Increasingly frequent BSODs, stop codes change each time

monkeymonk · 15 Apr 2023

Hi all,

My PC has been crashing/blue screening alot lately and I have no idea how to fix it. I'll try to provide as much information as I can:

I built this PC around 2017/18. At the end of 2020 I upgraded the CPU, GPU and RAM. (CPU 1300x > 3700x, GPU RX580 > RTX 2070 Super)

I do not recall experiencing any issues in the months after upgrading. However sometime in 2021, I started to get BSODs only after waking the PC from sleep (I don't know if this is relevant but I almost never shutdown my PC, I always let it sleep by itself instead). Apart from this I had no issues. Stupidly, I never bothered to look deeply into this issue of BSOD on waking at the time.

Around halfway through 2022, the BSODs started occurring more frequently, and were no longer restricted to moments after waking the PC from sleep mode. Still I did not bother to look into the issue as everything else was still working (I know, I'm an idiot). I did however notice that at that point, it never bluescreened when it was under load (eg. during gaming etc).

Now, however, my PC is almost constantly crashing, whether or not it's under load, whether or not I sleep it or shutdown properly. In the last few weeks every day I've gotten BSODs probably 10-20+ times a day. In the Reliability Monitor in Windows it shows a ton of errors related to "COM Surrogate stopped working", and in Event Viewer something called "VSS" (Volume Shadow Copy Service)? There are other errors scattered throughout though (screenshots attached).

BSOD error message and what failed varies alot, sometimes it doesn't show what failed either. I have been noting down all the error messages in the last few months. The two most common ones appear to be IRQL_NOT_LESS_OR_EQUAL and SYSTEM_SERVICE_EXCEPTION with no "what failed" attached, but the following have also appeared:
Stop codes:
- PAGE_FAULT_IN_NONPAGED_AREA
- FAST_ERESOURCE_PRECONDITION_VIOLATION
- ATTEMPTED_EXECUTE_OF_NO_EXECUTE_MEMORY
- KERNEL_SECURITY_CHECK_FAILURE
- DRIVER_OVERRAN_STACK_BUFFER
- IRQL_GT_ZERO_AT_SYSTEM_SERVICE
- KMODE_EXCEPTION_NOT_HANDLED
- CRITICAL_PROCESS_DIED
- KERNEL_AUTO_BOOST_INVALID_LOCK_RELEASE
- CRITICAL_STRUCTURE_CORRUPTION
- WDF_VIOLATION (this one always occurs with "HDaudBus.sys"
- SYSTEM_THREAD_EXCEPTION_NOT_HANDLED
What failed (most of the time it does not list what failed, but):
- fltmgr.sys
- hdaudbus.sys
- wpprecorder.sys
- ntfs.sys
- amdppm.sys
- netwtw04.sys
- netwtw03.sys
- win32kbase.sys
- win32kfull.sys
- tcpip.sys
- rt640x64.sys
- rtkvhd64.sys

I have tried:
- Reseating RAM and GPU
- Cleaning out the CPU heatsink which was super clogged with dust
- Windows Memory Diagnostic Tool (I did this a few months back and I don't recall it reporting anything wrong, I will try again tonight)
- sfc /scannow (a few hours ago it said "did not find any integrity violations", BUT I just did another one and it said it found and repaired corrupt files)
- DISM /CheckHealth /Scanhealth /RestoreHealth (Check and Scan both returned "the component store is repairable" which is apparently normal? The results of /RestoreHealth I'll attach in a screenshot as I have no idea what it means)
- Uninstalled graphics driver via DDU and reinstalled
- Updating Windows (currently Windows 10 PRO 22H2) and searching for driver updates through Windows Update
- Updating chipset drivers (I believe I did this correctly but not 100% sure)
- Changing power plans (there apparently used to be some issues with Ryzen CPUs and BSODs on waking with certain power plans?)

I am planning to run Memtest86 (have not had the chance to do this as I don't have a spare USB handy)

Other issues that may or may not be relevant:
- Main drive (the one with Windows installed, NVMe) remaining disk space fluctuates wildly (between <2gb - 15+gb remaining)
- Secondary SSDs (non NVMe) have been accumulating these huge (1gb+) DUMPxxx.tmp files since late 2022, I have no idea what to do with them
- The last couple weeks in addition to BSODs the PC will just hang randomly (screen stays on but nothing is responsive)
- Also apps will just close randomly, but PC does not freeze
- After the BSOD reaches 100% it almost never restarts by itself, just stays stuck at 100%, I usually have to hard reset with power button
- In device manager there is a "Corsair virtual input device" that keeps reappearing no matter how many times I uninstall/disable it, and it always has the yellow exclamation mark on it

I've attached some screenshots and the V2 log collector zip file, let me know if the links or permissions don't work:
Update your browser to use Google Drive, Docs, Sheets, Sites, Slides, and Forms - Google Drive Help
DESKTOP-LFS2OGV-(2023-04-16_04-15-52).zip - Google Drive
I can also continue uploading new minidump files as they come in.

Because of how varied the errors are, and how they change each time I don't know where to start, I've googled a few of them to no avail. I'm not well versed in this kind of troubleshooting and it gets overwhelming quickly for me. However it seems (and I could totally be off the mark) to be something memory or driver related?

I'm really hoping I can sort this out without having to replace parts which I can't afford currently, or having to reinstall Windows but I understand if that's not possible. At this point I'm ready to chuck the whole thing in the bin, it's been frustrating.

I'm so sorry for the long post, any help would be much appreciated and thank you in advance for your time!

Samuria · 15 Apr 2023

Using chatgpt AI if gives this
These error messages and their corresponding stop codes indicate various types of system crashes and failures in Windows 10. The listed system files that failed are also important clues in determining the root cause of the errors. Here are some possible reasons and solutions for each error:

PAGE_FAULT_IN_NONPAGED_AREA: This error is usually caused by faulty hardware, such as RAM or hard drive. Run a memory diagnostic tool or check the hard drive for errors.
FAST_ERESOURCE_PRECONDITION_VIOLATION: This error is related to the Windows kernel and can be caused by incompatible drivers, hardware problems, or corrupted system files. Try updating or reinstalling drivers, and perform a system file check (sfc /scannow) to fix corrupted files.
ATTEMPTED_EXECUTE_OF_NO_EXECUTE_MEMORY: This error is caused by a driver or program trying to execute code from a non-executable memory region. Check for driver updates or try uninstalling recently installed programs to see if it resolves the issue.
KERNEL_SECURITY_CHECK_FAILURE: This error is related to security issues in the Windows kernel, such as incompatible drivers or system files, malware infections, or hardware problems. Run a malware scan and check for driver updates or hardware problems.
DRIVER_OVERRAN_STACK_BUFFER: This error is caused by a driver writing beyond the allocated stack buffer, resulting in data corruption. Check for driver updates or try uninstalling recently installed programs to see if it resolves the issue.
IRQL_GT_ZERO_AT_SYSTEM_SERVICE: This error is caused by a driver or hardware trying to access a memory address that it does not have permission to access. Check for driver updates or try uninstalling recently installed programs to see if it resolves the issue.
KMODE_EXCEPTION_NOT_HANDLED: This error is caused by a driver or program triggering an unhandled exception in kernel mode. Check for driver updates or try uninstalling recently installed programs to see if it resolves the issue.
CRITICAL_PROCESS_DIED: This error is caused by a critical system process or driver failing, resulting in system shutdown to prevent damage. Check for driver updates or perform a system file check (sfc /scannow) to fix corrupted files.
KERNEL_AUTO_BOOST_INVALID_LOCK_RELEASE: This error is caused by a problem with the kernel auto-boost feature, which optimizes CPU usage. Check for driver updates or try uninstalling recently installed programs to see if it resolves the issue.
CRITICAL_STRUCTURE_CORRUPTION: This error is caused by corruption of critical data structures in the Windows kernel, usually due to hardware problems or driver conflicts. Run a memory diagnostic tool or check the hard drive for errors.
WDF_VIOLATION: This error is related to the Windows Driver Framework and can be caused by incompatible drivers or hardware problems. Check for driver updates or try uninstalling recently installed programs to see if it resolves the issue. Since it always occurs with "HDaudBus.sys", try updating the audio driver to fix the problem.
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED: This error is caused by a program or driver triggering an unhandled exception in user mode. Check for driver updates or try uninstalling recently installed programs to see if it resolves the issue.

In summary, the most common causes of these errors are faulty hardware, incompatible or outdated drivers, corrupted system files, and malware infections. Updating drivers, performing a system file check, running a malware scan, and checking hardware for errors can help resolve these issues.

zbook · 15 Apr 2023

The information from the V2 log collector indicated:
a) Insufficient free space on the Windows drive
b) likely malfunctioning RAM
c) No restore point
d) Page file on a non-Windows drive
e) Problems related to the component store

Plan to test and confirm malfunctioning RAM / DIMM / MB

Please perform the following steps: (in sequence)

1) Increase the free space on C: so that there is > 35 - 40 GB free space

2) Move the page file from D: to C: (during the troubleshooting make sure that the page file is on the Windows drive)

3) Run:

a) https://www.tenforums.com/attachment...p_plus_log.bat

b) https://www.tenforums.com/attachment...figuration.bat

Post share links into this thread using one drive, drop box, or google drive

4) Make a new restore point:

Create System Restore Point in Windows 10.

5) Download and install onto the desktop:

Download Windows 10 ISO File

https://www.microsoft.com/en-us/soft...load/windows10

6) Run Memtest86 (free version) overnight while sleeping
MemTest86 - Official Site of the x86 and ARM Memory Testing Tool
Take pictures > post images or share links using one drive, drop box, or google drive
Memtest86 has a feature to create text/html reports.
If possible, please include the reports with the images in the share links.

7) Run:

Crucial System Scanner | Memory Upgrade Scanner | Crucial | Crucial.com

Post a link into this thread.

Code:

------------------------
Disk & DVD/CD-ROM Drives
------------------------
      Drive: C:
 Free Space: 3.9 GB
Total Space: 237.9 GB
File System: NTFS
      Model: Samsung SSD 960 EVO 250GB

      Drive: D:
 Free Space: 11.3 GB
Total Space: 113.9 GB
File System: NTFS
      Model: INTEL SSDSC2CT120A3

      Drive: E:
 Free Space: 618.3 GB
Total Space: 953.9 GB
File System: NTFS
      Model: CT1000MX500SSD1

      Drive: G:
 Free Space: 3.7 GB
Total Space: 15.4 GB
File System: FAT32
      Model: n/a

ubuysa · 16 Apr 2023

I certainly agree with the above that this has all the hallmarks of flaky RAM, so running Memtest86 is a priority. The free version of Memtest only does four iterations of the 13 different tests. There is a school of thought that says that running 8 sequential iterations is a more stressful test. Assuming the first four iterations find no errors, it would be useful (if you can) to re-start Memtest86 after it completes the first four iterations and let it do another four. Note that even a single error is a failure. In that case remove one stick and re-run Memtest86 on each stick in turn.

Even Metest86 cannot detect every possible RAM glitch, so the ultimate RAM test is to remove one stick and run on just one for a day or two. Then swap the sticks and run on just the other one. That will tell you whether one stick is flaky or not.

In the five dumps there are multiple and unrelated third-party drivers highlighted as potential causes...

For the 041623-8375-01.dmp dump...

Code:

ffffb106`2521b9f0  fffff803`94c22000 rt640x64+0x112000
ffffb106`2521b9f8  fffff803`94becdb4 rt640x64+0xdcdb4
ffffb106`2521ba00  ffffe50d`e38de000
ffffb106`2521ba08  ffffb106`2521ba30
ffffb106`2521ba10  fffff803`87db3001 ndis!PktMonClientNotify+0x1

The rt640x64.sys driver is the Realtek packet filter driver, a component of your network adapter. This driver is quite old, dating from 2019...

Code:

7: kd> lmDvmrt640x64
Browse full module list
start             end                 module name
fffff800`5fb10000 fffff800`5fc2c000   rt640x64   (deferred)             
    Image path: \SystemRoot\System32\drivers\rt640x64.sys
    Image name: rt640x64.sys
    Browse all global symbols  functions  data
    Timestamp:        Mon Jul  1 10:38:21 2019 (5D19B86D)
    CheckSum:         00129BD5
    ImageSize:        0011C000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:

The Gigabyte support site for your board has a more recent driver dated May 2020, it would be worth installing this

For the 041623-10203-01.dmp dump...

Code:

ffff8308`75a7d4f8  fffff802`868531e6 NETIO!RtlGetNextExpiredTimerWheelEntry+0x116
ffff8308`75a7d500  00000000`00000010
ffff8308`75a7d508  00000000`00010206
ffff8308`75a7d510  ffff8308`75a7d528
ffff8308`75a7d518  00000000`00000018
ffff8308`75a7d520  00000000`00057e69
ffff8308`75a7d528  fffff802`8698127a tcpip!TcpProcessExpiredTcbTimers+0x9a
ffff8308`75a7d530  ffff880f`f6262270

The tcpip.sys and NETIO.sys drivers are Windows drivers (so not at fault) related of course to network processing. There are no third-party drivers on this call stack, that is suggestive of a hardware cause.

For the 041623-15218-01.dmp dump...

Code:

ffff8209`31505960  00000000`00000010
ffff8209`31505968  fffff806`709ab244 nvlddmkm+0xab244
ffff8209`31505970  00000000`00000000
ffff8209`31505978  fffff806`709cbd42 nvlddmkm+0xcbd42
ffff8209`31505980  ffff8209`31505a30

The nvlddmkm.sys driver is the Nvidia graphics driver. It's dated Feb 2023 so is quite recent...

Code:

7: kd> lmDvmnvlddmkm
Browse full module list
start             end                 module name
fffff800`6c3f0000 fffff800`6fc84000   nvlddmkm   (deferred)             
    Image path: \SystemRoot\System32\DriverStore\FileRepository\nv_dispig.inf_amd64_abf7e4e84f20581c\nvlddmkm.sys
    Image name: nvlddmkm.sys
    Browse all global symbols  functions  data
    Timestamp:        Fri Feb 24 23:47:28 2023 (63F93070)
    CheckSum:         0379570D
    ImageSize:        03894000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:

There is an updated driver on the Nvidia driver site dated May 2023, it might be worth installing this?

For the 041623-16968-01.dmp dump...

Code:

fffff504`4e8f2998  fffff800`4d8dd158 nt!KeWaitForMultipleObjects+0x318
fffff504`4e8f29a0  ffffe38a`00000000
fffff504`4e8f29a8  fffff800`5fc47672 RTKVHD64+0x17672
fffff504`4e8f29b0  00000000`00000000
fffff504`4e8f29b8  00000000`00000000
fffff504`4e8f29c0  fffff504`4e8f2a40
fffff504`4e8f29c8  fffff800`4e219230 nt!ExpTaggedPoolLock

The RTKVHD64.sys driver is the Realtek audio driver, this driver is very old, dating from 2017...

Code:

7: kd> lmDvmRTKVHD64
Browse full module list
start             end                 module name
fffff800`5fc30000 fffff800`60228000   RTKVHD64 T (no symbols)           
    Loaded symbol image file: RTKVHD64.sys
    Image path: \SystemRoot\system32\drivers\RTKVHD64.sys
    Image name: RTKVHD64.sys
    Browse all global symbols  functions  data
    Timestamp:        Tue Nov 14 13:05:07 2017 (5A0ACDE3)
    CheckSum:         005D18F5
    ImageSize:        005F8000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:

The Gigabyte support site for your board has a more recent driver dated July 2022, it would be worth installing this.

For the 041623-8890-01.dmp dump...

Code:

ffffaa83`d546cb80  00000000`00000019
ffffaa83`d546cb88  fffff806`24542777 kbdclass!KeyboardClassHandleRead+0xa7
ffffaa83`d546cb90  ffffcc01`7af54d40

The kbdclass.sys is a Windows keyboard class driver, so it's not at fault, but it does suggest that a keyboard operation was in progress. There are no third-party driver on this call stack either, suggesting a hardware cause.

Despite a couple of older drivers, which might be problematic, I think flaky RAM is the most likely common denominator here.

monkeymonk · 16 Apr 2023

Thank you all for your replies! I'm slowly working through each step but I have a few questions:

@Samuria
Is there a particular malware scan you would recommend? Is Malwarebytes okay?

@zbook
When I looked up how to move the pagefile it led me to this (this was before I started tinkering with it):

Increasingly frequent BSODs, stop codes change each time-pagefile-before.png

Am I understanding correctly that this means the pagefile was already on C:?
I was also able to locate the actual file on C: but could not find the same on D:

Increasingly frequent BSODs, stop codes change each time-pagefile-c-drive-before-.png

Anyhow I have changed it so it looks like this now (I wasn't sure how big to make it):

Increasingly frequent BSODs, stop codes change each time-pagefile-after.png

Is this correct? Should I change the sizes?

And for step 5), just to clarify is this asking me to reinstall Windows completely? Sorry I'm not sure what exactly "install to desktop" means, I'm reluctant to wipe Windows completely at this point but I can if you think it's required.

Here are the links for step 3):
Tuneup.log - Google Drive
RAM_info.txt - Google Drive

@ubuysa
My apologies, I was under the impression that Windows automatically searches and updates these drivers for me. I'll go ahead and update all the ones you've linked now! I already updated the nvidia drivers when I reinstalled with DDU last night, but a BSOD did happen when I initially tried to reinstall after uninstalling, would it be worth doing this again? This is the currently installed version:

Increasingly frequent BSODs, stop codes change each time-screenshot-2023-04-16-221505.png

Also when you say "The tcpip.sys and NETIO.sys drivers are Windows drivers (so not at fault)" and "The kbdclass.sys is a Windows keyboard class driver, so it's not at fault", what do you mean by it's not at fault?

I will try to run Memtest86 tonight.
Also should I keep uploading new minidump files as they happen?

Thank you everyone!!

Update: I just checked the pagefile settings again after restarting my PC and it seems to have reverted back to its previous size (10gb) and state (system managed)... Is this normal?

Update 2: I just tried to create a system restore point for step 4) and it gave me this:

Increasingly frequent BSODs, stop codes change each time-system-restore-vss-error.png

I don't know what this means... but I have seen this VSS thing before in Event Viewer as I mentioned in my first post

ubuysa · 16 Apr 2023

Please keep uploading minidumps, also include a description of what you were doing at the time.

Regarding Windows drivers being 'not at fault'; all BSOD analysts assume that Windows (Microsoft) drivers are perfect, and thus never the cause of a BSOD. In practice they generally are perfect, and are so well tested and installed in so many systems that they're never the real cause. As a general rule, when we have a dump that contains only Windows drivers on the call stack, then a hardware problem is the most likely cause. My purpose in mentioning that above was to show that RAM is a much more likely cause of these BSODs.

Regarding the paging file, you always want it on the fastest storage device you have - and that's also true of Windows, you want it on the fastest device you have. Thus the paging file should generally be on the system drive. As for sizing, using the 'system managed' option is by far the best choice. In part this is because when a BSOD happens, the memory dump is written initially to the paging file, if it's system managed it can (under some circumstances) be expanded to fit the dump in, but if it's manually specified and not big enough then no dump is written. For the same reason you should select 'automatic memory dump' on the dump type selection.

In addition, when you manually specify the paging file sizes you're actually saying that you know more about how to manage virtual memory than Windows does. And you simply don't.

monkeymonk · 16 Apr 2023

Ah got it, thanks!
Sorry I got confused because zbook asked me to move the pagefile from D: to C: but when I went to do that it already appeared to be on C: ...I thought maybe if I set the size manually it would be *more* on C:? Lol yeah that logic makes no sense to me either, I'm in way over my head here! Anyway, I've changed the pagefile back to system managed, although it seems to be doing that by itself anyway...

I've attached the latest minidumps from today - I believe they all happened while I was reinstalling something (Apex Legends) through Steam.

I also just restarted my PC again after changing the pagefile to system managed, and was greeted with this:

Increasingly frequent BSODs, stop codes change each time-20230416_232331.jpg

This screen has occurred a few times over the last few weeks, usually after a string of BSODs but I'm usually able to get back in to Windows with the first option. As far as I can tell there was no BSOD occurring right before this instance.

- - - Updated - - -

So I was looking around the settings under System Properties > Advanced > Start-up and Recovery, to double check if it was on "automatic memory dump" (it was), but when I ticked "Automatically restart" and clicked OK it gave me this:

Increasingly frequent BSODs, stop codes change each time-screenshot-2023-04-17-000142.png

Even though the pagefile does appear to be enabled and definitely over 800mb? Here are the pagefile settings currently:

Increasingly frequent BSODs, stop codes change each time-pagefile-current.png

I'm getting more and more confused lol sorry!

ubuysa · 16 Apr 2023

How much free space is on your C: drive? It sounds as though there's not enough space for a big enough paging file on that drive. An easy way to get that info (for all drives) is by opening a PowerShell session and entering the command 'get-psdrive -psprovider filesystem' (without the quotes). Post a screen shot of that output.

monkeymonk · 16 Apr 2023

Currently it's at 60gb, I cleared a bunch of stuff earlier today as zbook requested:

Increasingly frequent BSODs, stop codes change each time-diskspace.png

Also just got another BSOD, this time I was validating something in Steam in the background, and browsing in Chrome.

ubuysa · 16 Apr 2023

I'd suggest that, for the pagefile issue, you select 'no paging file' on all drives (including C:) and then reboot (this will delete your existing paging file). When Windows restarts change the paging file to system managed on C:. If you still can't set a system managed paging file, download Samsung Magician and use that to run diagnostics on the 960 EVO. You might also use Magician to check for a driver update and/or a firmware update for that drive. TBH I'd do that anyway, since you mention VSS errors in your OP.

The latest dump also contains NETIO.sys and tcpip.sys in the call stack, and the bugcheck occurs immediately after the NETIO.sys call...

Code:

11: kd> knL
 # Child-SP          RetAddr               Call Site
00 ffff8b80`ffdfc158 fffff801`6b6f909e     nt!KeBugCheckEx
01 ffff8b80`ffdfc160 fffff801`6b606302     nt!HvlpVtlCallExceptionHandler+0x22
02 ffff8b80`ffdfc1a0 fffff801`6b4e58c7     nt!RtlpExecuteHandlerForException+0x12
03 ffff8b80`ffdfc1d0 fffff801`6b4e7896     nt!RtlDispatchException+0x297
04 ffff8b80`ffdfc8f0 fffff801`6b5fcd22     nt!KiDispatchException+0x186
05 ffff8b80`ffdfcfb0 fffff801`6b5fccf0     nt!KxExceptionDispatchOnExceptionStack+0x12
06 ffff9f84`57ab52b8 fffff801`6b60fd65     nt!KiExceptionDispatchOnExceptionStackContinue
07 ffff9f84`57ab52c0 fffff801`6b60b35a     nt!KiExceptionDispatch+0x125
08 ffff9f84`57ab54a0 fffff801`6ec531e6     nt!KiGeneralProtectionFault+0x31a
09 ffff9f84`57ab5638 fffff801`6ed805fe     NETIO!RtlGetNextExpiredTimerWheelEntry+0x116
0a ffff9f84`57ab5640 fffff801`6b48b57e     tcpip!TcpPeriodicTimeoutHandler+0xf4e
0b ffff9f84`57ab5860 fffff801`6b48a864     nt!KiExecuteAllDpcs+0x30e
0c ffff9f84`57ab59d0 fffff801`6b60050e     nt!KiRetireDpcList+0x1f4
0d ffff9f84`57ab5c60 00000000`00000000     nt!KiIdleLoop+0x9e

This is the third similar dump so I think you may well be looking at a networking issue. Since NETIO.sys and tcpip.sys are Windows drivers we need to look lower in the networking stack at the third-party adapter driver. I suggest you download the Intel Driver & Support Assistant and use that to look for an updated driver for your Intel wireless card.