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffffe8a`6347ecd0=0000000000000050
13: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffffffffffffffd0, memory referenced.
Arg2: 0000000000000002, value 0 = read operation, 1 = write operation.
Arg3: fffff80673a082b6, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)

Debugging Details:
------------------


KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 2577

Key : Analysis.DebugAnalysisManager
Value: Create

Key : Analysis.Elapsed.mSec
Value: 2620

Key : Analysis.Init.CPU.mSec
Value: 390

Key : Analysis.Init.Elapsed.mSec
Value: 78653

Key : Analysis.Memory.CommitPeak.Mb
Value: 83

Key : WER.OS.Branch
Value: vb_release

Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key : WER.OS.Version
Value: 10.0.19041.1


BUGCHECK_CODE: 50

BUGCHECK_P1: ffffffffffffffd0

BUGCHECK_P2: 2

BUGCHECK_P3: fffff80673a082b6

BUGCHECK_P4: 2

READ_ADDRESS: ffffffffffffffd0

MM_INTERNAL_CODE: 2

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

PROCESS_NAME: GamingServices.exe

TRAP_FRAME: fffffe8a6347ef70 -- (.trap 0xfffffe8a6347ef70)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000070536f49 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80673a082b6 rsp=fffffe8a6347f100 rbp=fffffe8a6347f550
r8=0000000000000000 r9=0000000000000000 r10=00000000ffffffff
r11=00000000000000b1 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!ObfDereferenceObjectWithTag+0x26:
fffff806`73a082b6 f0480fc15ed0 lock xadd qword ptr [rsi-30h],rbx ds:ffffffff`ffffffd0=????????????????
Resetting default scope

STACK_TEXT:
fffffe8a`6347ecc8 fffff806`73c8dd7d : 00000000`00000050 ffffffff`ffffffd0 00000000`00000002 fffffe8a`6347ef70 : nt!KeBugCheckEx
fffffe8a`6347ecd0 fffff806`73b281a0 : ffff9d84`cdbbed78 00000000`00000002 fffffe8a`6347eff0 00000000`00000000 : nt!MiSystemFault+0x147d2d
fffffe8a`6347edd0 fffff806`73c04d5e : ffffb30e`96c415a0 ffff9d84`c6a37180 00000000`00000000 fffffe8a`6347efd0 : nt!MmAccessFault+0x400
fffffe8a`6347ef70 fffff806`73a082b6 : 00000000`00000103 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x35e
fffffe8a`6347f100 fffff806`73a6a0f6 : ffff9d84`d60fb290 00000000`00000000 ffff9d84`da99ace0 fffff806`73e8cc1c : nt!ObfDereferenceObjectWithTag+0x26
fffffe8a`6347f140 fffff806`73ee5e72 : ffff9d84`da99ace0 ffff9d84`da99ace0 fffffe8a`6347f550 00000000`00000000 : nt!IopDeleteFileObjectExtension+0x122
fffffe8a`6347f190 fffff806`73ee0120 : fffffe8a`6347f550 00000000`00000000 ffff9d84`bbb8ebc0 ffff9d84`d6d39a20 : nt!IopDeleteFile+0x212
fffffe8a`6347f210 fffff806`73a08357 : 00000000`00000000 00000000`00000000 fffffe8a`6347f550 ffff9d84`da99ace0 : nt!ObpRemoveObjectRoutine+0x80
fffffe8a`6347f270 fffff806`73a0827e : fffff806`75be8ef0 00000000`00000001 fffffe8a`6347f7a0 00000000`00000001 : nt!ObfDereferenceObjectWithTag+0xc7
fffffe8a`6347f2b0 fffff806`73ee4aad : ffff9d84`da99ace0 00000000`00000000 fffffe8a`6347f550 fffff806`75be8ef0 : nt!HalPutDmaAdapter+0xe
fffffe8a`6347f2e0 fffff806`73df23ce : ffff9d84`c687b8f0 fffff806`75be8ef0 ffff9d84`cdc0b010 ffff9d84`cdc0b001 : nt!IopParseDevice+0x1dcd
fffffe8a`6347f450 fffff806`73f014aa : ffff9d84`cdc0b000 fffffe8a`6347f6b8 00000000`00000040 ffff9d84`bbb8ebc0 : nt!ObpLookupObjectName+0x3fe
fffffe8a`6347f620 fffff806`73e167d5 : 00000000`00000000 000000da`63f7ddb0 000000da`63f7e301 000000da`63f7dd80 : nt!ObOpenObjectByNameEx+0x1fa
fffffe8a`6347f750 fffff806`73c085b5 : ffff9d84`d0ab8000 00007ffe`4b149524 ffff9d84`d0ab8080 0000021a`211d12e0 : nt!NtQueryAttributesFile+0x1c5
fffffe8a`6347fa00 00007ffe`4b7cd5c4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
000000da`63f7dd08 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffe`4b7cd5c4


SYMBOL_NAME: nt!ObfDereferenceObjectWithTag+26

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: 26

FAILURE_BUCKET_ID: AV_INVALID_nt!ObfDereferenceObjectWithTag

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {bf6808a0-c526-a191-e599-784e02b18e9e}

Followup: MachineOwner
---------


6/29 4:42 dump indicates a problem with farflt.sys:

Code:

ffffcb03`05f074b8  fffff801`cf02354dUnable to load image \SystemRoot\system32\DRIVERS\farflt.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for farflt.sys
 farflt+0x1354d

farflt.sys is part of Anti-RansomWare SDK developed by Malwarebytes

Uninstall Malwarebytes for now and see if that gets rid of the problem.

rumplestiltskin said:

Hmmm...

Matthew,
Ztruker's post pointed out the Anti-Ransomware component of the Malwarebytes product might be the cause of my BSODs. I did uninstall it (and verified that MS Defender was then running properly). I'm going to keep MWB clear of my system at the moment (although I did leave the MWB web browser extension in Chrome as that continues to provide a layer of protection against ending up at nasty websites).

I did see MS's advice about using OneDrive and Controlled Folder Access and am evaluating whether to take advantage of them. Frankly, I can't see a downside although it might introduce some workflow delays if some of my apps are safe but aren't on MS's list of verified "okey-dokey" apps. I can always turn it off if it gets too bothersome.

At this point, some hours after removing Malwarebytes, I've yet to see any further BSODs (and please don't let me jinx this). It's tough to declare victory when the enemy has simply disappeared. I'll give it a few more days and, if it all looks good, I'll come back and give Ztruker his due and mark this solved. (And where do I contribute to his coffee fund?)

Thanks,
Barry

If all is well in a few days you could try reinstalling MBAM to see if the new install resolves your problem with it. The date on the file I saw from you uploaded zip is older than what I have on my system so the reinstall may just fix it.

Wait a few more days first though.