BSOD after Windows left idle.

katcj · 06 Mar 2017

Hello, Ever since I upgraded to Windows 10 from Window 7 back in July I have been experiencing random crashes. Sometimes I try something (removing a program, updating a driver) and that seems to fix it for a bit, but then it comes back.
The one consistent pattern is that it happens after some period of leaving the computer idle. It usually takes between 5 to 15 minutes for it to crash.
If I run a virtual "jiggling" program to simulate mouse movement there is no crash.
If the machine is waiting at the login screen there is no crash.
I have a dual boot system and I have experienced no problems running Linux which should rule out a hardware problem.

Things I have checked:

drivers - IO Bit Driver Booster says everything is up to date.
I am running in High performance power mode .
- PCI Link State Power management is off.
- no wireless adapter currently plugged in - just a wired LAN.
- HD - turn off HD after 0 minutes.
Screen timeout is 15 minutes but it doesn't seem connected - recently it will crash in less than 15 min.
Ran Memtest86+ overnight (2 passes) and it didn't find anything
I have done a System refresh a couple times but the crashes always come back.

Log collector data is attached. Any help is greatly appreciated!

lifetec · 06 Mar 2017

All the latest dumpfile point to problems with your memory.

Code:

 BugCheck 12B, {ffffffffc00002c4, 409, bc14320, ffffd881e7c90000}

Probably caused by : hardware ( REGION_PAGED_OUT )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

FAULTY_HARDWARE_CORRUPTED_PAGE (12b)
This bugcheck indicates that a single bit error was found in this page.  This is a hardware memory error.

BugCheck 1A, {61948, 4039747, 1, 4039747}

Probably caused by : memory_corruption

Followup: memory_corruption
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)

BugCheck 50, {ffffd3c2336be028, 0, fffff800b0afa065, 2}


Could not read faulting driver name
Probably caused by : memory_corruption

Followup: memory_corruption
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.

Please start with diagnosing the system RAM first. You can use the free tool "Memtest86+" to stress test the RAM.

How to run "Memtest"
MemTest86+ - Test RAM - Windows 10 BSOD Tutorials
Make sure you are using the latest version 5.01 - Memtest86+ - Advanced Memory Diagnostic Tool

You can stop the test even if a single error is found during the test. Otherwise continue the test for 8-10 passes and post a screenshot with next reply. 8 passes is the recommended bare minimum but more passes will give better result.

katcj · 08 Mar 2017

8 passes and no errors. (had to stop at 25 hours)

katcj · 08 Mar 2017

Just got another crash but this time it looks like it might be Avast.

Code:

On Wed 8.Mar.2017 4:09:21 PM GMT your computer crashed
crash dump file: C:\WINDOWS\Minidump\030817-25578-01.dmp
This was probably caused by the following module: aswmonflt.sys (0xFFFFF80B1D4227B0) 
Bugcheck code: 0x50 (0xFFFF950D2C1DD7B8, 0x0, 0xFFFFF80B1D4227B0, 0x2)
Error: PAGE_FAULT_IN_NONPAGED_AREA
Bug check description: This indicates that invalid system memory has been referenced.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. 
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: aswmonflt.sys . 
Google query: aswmonflt.sys PAGE_FAULT_IN_NONPAGED_AREA

going to see what I can find in Avast BSODs to see if that leads anywhere.

katcj · 08 Mar 2017

that was short lived. uninstalled Avast and then ran Avast uninstall utility. Just now got another BSOD.

Code:

On Wed 8.Mar.2017 8:32:37 PM GMT your computer crashed
crash dump file: C:\WINDOWS\Minidump\030817-25453-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x14A6F0)
Bugcheck code: 0x1A (0x41793, 0xFFFFF301D055D3D8, 0xC, 0xB)
Error: MEMORY_MANAGEMENT
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a severe memory management error occurred.
This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

On Wed 8.Mar.2017 8:32:37 PM GMT your computer crashed
crash dump file: C:\WINDOWS\memory.dmp
This was probably caused by the following module: ntdll.sys (ntdll!NtFreeVirtualMemory+0x14)
Bugcheck code: 0x1A (0x41793, 0xFFFFF301D055D3D8, 0xC, 0xB)
Error: MEMORY_MANAGEMENT
Bug check description: This indicates that a severe memory management error occurred.
This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: ntdll.sys .
Google query: ntdll.sys MEMORY_MANAGEMENT

Enclosing a more recent copy of collected logs.

Ztruker · 08 Mar 2017

Try disabling these in Task Manager, Startup tab:

Code:

f.lux, "C:\Users\Yo\AppData\Local\FluxSoftware\Flux\flux.exe" /noshow
3RVX, C:\Program Files (x86)\3RVX\3RVX.exe
TrayStatus, "C:\Program Files (x86)\TrayStatus\TrayStatus.exe"
GlassWire, "C:\Program Files (x86)\GlassWire\glasswire.exe" -hide
Franz, C:\ProgramData\SquirrelMachineInstalls\Franz.exe --checkInstall

The last dump was caused by aswMonFlt.sys.

Driver Description: avast! File System Minifilter Driver
Driver Update Site: Support : Avast Software

Uninstall Avast anti-virus.
Make sure Windows Defender and Windows Firewall are enabled.

Run that way for awhile to test, see if that resolves the problem.

If that doesn't resolve the problem, try Driver Verifier, see if it shows us anything:

===================================================
Driver Verifier is a diagnostic tool built into Windows 10, it is designed to verify both native Microsoft drivers and third party drivers. Driver Verifier's verification process involves putting heavy stress on drivers with the intention of making bad, outdated, incompatible or misbehaving drivers fail. The required result is a BSOD (Blue Screen of Death) which will generate a crash dump for debugging purposes.
Machines exposed to Driver Verifier will run very sluggishly due to the stress being applied to the drivers.

Driver Verifier - Enable and Disable in Windows 10

Pay close attention to

PART TWO

and make sure the correct boxes are checked.

Warning:
It is not advised to run Driver Verifier for more than 48 hours at a time. Disable Driver Verifier after 48 hours or after receiving a BSOD, whichever happens soonest.

Always create a Restore Point prior to enabling Driver Verifier.

What we're looking for is a verifier generated BSOD with a mini dump that will tell us what driver caused it.

lifetec · 09 Mar 2017

Although the memorytest showed no errors, i suspect the problem is that you are using 2 different kinds of modules/vendors in your system. Thats probably the reason some of the dumpfiles mention Memory Management
Try running your system with only the Crucial or the G-Skill memory and see if this stops the BSODs.

And you could retest your memory with only 1 kind of modules inserted.

Remember:

Unreliable RAM, in particular, is deadly as far as software is concerned, and anything other than a 100% clear memory test result is cause for concern. Unfortunately, even a 100% clear result from the diagnostics utilities does not guarantee that the RAM is free from defects - only that none were encountered during the test passes.

Although it is not exactly the same case as yours, see this link Another day, another Stop Code for some more info.

katcj · 09 Mar 2017

The RAM is at least 3 years old . There were no problems under Windows 7 and there are still no problems under Linux. Only Windows 10 , which I have been using for only 8 months, has the issues. I'm going to try the steps under #6 and see what that shows...

katcj · 27 Mar 2017

I uninstalled Avast, and it helped a little bit but the problem came back. In the meantime I had a different issue which was fixed with a Repair Upgrade.That led to a beautifuly running system for about a week until the problem came back again with BAD_POOL_HEADER and PAGE_FAULT_IN_NONPAGED_AREA BSODs

I followed the instructions to run Driver Verifier but the system wouldn't even boot - I immediately got DRIVER_VERIFIER_IOMANAGER_VIOLATION BSOD just after startup begins - it doesnt make it to the login screen. At least with the issue at hand it is only after login.

Ideas on where to go from here? Or how to get Driver Verifier working usefully? Recent log collector data is attached. thanks in advance for the help.

lifetec · 29 Mar 2017

The driver verifier dumpfile is blaming

Code:

  BugCheck C9, {22e, fffff800922a33a0, ffffd780c0e8aa60, 0}

*** WARNING: Unable to verify timestamp for uvhid.sys
*** ERROR: Module load completed but symbols could not be loaded for uvhid.sys
Probably caused by : memory_corruption

Followup: memory_corruption
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_VERIFIER_IOMANAGER_VIOLATION (c9)
The IO manager has caught a misbehaving driver.
Arguments:
Arg1: 000000000000022e, The caller has completed a successful IRP_MJ_PNP instead of passing it down.
Arg2: fffff800922a33a0, The address in the driver's code where the error was detected.
Arg3: ffffd780c0e8aa60, IRP address.
Arg4: 0000000000000000

uvhid.sys

Driver Description: Unified Remote HID Mini Driver for Unified Virtual HID
Driver Update Site: Download: Download Unified Remote
Support: Help Unified Remote

See if there is a newer version or uninstall.