System thread exception not handled bsod

jfranzreb · 27 Dec 2021

I have a user experiencing SYSTEM THREAD EXCEPTION NOT HANDLED and the system stays online for 15-20 minutes before crashing. I was able to read the minidump files and it appears to be having problems with the Realtek audio driver. ntoskrnl has been showing up as well. My most recent dumps have complained on a variety of other sys files.

User is on Windows 10 21H1 build 19043.1415

Thanks,
Jeff

James · 31 Dec 2021

Hello, Jeff.

It seems you are having the same problem as this person, so a quick look at the answer I put for them might help you.

-James

jfranzreb · 05 Jan 2022

Thanks. Sorry, I haven't logged into the site in a few days. I'll check things out.

axe0 · 06 Jan 2022

james12121 said:

It seems you are having the same problem as this person

Sorry to say, but that would suggest the same solution solves this problem as well, and I know for a fact it won't because the software involved in the other thread isn't relevant here. Furthermore, different crashes are involved here as well as possible hard drive problems.

Jeff, could you rerun the log collector and post the logs again, the logs appear to be incomplete.

Code:

   2021-12-27T07:36:26.2350000Z		Dump file creation failed due to error during dump creation.
   2021-12-27T07:49:31.5220000Z		Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0
Problem signature:
P1: 1e
P2: ffffffffc0000005
P3: fffff80537124a3a
P4: 0
P5: ffffffffffffffff
P6: 10_0_19043
P7: 0_0
P8: 256_1
P9: 
P10: 
Attached files:
\\?\C:\WINDOWS\Minidump\122721-44843-01.dmp
\\?\C:\WINDOWS\TEMP\WER-46921-0.sysdata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER150B.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER155A.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1634.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1654.tmp.txt
These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_1e_47d0c6d19272acd14b3c3e5e809c8a7e912b9_00000000_6df49eb2-b8ed-4978-8fa3-7d3538a105c3
Analysis symbol: 
Rechecking for solution: 0
Report Id: e290d33a-1ec5-4e51-bd2d-714c643cec4f
Report Status: 4
Hashed bucket: 
Cab Guid: 0
   2021-12-27T08:25:25.6860000Z		Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0
Problem signature:
P1: 3b
P2: c0000005
P3: fffff80316001e9b
P4: ffff818bf44a62f0
P5: 0
P6: 10_0_19043
P7: 0_0
P8: 256_1
P9: 
P10: 
Attached files:
\\?\C:\WINDOWS\Minidump\122121-45734-01.dmp
\\?\C:\WINDOWS\TEMP\WER-47453-0.sysdata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERBE9E.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERBEDD.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERC370.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERC3B0.tmp.txt
These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_3b_11c76ad8fbc3b2521fedc542da174824fd9a29c_00000000_cab_b2e4e573-3d74-4d76-8ebe-4ae069d4bd6d
Analysis symbol: 
Rechecking for solution: 0
Report Id: cde31745-99e4-48fb-81e3-da0986f024c1
Report Status: 2049
Hashed bucket: 
Cab Guid: 0
   2021-12-27T08:25:38.5600000Z		Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0
Problem signature:
P1: 1e
P2: ffffffffc0000005
P3: fffff80537124a3a
P4: 0
P5: ffffffffffffffff
P6: 10_0_19043
P7: 0_0
P8: 256_1
P9: 
P10: 
Attached files:
\\?\C:\WINDOWS\Minidump\122721-44843-01.dmp
\\?\C:\WINDOWS\TEMP\WER-46921-0.sysdata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER150B.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER155A.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1634.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1654.tmp.txt
These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_1e_47d0c6d19272acd14b3c3e5e809c8a7e912b9_00000000_cab_6df49eb2-b8ed-4978-8fa3-7d3538a105c3
Analysis symbol: 
Rechecking for solution: 0
Report Id: e290d33a-1ec5-4e51-bd2d-714c643cec4f
Report Status: 2049
Hashed bucket: 
Cab Guid: 0
   2021-12-27T09:31:17.0390000Z		Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0
Problem signature:
P1: 3b
P2: c0000005
P3: fffff8047f8659cf
P4: ffffbb86b06d0cf0
P5: 0
P6: 10_0_19043
P7: 0_0
P8: 256_1
P9: 
P10: 
Attached files:
\\?\C:\WINDOWS\Minidump\122721-56078-01.dmp
\\?\C:\WINDOWS\TEMP\WER-63968-0.sysdata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4C52.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4C63.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4F6F.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4FFD.tmp.txt
These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_3b_33e222f0dd5755f57cb49cb11b8d9c50e465f1_00000000_f9401f9d-d5b0-4d14-b2a6-d3830db82711
Analysis symbol: 
Rechecking for solution: 0
Report Id: b63cd8a4-e8f5-4f78-a17d-776cb3399086
Report Status: 4
Hashed bucket: 
Cab Guid: 0
   2021-12-27T09:31:17.6830000Z		Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0
Problem signature:
P1: 1000007e
P2: ffffffffc0000005
P3: fffff80744c1e380
P4: ffff9f03b9e3f568
P5: ffffd081afdcf920
P6: 10_0_19043
P7: 0_0
P8: 256_1
P9: 
P10: 
Attached files:
\\?\C:\WINDOWS\Minidump\122721-51906-01.dmp
\\?\C:\WINDOWS\TEMP\WER-63968-0.sysdata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER5A8D.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER5A9E.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER5A9D.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER5B0B.tmp.txt
These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_1000007e_4f9b9447ffad3888299328e6b2405fc6e867_00000000_9f27cae5-5c23-40c0-afbc-a4e158602be6
Analysis symbol: 
Rechecking for solution: 0
Report Id: 90c185c8-6676-4a81-a7f8-b68364294f49
Report Status: 4
Hashed bucket: 
Cab Guid: 0
   2021-12-27T09:34:08.0680000Z		Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0
Problem signature:
P1: 3b
P2: c0000005
P3: fffff8047f8659cf
P4: ffffbb86b06d0cf0
P5: 0
P6: 10_0_19043
P7: 0_0
P8: 256_1
P9: 
P10: 
Attached files:
\\?\C:\WINDOWS\Minidump\122721-56078-01.dmp
\\?\C:\WINDOWS\TEMP\WER-63968-0.sysdata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4C52.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4C63.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4F6F.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4FFD.tmp.txt
These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_3b_33e222f0dd5755f57cb49cb11b8d9c50e465f1_00000000_cab_f9401f9d-d5b0-4d14-b2a6-d3830db82711
Analysis symbol: 
Rechecking for solution: 0
Report Id: b63cd8a4-e8f5-4f78-a17d-776cb3399086
Report Status: 2049
Hashed bucket: 
Cab Guid: 0
   2021-12-27T09:34:29.4850000Z		Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0
Problem signature:
P1: 1000007e
P2: ffffffffc0000005
P3: fffff80744c1e380
P4: ffff9f03b9e3f568
P5: ffffd081afdcf920
P6: 10_0_19043
P7: 0_0
P8: 256_1
P9: 
P10: 
Attached files:
\\?\C:\WINDOWS\Minidump\122721-51906-01.dmp
\\?\C:\WINDOWS\TEMP\WER-63968-0.sysdata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER5A8D.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER5A9E.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER5A9D.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER5B0B.tmp.txt
These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_1000007e_4f9b9447ffad3888299328e6b2405fc6e867_00000000_cab_9f27cae5-5c23-40c0-afbc-a4e158602be6
Analysis symbol: 
Rechecking for solution: 0
Report Id: 90c185c8-6676-4a81-a7f8-b68364294f49
Report Status: 2049
Hashed bucket: 
Cab Guid: 0
   2021-12-27T10:17:23.7640000Z		Crash dump initialization failed!

Code:

2021-12-27T09:17:42.8800000Z Volume C: (\Device\HarddiskVolume3) requires an Online Scan. An Online Scan will automatically run as part of the next scheduled maintenance task. Alternatively you may run "CHKDSK /SCAN" locally via the command line, or run "REPAIR-VOLUME <drive:> -SCAN" locally or remotely via PowerShell.
2021-12-27T09:18:52.7040000Z Volume C: (\Device\HarddiskVolume3) requires an Online Scan. An Online Scan will automatically run as part of the next scheduled maintenance task. Alternatively you may run "CHKDSK /SCAN" locally via the command line, or run "REPAIR-VOLUME <drive:> -SCAN" locally or remotely via PowerShell.
2021-12-27T09:25:45.7990000Z Volume C: (\Device\HarddiskVolume3) requires an Online Scan. An Online Scan will automatically run as part of the next scheduled maintenance task. Alternatively you may run "CHKDSK /SCAN" locally via the command line, or run "REPAIR-VOLUME <drive:> -SCAN" locally or remotely via PowerShell.
2021-12-27T09:30:52.3540000Z Chkdsk was executed in verify mode on a volume snapshot.
Checking file system on \Device\HarddiskVolume3
Volume label is OS.
Examining 1 corruption record ...
Record 1 of 1: Index entry for file "\Windows\Logs\MeasuredBoot\0000000221-0000000000.log <0x12,0x287bb>" is missing from index "$I30" of directory "\Windows\CbsTemp\30926520_1618304904\WINDOW~1.CAB <0x288,0x368>" ... no corruption found.
1 corruption record processed in 0.8 seconds.
Windows has examined the list of previously identified potential issues and found no problems.
No further action is required.
2021-12-27T10:17:23.4770000Z Volume C: (\Device\HarddiskVolume3) requires an Online Scan. An Online Scan will automatically run as part of the next scheduled maintenance task. Alternatively you may run "CHKDSK /SCAN" locally via the command line, or run "REPAIR-VOLUME <drive:> -SCAN" locally or remotely via PowerShell.
2021-12-27T10:51:53.1210000Z Chkdsk was executed in verify mode on a volume snapshot.
Checking file system on \Device\HarddiskVolume3
Volume label is OS.
Examining 1 corruption record ...
Record 1 of 1: Index entry for file "\Windows\Logs\MeasuredBoot\0000000221-0000000000.log <0x12,0x287bb>" is missing from index "$I30" of directory "\Windows\CbsTemp\30926520_1618304904\WINDOW~1.CAB <0x288,0x368>" ... no corruption found.
1 corruption record processed in 0.2 seconds.
Windows has examined the list of previously identified potential issues and found no problems.
No further action is required.
2021-12-27T12:45:16.9560000Z Volume C: (\Device\HarddiskVolume3) requires an Online Scan. An Online Scan will automatically run as part of the next scheduled maintenance task. Alternatively you may run "CHKDSK /SCAN" locally via the command line, or run "REPAIR-VOLUME <drive:> -SCAN" locally or remotely via PowerShell.

James · 06 Jan 2022

I meant similar - sorry @axe0 - I'll leave it to the pro!!

axe0 · 06 Jan 2022

I don't mean to turn this in a discussion, but I don't think it's similar either. In the form of a bugcheck, maybe, but then only the bugcheck code and not the rest of the crash. Problem here is that the crash mentioned is a generic bugcheck, it can be as a result of various reasons so even though the bugcheck code is the same the cause can be theoretically anything from a mere bug in a driver to a faulty PSU. I'm not suggesting that the PSU is the problem here though.

Unless the context and everything is the same, I wouldn't imply that a crash is the same or similar to one someone else has experienced. There are a plethora of variables to check before one might be the same, and honestly out of hundreds (thousands?) dumps I have looked into only a very small portion truly were the same.