BSoD's after 10 minutes idle

idespisebsods · 14 Jul 2017

Upon startup, my desktop yielded two files from the tool. I don't know if they're what you need, but they're in the attached zipped folder.

axe0 · 14 Jul 2017

Hi idespisebsods,

Those files are not what is needed.

Please wait until the tool tells it is finished :)

idespisebsods · 14 Jul 2017

Okay, for whatever reason, pressing a key to finish and exit out of the script formatted both the folders it outputs? So I just avoided doing that as was suggested a few posts ago.
I'm not illiterate with computers, I swear... :'(

I had to remove a few .dmp files in order to post it, but there are still pleeeenty. I'm also gonna hold off from doing an in place upgrade until I have nothing else to turn to.

zbook · 14 Jul 2017

Hi idespisebsods ,

In the log there were 39 bsod. The most recent 10 were debugged.
In the event log there were many dump file creation failed events so you likely had more than 50 bsod in the past 23 days.
With this many bsod it could be related to memory/MB problems so there will be tests performed to rule in /rule out hardware problems.
The event logs indicated file corruptions especially multiple drivers.
Antivirus software drivers were identified as misbehaving drivers and the software needs to be uninstalled.
Hardware drivers were identified as misbehaving drivers and should be uninstalled and reinstalled.

The results of sfc scannow and dism restore health will be important in consideration of starting the troubleshooting with a windows 10 1703 repair installation. Please post these results early in the troubleshooting.

Open administrative command prompt and type or copy and paste:

1) winver (in the pop up about windows > view your windows version and build > type this information into the thread)

2) sfc /scannow

3) dism /online /cleanup-image /restorehealth

4) chkdsk /scan

When these have completed > right click on the top bar or title bar of the administrative command prompt box > left click on edit then select all > right click on the top bar again > left click on copy > paste into the thread

5) perform windows updates and post any failed KB# with error code into the thead

6) Make sure that there is no over clocking while troubleshooting.

Sometimes there are problems in the bios that produce bsod.

7) To ensure that there are no improper bios settings please reset the bios.

Sometimes there can be failure to boot after resetting the bios.

8) So please make sure your files are backed up.

9) Please make a backup image with Macrium: Macrium Software | Macrium Reflect Free:
Macrium Software | Your image is everything

10) And please create a restore point.

How to Clear Your Computers CMOS to Reset BIOS Settings:

How to Clear Your Computers CMOS to Reset BIOS Settings

3 Ways to Reset Your BIOS - wikiHow:3 Ways to Reset Your BIOS - wikiHow

11) Run memtest86+ version 5.01 for at least 8 runs.

This may take many hours so plan to run it overnight.

http://www.memtest.org/When Memtest86+ has completed 8 or more runs make an image of the results to post into the thread.

Memory problems. - Microsoft Community

Windows 10 Forums)

12) run one of the SMART tests on your drives:CrystalDiskInfo - Software - Crystal Dew World:
CrystalDiskMark - Software - Crystal Dew World

Software - Crystal Dew World

HD Tune: http://www.hdtune.com/

Hard Disk Sentinel - HDD health and temperature monitoring:

Hard Disk Sentinel - HDD health and temperature monitoring

When the SMART test has completed open the Microsoft snipping tool and make images of the results to post into the thread.

13) Uninstall all Nvidia drivers/software

The best way to do this is to uninstall everything of Nvidia using Display Driver Uninstaller and install new drivers from your from the NVidia website.
When you do this be sure the "clean install" box is checked and only install the Graphics driver and the PhysX driver.
Display Driver Uninstaller Download version 17.0.6.7: Official Display Driver Uninstaller DDU Download

14) Uninstall: Webroot antivirus using the control panel
Then use the Webroot uninstall tool: Installation Support
Do not reinstall this antivirus software during the troubleshooting
Instead turn on Microsoft Windows defender

15) Uninstall: Intel rapid storage technology using the control panel
reinstall: Downloads for IntelÂ® Rapid Storage Technology (IntelÂ® RST)

16) Uninstall: Intel Pro/1000 Network Adapter driver using device manager
reinstall: Software and Drivers for the IntelÂ® PRO/100 Adapter

17) Uninstall: all Focusrite software FocusriteUSB.sys using device manager
reinstall: USB Audio Interfaces | Focusrite

18) turn off windows fast startup:
Turn On or Off Fast Startup in Windows 10 Windows 10 Performance Maintenance Tutorials

Code:

BugCheck 139, {3, ffff8001e6d0f3d0, ffff8001e6d0f328, 0}Probably caused by : ntkrnlmp.exe ( nt!KiFastFailDispatch+d0 )

Code:

fffff803`a7985778  fffff809`32ca08d2Unable to load image \SystemRoot\System32\drivers\iaStorA.sys, Win32 error 0n2*** WARNING: Unable to verify timestamp for iaStorA.sys*** ERROR: Module load completed but symbols could not be loaded for iaStorA.sys iaStorA+0xa08d2

Code:

iaStorA      Intel Chipset SATA RAI Intel Chipset SATA RAI Kernel        Boot       Running    OK         TRUE        FALSE        4,096             782,336     0          3/17/2017 10:32:24 AM  C:\WINDOWS\system32\drivers\iaStorA.sys          4,096

iaStorA.sys

Intel RST (Rapid Storage Technology) driver

http://downloadcenter.intel.com/Default.aspx XP

Code:

BugCheck A, {40, 2, 1, fffff803a4f05c41}Probably caused by : ntkrnlmp.exe ( nt!KiTryUnwaitThread+31 )

Code:

BugCheck A, {34, 2, 0, fffff8025ff2ac29}*** WARNING: Unable to verify checksum for win32k.sysProbably caused by : memory_corruption

Code:

ffffac00`4a118128  fffff80e`6954ac5cUnable to load image \SystemRoot\System32\drivers\WRkrn.sys, Win32 error 0n2*** WARNING: Unable to verify timestamp for WRkrn.sys*** ERROR: Module load completed but symbols could not be loaded for WRkrn.sys WRkrn+0xac5c

Code:

WRkrn        WRkrn                  WRkrn                  Kernel        Boot       Running    OK         TRUE        FALSE        8,192             65,536      0          5/25/2017 12:49:29 PM  C:\WINDOWS\system32\drivers\WRkrn.sys            8,192

WRkrn.sys

Webroot SecureAnywhere Essentials driver
Webroot SecureAnywhere Anti-virus driver

http://www.webroot.com/En_US/consumer.html

Code:

ffffac00`4a117338  fffff80e`6a58c565Unable to load image \SystemRoot\system32\DRIVERS\e1d65x64.sys, Win32 error 0n2*** WARNING: Unable to verify timestamp for e1d65x64.sys*** ERROR: Module load completed but symbols could not be loaded for e1d65x64.sys e1d65x64+0x1c565

Code:

e1dexpress   Intel(R) PRO/1000 PCI  Intel(R) PRO/1000 PCI  Kernel        Manual     Running    OK         TRUE        FALSE        4,096             421,888     0          8/13/2015 5:14:29 AM   C:\WINDOWS\system32\DRIVERS\e1d65x64.sys         4,096

e1d65x64.sys

Intel Pro/1000 Network Adapter driver

https://downloadcenter.intel.com/

Code:

BugCheck 3B, {c0000005, fffff802834b7cd7, ffffac004a117cf0, 0}*** WARNING: Unable to verify checksum for win32k.sysProbably caused by : memory_corruption

Code:

BugCheck 4E, {99, 10a393, 2, e0001a0001a8948}*** WARNING: Unable to verify checksum for win32k.sysProbably caused by : memory_corruption

Code:

BugCheck 1A, {41792, ffff860000004118, 1000, 0}*** WARNING: Unable to verify checksum for win32k.sysProbably caused by : memory_corruption

Code:

ffffc281`51a6b830  fffff808`a0b94c00Unable to load image \SystemRoot\System32\drivers\iaStorA.sys, Win32 error 0n2*** WARNING: Unable to verify timestamp for iaStorA.sys*** ERROR: Module load completed but symbols could not be loaded for iaStorA.sys iaStorA+0x84c00

Code:

BugCheck 1000007E, {ffffffffc0000005, fffff8031ad136a6, ffffc28151a6c5a8, ffffc28151a6bdf0}*** WARNING: Unable to verify checksum for win32k.sysProbably caused by : memory_corruption

Code:

fffff800`59b85628  fffff80c`ddde6ce3Unable to load image \SystemRoot\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_2386fda73b467ac8\nvlddmkm.sys, Win32 error 0n2*** WARNING: Unable to verify timestamp for nvlddmkm.sys*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys nvlddmkm+0x1c6ce3

nvlddmkm.sys

nVidia Video drivers

http://www.nvidia.com/Download/index.aspx
Get from OEM for laptops

Code:

fffff800`59b85158  fffff80c`dbeb6ae1Unable to load image \SystemRoot\System32\drivers\FocusriteUSB.sys, Win32 error 0n2*** WARNING: Unable to verify timestamp for FocusriteUSB.sys*** ERROR: Module load completed but symbols could not be loaded for FocusriteUSB.sys FocusriteUSB+0x6ae1

Code:

FocusriteUSB Focusrite USB          Focusrite USB          Kernel        Manual     Running    OK         TRUE        FALSE        4,096             61,440      0          6/8/2017 7:58:59 AM    C:\WINDOWS\system32\drivers\FocusriteUSB.sys     4,096      FocusriteUSB Focusrite USB Audio    Focusrite USB Audio    Kernel        Manual     Running    OK         TRUE        FALSE        0                 24,576      0          6/8/2017 7:58:42 AM    C:\WINDOWS\system32\drivers\FocusriteUSBAudio.sy 4,096      
FocusriteUSB Focusrite USB MIDI     Focusrite USB MIDI     Kernel        Manual     Running    OK         TRUE        FALSE        0                 20,480      0          6/8/2017 7:58:45 AM    C:\WINDOWS\system32\drivers\FocusriteUSBMidi.sys 4,096      
FocusriteUSB USB Audio Root         USB Audio Root         Kernel        Manual     Running    OK         TRUE        FALSE        4,096             65,536      0          6/8/2017 7:58:52 AM    C:\WINDOWS\system32\drivers\FocusriteUSBSwRoot.s 4,096

Code:

BugCheck A, {c0, 2, 0, fffff800570843ae}Probably caused by : afd.sys ( afd!AfdCompletePollIrp+8b )

Code:

ffff9180`75286a48  fffff808`abf5da01Unable to load image \SystemRoot\System32\drivers\WRkrn.sys, Win32 error 0n2*** WARNING: Unable to verify timestamp for WRkrn.sys*** ERROR: Module load completed but symbols could not be loaded for WRkrn.sys WRkrn+0xda01

WRkrn.sys

Webroot SecureAnywhere Essentials driver
Webroot SecureAnywhere Anti-virus driver

http://www.webroot.com/En_US/consumer.html

Code:

BugCheck 3B, {c0000005, fffff8014b987154, ffff918075284fc0, 0}Probably caused by : memory_corruption

Code:

BugCheck 3B, {c0000005, fffff800194b20ff, ffff9901a57cead0, 0}*** WARNING: Unable to verify checksum for win32k.sysProbably caused by : memory_corruption

Code:

{Registry Hive Recovered} Registry hive (file): '\SystemRoot\System32\config\DRIVERS' was corrupted and it has been recovered. Some data might have been lost.

Code:

The following file necessary for Windows startup was corrupt: d:\windows\system32\ntoskrnl.exe

Code:

The following file necessary for Windows startup was corrupt: d:\windows\system32\drivers\wrkrn.sys

Code:

The following file necessary for Windows startup was corrupt: D:\TDI.SYS

Code:

The following file necessary for Windows startup was corrupt: D:\NDIS.SY

Code:

The following file necessary for Windows startup was corrupt: d:\werkernel.sys

Code:

The following file necessary for Windows startup was corrupt: d:\windows\system32\drivers\partmgr.sys

Code:

Windows failed fast startup with error status 0xC00000D4.

Code:

Dump file creation failed due to error during dump creation.

idespisebsods · 15 Jul 2017

winvr turned up Version 1703 (OS Build 15063.483). Also, I've already tried 8 passes of memtest86 and recently found out that the problem doesn't persist in safe mode. So that should eliminate the need to test hardware, right?

Here are the results of the other command prompt entries:

Microsoft Windows [Version 10.0.15063](c) 2017 Microsoft Corporation. All rights reserved.C:\WINDOWS\system32>winverC:\WINDOWS\system32>sfc /scannowBeginning system scan. This process will take some time.Beginning verification phase of system scan.Verification 100% complete.Windows Resource Protection found corrupt files but was unable to fix someof them. Details are included in the CBS.Log windir\Logs\CBS\CBS.log. Forexample C:\Windows\Logs\CBS\CBS.log. Note that logging is currently notsupported in offline servicing scenarios.C:\WINDOWS\system32>dism /online /cleanup-image /restorehealthDeployment Image Servicing and Management toolVersion: 10.0.15063.0Image Version: 10.0.15063.0[==========================100.0%==========================]Error: 0x800f081fThe source files could not be found.Use the "Source" option to specify the location of the files that are required to restore the feature. For more information on specifying a source location, see MSN.com - Hotmail, Outlook, Skype, Bing, Latest News, Photos Videos DISM log file can be found at C:\WINDOWS\Logs\DISM\dism.logC:\WINDOWS\system32>chkdsk /scanThe type of the file system is NTFS.Stage 1: Examining basic file system structure ... 277504 file records processed.File verification completed. 5906 large file records processed. 0 bad file records processed.Stage 2: Examining file name linkage ... 339512 index entries processed.Index verification completed. 0 unindexed files scanned. 0 unindexed files recovered to lost and found.Stage 3: Examining security descriptors ...Security descriptor verification completed. 31005 data files processed.CHKDSK is verifying Usn Journal... 41449024 USN bytes processed.Usn Journal verification completed.Windows has scanned the file system and found no problems.No further action is required. 243618815 KB total disk space. 54546760 KB in 161696 files. 109784 KB in 31006 indexes. 0 KB in bad sectors. 395647 KB in use by the system. 65536 KB occupied by the log file. 188566624 KB available on disk. 4096 bytes in each allocation unit. 60904703 total allocation units on disk. 47141656 allocation units available on disk.C:\WINDOWS\system32>

axe0 · 15 Jul 2017

So that should eliminate the need to test hardware, right?

Not really, unfortunately.
In safe mode not everything of the system is being used, when safe mode gives no problems it means only the part that has been used seems proper, but there is no way in telling what part has been used.

zbook · 15 Jul 2017

Which Antivirus products have you used over the past few months?
Which one's are you using now in addition to Microsoft Windows defender?
The full 39 dump files were debugged.
The most frequent misbehaving driver was: WRkrn.sys
One new misbehaving driver was found in the remaining minidump files: MBAMChameleon.sys
Please use the control panel and uninstall all Malwarebytes software.
Please make sure that Windows defender is the only antivirus product in use during the troubleshooting.

Scannow reported that the operating system has corruption.
It was not able to fix the corruption.
Restorehealth was not able to fix the corruption.
It would be nice if you could rule in or rule out hardware problems by using safe mode.
Nobody has reported the duration of time, whether 1 minute or 1 week is sufficient time for accuracy of this type of testing.
For the Memtest86+ testing if there are fewer than 8 passes the number of false negatives is too large to make the test accuracy useful. So all testing has true negatives, true positives, false negatives, false positives, and accuracy. The aim is to find a test that can be performed with known or desired accuracy.

For the operating system open administrative command prompt and type or copy and paste:

1) sfc /scannow (repeat this two times for a total of three times)
2) dism /online /cleanup-image /checkhealth
3) dism /online /cleanup-image /scanhealth
4) dism /online /cleanup-image /restorehealth

When these commands have completed please post the results into the thread.

Find a flash drive that you can format.
Create a bootable windows 10 iso: Download Windows 10

Code:

ffff9780`3eda34f8  fffff80e`ff2b4eb8Unable to load image \SystemRoot\system32\drivers\MBAMChameleon.sys, Win32 error 0n2*** WARNING: Unable to verify timestamp for MBAMChameleon.sys*** ERROR: Module load completed but symbols could not be loaded for MBAMChameleon.sys MBAMChameleon+0x24eb8

Code:

ffffe280`af882838  fffff80e`c8334d50Unable to load image \SystemRoot\system32\drivers\MBAMChameleon.sys, Win32 error 0n2*** WARNING: Unable to verify timestamp for MBAMChameleon.sys*** ERROR: Module load completed but symbols could not be loaded for MBAMChameleon.sys MBAMChameleon+0x24d50

Code:

Event[134]:  Log Name: System  Source: Service Control Manager  Date: 2017-04-20T09:33:21.968  Event ID: 7045  Task: N/A  Level: Information  Opcode: N/A  Keyword: Classic  User: S-1-5-18  User Name: NT AUTHORITY\SYSTEM  Computer: DESKTOP-QFUDV14  Description: A service was installed in the system.Service Name:  MBAMChameleonService File Name:  \SystemRoot\system32\drivers\MBAMChameleon.sysService Type:  kernel mode driverService Start Type:  auto startService Account:

Code:

Event[191]:  Log Name: System  Source: Microsoft-Windows-FilterManager  Date: 2017-04-20T09:33:58.406  Event ID: 6  Task: N/A  Level: Information  Opcode: Info  Keyword: N/A  User: S-1-5-18  User Name: NT AUTHORITY\SYSTEM  Computer: DESKTOP-QFUDV14  Description: File System Filter 'MBAMChameleon' (6.3, ?2016?-?11?-?19T15:13:08.000000000Z) has successfully loaded and registered with Filter Manager.

Code:

Event[6870]:  Log Name: System  Source: Service Control Manager  Date: 2017-06-28T22:10:18.473  Event ID: 7045  Task: N/A  Level: Information  Opcode: N/A  Keyword: Classic  User: S-1-5-21-2467530947-2136463203-715072996-1001  User Name: DESKTOP-QFUDV14\Avery Devine  Computer: DESKTOP-QFUDV14  Description: A service was installed in the system.Service Name:  MBAMServiceService File Name:  "C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe"Service Type:  user mode serviceService Start Type:  demand startService Account:  LocalSystem

Code:

Event[6872]:  Log Name: System  Source: Service Control Manager  Date: 2017-06-28T22:10:19.676  Event ID: 7045  Task: N/A  Level: Information  Opcode: N/A  Keyword: Classic  User: S-1-5-18  User Name: NT AUTHORITY\SYSTEM  Computer: DESKTOP-QFUDV14  Description: A service was installed in the system.Service Name:  MBAMSwissArmyService File Name:  C:\WINDOWS\system32\drivers\MBAMSwissArmy.sysService Type:  kernel mode driverService Start Type:  demand startService Account:

idespisebsods · 15 Jul 2017

Okay, I just uninstalled Webroot. There wasn't any Malwarebytes to uninstall from my control panel and for some reason, I can't locate MBAMchameleon.sys in my driver folder. I tried a removal tool and it couldn't locate anything MBAM related on my computer. Weird.

Here are the results of the command prompt entries. I made a typo then fixed it:

Microsoft Windows [Version 10.0.15063](c) 2017 Microsoft Corporation. All rights reserved.C:\WINDOWS\system32>sfc /scannowBeginning system scan. This process will take some time.Beginning verification phase of system scan.Verification 100% complete.Windows Resource Protection found corrupt files but was unable to fix someof them. Details are included in the CBS.Log windir\Logs\CBS\CBS.log. Forexample C:\Windows\Logs\CBS\CBS.log. Note that logging is currently notsupported in offline servicing scenarios.C:\WINDOWS\system32>sfc /scannowBeginning system scan. This process will take some time.Beginning verification phase of system scan.Verification 100% complete.Windows Resource Protection found corrupt files but was unable to fix someof them. Details are included in the CBS.Log windir\Logs\CBS\CBS.log. Forexample C:\Windows\Logs\CBS\CBS.log. Note that logging is currently notsupported in offline servicing scenarios.C:\WINDOWS\system32>sfc /scannowBeginning system scan. This process will take some time.Beginning verification phase of system scan.Verification 100% complete.Windows Resource Protection found corrupt files but was unable to fix someof them. Details are included in the CBS.Log windir\Logs\CBS\CBS.log. Forexample C:\Windows\Logs\CBS\CBS.log. Note that logging is currently notsupported in offline servicing scenarios.C:\WINDOWS\system32>dism /online /cleanup-image /checkhealthDeployment Image Servicing and Management toolVersion: 10.0.15063.0Image Version: 10.0.15063.0The component store is repairable.The operation completed successfully.C:\WINDOWS\system32>dism /online /cleanup-image scanhealthError: 87DISM doesn't recognize the command-line option "scanhealth".For more information, refer to the help by running DISM.exe /?.The DISM log file can be found at C:\WINDOWS\Logs\DISM\dism.logC:\WINDOWS\system32>dism /online /cleanup-image /scanhealthDeployment Image Servicing and Management toolVersion: 10.0.15063.0Image Version: 10.0.15063.0[==========================100.0%==========================] The component store is repairable.The operation completed successfully.C:\WINDOWS\system32>dism /online /cleanup-image /restorehealthDeployment Image Servicing and Management toolVersion: 10.0.15063.0Image Version: 10.0.15063.0[===========================94.7%====================== ]Error: 0x800f081fThe source files could not be found.Use the "Source" option to specify the location of the files that are required to restore the feature. For more information on specifying a source location, see MSN.com - Hotmail, Outlook, Skype, Bing, Latest News, Photos Videos DISM log file can be found at C:\WINDOWS\Logs\DISM\dism.logC:\WINDOWS\system32>

zbook · 15 Jul 2017

If you are on a metered connection please make sure that is no longer metered and using administrative command prompt type: dism /online /cleanup-image /restorehealth

If you are not on a metered connection of if restorehealth fails to complete or fails to make the needed repairs:

1) find a flash drive that you can format
2) create a bootable windows 10 iso:
Download Windows 10
3) plan to perform an in place upgrade repair saving files and applications. In case the in place upgrade repair fails plan to perform a clean install with installation of windows 10 version 1703.
4) create a new restore point
5) back up your files
6) make an image of the drive using Macrium:
Macrium Software | Your image is everything

Method to perform an in place upgrade repair:
1) power on and boot to the desktop
2) open file explorer
3) insert the bootable windows 10 iso flash drive into any USB port
4) locate the USB windows 10 iso within file explorer and click on it to open it
5) look for the file/folder setup or setup.exe
6) click on this folder and when it opens look in the left lower corner for repair this computer
7) run through the in place upgrade repair menu using this link:
Repair Install Windows 10 with an In-place Upgrade Windows 10 Installation Upgrade Tutorials

For Memtest86+ please post an image into the thread displaying 8 or more passes.

idespisebsods · 16 Jul 2017

After uninstalling Webroot completely and performing an in-place upgrade, the problem seeeeems to be gone. I'm not sure if it was Webroot or a faulty Windows update that caused OS corruption, but either way, I'm going to stay away from antiviruses other than Windows Defender for a while.

Thank you so much to everyone who took the time to help out! You're the best.