Hi comrade ,
There were 6 BSOD mini dump files debugged.
Some of them displayed WHEA 124 error which is very often hardware problems
The event logs display drive bad blocks and MFT corruption
The event logs display multiple Windows fast startup failed.
1) What is the history of hard drive problems?
2) What is the history of malware problems?
3) When did you first have CPU problems and what system problems did you notice
4) Had you had other problems with MB, RAM, GPU, PSU, etc?
5) Are your files backed up?
6) Had you made an image of the drive?
7) Have you had booting problems?
8) Have you been doing any over clocking?
A) Create a brand new restore point now!
B) Attempt to make a backup image of your drive using Macrium: Macrium Software | Your image is everything
The Macrium backup may fail when there is MFT corruption.
With the drive corruption its worth a shot.
Open administrative command prompt and type or copy and paste:
9) sfc /scannow
10) dism /online /cleanup-image /restorehealth
11) When these have completed > right click on the top bar or title bar of the administrative command prompt box > left click on edit then select all > right click on the top bar again > left click on edit then copy > paste into the thread
12) msconfig (in the pop up system configuration > move the dot from normal startup to selective startup > uncheck load startup items > click service tab > in left lower corner check hide all Microsoft services > in the lower right side click disable all > click apply or ok > do not reboot)
13) taskmgr (in the pop up task manager > click on the start up tab > click on status so that the column sorts with enable rising to the top > right click on each row with enable and change to disable)
https://support.microsoft.com/en-us/...oot-in-windows
How to perform a Clean Boot in Windows 10 - TechNet Articles - United States (English) - TechNet Wiki
14) shutdown /r (you will reboot the computer so that it is in clean boot)
Evaluate the performance on your computer in clean boot during typical use.
Are the boots faster or slower?
Are the shutdowns faster or slower?
How has the audio and video performance changed? Is it better, worse, or the same?
Continue using clean boot indefinitely to monitor performance.
15) Turn off Windows fast startup:
Turn On or Off Fast Startup in Windows 10 Windows 10 Performance Maintenance Tutorials
16) open administrative command prompt and type chkdsk /x /f /r (this may take many hours so plan to run overnight)
17) post the chkdsk results into the thread:
Read Chkdsk Log in Event Viewer in Windows 10 Windows 10 Performance Maintenance Tutorials
18) Make sure that there is no over clocking while troubleshooting.
Sometimes there are problems in the bios that produce bsod.
The bios in your computer: BIOS Version/Date LENOVO FBKTCCAUS, 21-Nov-16
19) Please check to see if this is the most up to date version.
20) To ensure that there are no improper bios settings please reset the bios.
Sometimes there can be failure to boot after resetting the bios.
So please make sure your files are backed up.
Please make a backup image with Macrium:
Macrium Software | Macrium Reflect Free: Macrium Software | Your image is everything
And please create a restore point.
How to Clear Your Computers CMOS to Reset BIOS Settings:
How to Clear Your Computers CMOS to Reset BIOS Settings
3 Ways to Reset Your BIOS - wikiHow:
3 Ways to Reset Your BIOS - wikiHow
21) When testing for WHEA hardware errors we need to systematically check CPU, GPU, memory and drive.
Once the bios is reset and there is no overclocking:
22) Choose one of the temperature monitoring software applications: Speecy, HW monitor, Speed fan:
Speccy - Free Download - Piriform: Speccy - System Information - Free Download
HWMONITOR | Softwares | CPUID: HWMONITOR | Softwares | CPUID
SpeedFan - Access temperature sensor in your computer: SpeedFan - Access temperature sensor in your computer
23) download and install the Intel Processor Diagnostic Tool
When the test completes please use the Microsoft snipping tool to post an image into the thread.
Download Intel® Processor Diagnostic Tool: Download Intel® Processor Diagnostic Tool
The Intel® Processor Diagnostic Tool: The Intel® Processor Diagnostic Tool
24) Run Prime95 - Stress Test Your CPU
Prime95 - Stress Test Your CPU Windows 10 Performance Maintenance Tutorials
Prime95 - Stress Test Your CPU Windows 10 Performance Maintenance Tutorials
Please use the Microsoft snipping tool to post images into the thread.
Take Screenshot in Windows 10 Windows 10 General Tips Tutorials
25) Run memtest86+ version 5.01 for at least 8 passes.
This may take hours so plan to run it overnight.
Memtest86+ - Advanced Memory Diagnostic Tool
Memory problems. - Microsoft Community
When Memtest86+ has completed 8 or more passes use a camera or smart phone to make an image of the results to post into the thread.
MemTest86+ - Test RAM Windows 10 BSOD Tutorials
MemTest86+ needs to be run for at least 8 complete passes for conclusive results. Set it running before you go to bed and leave it overnight. We're looking for zero errors here. Even a single error will indicate RAM failure.
Make a photo of the result and post it.
Addition:
If errors show up you can stop the test, remove all sticks but 1 and test this single stick in each slot for 8 passes or until errors show, switch sticks and repeat.
If errors show up and you see them a lot later, no problem, the errors don't affect the test.
26) Run HD Sentinel:
Hard Disk Sentinel - HDD health and temperature monitoring
When it has completed please use the Microsoft snipping to make an image and post into the thread.
Take Screenshot in Windows 10 Windows 10 General Tips Tutorials
27) Run FurMark - GPU Stress Test Windows 10 Performance Maintenance Tutorials
Please make note of the importance of temperature monitoring and aborting the test in the GPU link.
FurMark - GPU Stress Test Windows 10 Performance Maintenance Tutorials:
FurMark - GPU Stress Test Windows 10 Performance Maintenance Tutorials
All of these test should be done with the bios reset and no over clocking.
For each of the above tests please record maximum temperatures.
And please make sure that you use the Microsoft snipping tool to post images of each into the thread.
Take Screenshot in Windows 10 Windows 10 General Tips Tutorials
Type referenced: nt!_WHEA_XPF_PROCESSOR_ERROR_SECTION
Code:
Proc. Info 0 @ ffffe0019ecfc240===============================================================================Section 2 : x86/x64 MCA-------------------------------------------------------------------------------Descriptor @ ffffe0019ecfc138Section @ ffffe0019ecfc2c0Offset : 664Length : 264Flags : 0x00000000Severity : Fatal
[CODE]BugCheck 124, {0, ffffe0019ecfc028, be000000, 800400}[CODE]
Code:
WHEA_UNCORRECTABLE_ERROR (124)A fatal hardware error has occurred. Parameter 1 identifies the type of errorsource that reported the error. Parameter 2 holds the address of theWHEA_ERROR_RECORD structure that describes the error conditon.Arguments:Arg1: 0000000000000000, Machine Check ExceptionArg2: ffffe0001f0f0028, Address of the WHEA_ERROR_RECORD structure.Arg3: 00000000be000000, High order 32-bits of the MCi_STATUS value.Arg4: 0000000000800400, Low order 32-bits of the MCi_STATUS value.
Code:
A corruption was discovered in the file system structure on volume C:.The Master File Table (MFT) contains a corrupted file record. The file reference number is 0x1000000040603. The name of the file is "\Windows\CbsTemp\30606939_771198001\Package_3524_for_KB4025344~31bf3856ad364e35~amd64~~10.0.1.13.mum".
Code:
A corruption was discovered in the file system structure on volume C:.A corruption was found in a file system index structure. The file reference number is 0x5000000036f75. The name of the file is "\Windows\CbsTemp\30606939_771198001". The corrupted index attribute is ":$I30:$INDEX_ALLOCATION".
Code:
A corruption was discovered in the file system structure on volume C:.The Master File Table (MFT) contains a corrupted file record. The file reference number is 0x1000000040604. The name of the file is "\Windows\CbsTemp\30606939_771198001\Package_3524_for_KB4025344~31bf3856ad364e35~amd64~~10.0.1.13.cat".
Code:
A corruption was discovered in the file system structure on volume C:.The Master File Table (MFT) contains a corrupted file record. The file reference number is 0x1000000040605. The name of the file is "\Windows\CbsTemp\30606939_771198001\Package_3525_for_KB4025344~31bf3856ad364e35~amd64~~10.0.1.13.mum".
Code:
A corruption was discovered in the file system structure on volume C:.The Master File Table (MFT) contains a corrupted file record. The file reference number is 0x1000000040606. The name of the file is "\Windows\CbsTemp\30606939_771198001\Package_3525_for_KB4025344~31bf3856ad364e35~amd64~~10.0.1.13.cat".
Code:
The device, \Device\Harddisk0\DR0, has a bad block.
Code:
The dump file at location: C:\Windows\MEMORY.DMP was deleted because the disk volume had less than 25 GB free space.
Code:
A corruption was discovered in the file system structure on volume C:.The Master File Table (MFT) contains a corrupted file record. The file reference number is 0x1000000000000. The name of the file is "<unable to determine file name>".
Code:
A corruption was discovered in the file system structure on volume C:.The Master File Table (MFT) contains a corrupted file record. The file reference number is 0x10000000408f9. The name of the file is "\Windows\CbsTemp\30606939_771198001\Package_3902_for_KB4025344~31bf3856ad364e35~amd64~~10.0.1.13.cat".
Code:
Event[14576]: Log Name: System Source: disk Date: 2017-07-27T11:16:28.065 Event ID: 7 Task: N/A Level: Error Opcode: N/A Keyword: Classic User: N/A User Name: N/A Computer: DESKTOP-NQU57FK Description: The device, \Device\Harddisk0\DR0, has a bad block.
Code:
Windows failed fast startup with error status 0xC00000D4.
Code:
0: kd> !errrec ffffe000814e8028===============================================================================Common Platform Error Record @ ffffe000814e8028-------------------------------------------------------------------------------Record Id : 01d307a1981b4980Severity : Fatal (1)Length : 928Creator : MicrosoftNotify Type : Machine Check ExceptionTimestamp : 7/28/2017 13:35:23 (UTC)Flags : 0x00000000===============================================================================Section 0 : Processor Generic-------------------------------------------------------------------------------Descriptor @ ffffe000814e80a8Section @ ffffe000814e8180Offset : 344Length : 192Flags : 0x00000001 PrimarySeverity : FatalProc. Type : x86/x64Instr. Set : x64Error Type : Micro-Architectural ErrorFlags : 0x00CPU Version : 0x00000000000306c3Processor ID : 0x0000000000000000===============================================================================Section 1 : x86/x64 Processor Specific-------------------------------------------------------------------------------Descriptor @ ffffe000814e80f0Section @ ffffe000814e8240Offset : 536Length : 128Flags : 0x00000000Severity : FatalLocal APIC Id : 0x0000000000000000CPU Id : c3 06 03 00 00 08 10 00 - ff fb fa 7f ff fb eb bf 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00Proc. Info 0 @ ffffe000814e8240===============================================================================Section 2 : x86/x64 MCA-------------------------------------------------------------------------------Descriptor @ ffffe000814e8138Section @ ffffe000814e82c0Offset : 664Length : 264Flags : 0x00000000Severity : FatalError : Internal timer (Proc 0 Bank 4) Status : 0xbe00000000800400 Address : 0xfffff802f5e6191f Misc. : 0xfffff802f5e6191f
Code:
BugCheck BE, {fffff801979a78f8, 800000000f05c121, ffffd000ce7bab40, a}Probably caused by : fwpkclnt.sys ( fwpkclnt!FwppNetBufferListAssociateContext+f7 )
Code:
2: kd> !errrec ffffe0019ecfc028===============================================================================Common Platform Error Record @ ffffe0019ecfc028-------------------------------------------------------------------------------Record Id : 01d307a68a1bbf54Severity : Fatal (1)Length : 928Creator : MicrosoftNotify Type : Machine Check ExceptionTimestamp : 7/28/2017 15:59:41 (UTC)Flags : 0x00000000===============================================================================Section 0 : Processor Generic-------------------------------------------------------------------------------Descriptor @ ffffe0019ecfc0a8Section @ ffffe0019ecfc180Offset : 344Length : 192Flags : 0x00000001 PrimarySeverity : FatalProc. Type : x86/x64Instr. Set : x64Error Type : Micro-Architectural ErrorFlags : 0x00CPU Version : 0x00000000000306c3Processor ID : 0x0000000000000002===============================================================================Section 1 : x86/x64 Processor Specific-------------------------------------------------------------------------------Descriptor @ ffffe0019ecfc0f0Section @ ffffe0019ecfc240Offset : 536Length : 128Flags : 0x00000000Severity : FatalLocal APIC Id : 0x0000000000000002CPU Id : c3 06 03 00 00 08 10 02 - ff fb fa 7f ff fb eb bf 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00Proc. Info 0 @ ffffe0019ecfc240===============================================================================Section 2 : x86/x64 MCA-------------------------------------------------------------------------------Descriptor @ ffffe0019ecfc138Section @ ffffe0019ecfc2c0Offset : 664Length : 264Flags : 0x00000000Severity : FatalError : Internal timer (Proc 2 Bank 4) Status : 0xbe00000000800400 Address : 0xfffff80288e9a106 Misc. : 0xfffff80288e9a106
Code:
0: kd> !errrec ffffe0001f0f0028===============================================================================Common Platform Error Record @ ffffe0001f0f0028-------------------------------------------------------------------------------Record Id : 01d30759523a9659Severity : Fatal (1)Length : 928Creator : MicrosoftNotify Type : Machine Check ExceptionTimestamp : 7/28/2017 7:45:00 (UTC)Flags : 0x00000000===============================================================================Section 0 : Processor Generic-------------------------------------------------------------------------------Descriptor @ ffffe0001f0f00a8Section @ ffffe0001f0f0180Offset : 344Length : 192Flags : 0x00000001 PrimarySeverity : FatalProc. Type : x86/x64Instr. Set : x64Error Type : Micro-Architectural ErrorFlags : 0x00CPU Version : 0x00000000000306c3Processor ID : 0x0000000000000000===============================================================================Section 1 : x86/x64 Processor Specific-------------------------------------------------------------------------------Descriptor @ ffffe0001f0f00f0Section @ ffffe0001f0f0240Offset : 536Length : 128Flags : 0x00000000Severity : FatalLocal APIC Id : 0x0000000000000000CPU Id : c3 06 03 00 00 08 10 00 - ff fb fa 7f ff fb eb bf 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00Proc. Info 0 @ ffffe0001f0f0240===============================================================================Section 2 : x86/x64 MCA-------------------------------------------------------------------------------Descriptor @ ffffe0001f0f0138Section @ ffffe0001f0f02c0Offset : 664Length : 264Flags : 0x00000000Severity : FatalError : Internal timer (Proc 0 Bank 4) Status : 0xbe00000000800400 Address : 0xfffff8001a8e720b Misc. : 0xfffff8001a8e720b
Quote