Very random blue screens

[GoodBoy_Gal]

Hi. I have been having blue screens for a while now. the problem is, they don't happen that often. maybe 2 times a month or so on average. but sometimes it happens more often, and sometimes less often. At seemingly random times. sometimes while gaming, other times browsing the web. the most recent was when I opened windows updates in settings and hit check now. But I find the most common or consistent time is when I boot into windows. I have updated all drivers more times than I can count, the bios as well. I have run the built in windows mem test many times, and mem 86 once. all came back with nothing. I have run the windows sfc command a lot too. sometimes it comes back clean, other times it says it found a problem and fixed it. I keep tricking myself into thinking I have fixed the problem, because it won't happen for a month or so, then it just randomly happens. I have done a clean install of windows once too. I don't use any antivirus software. I have discord and Logitech G hub for my mouse and keyboard.

This problem is very tricky because it doesn't happen so often. it's been happening ever since I built my pc about 18 months ago. but it's really starting to annoy me. to the point where I'm motivated enough to post here and ask for help. So any help would be much appreciated. I'm not sure how I can post dump files here? so I guess that would be the first step?

Thanks

 

[GoodBoy_Gal]

Here is an overview of the last 5 crashes from Blue screen view. all of them are caused by "ntoskrnl.exe+3f6b90" not sure how helpful this is. please let me know what other info I can give/attach. looking at the dates, it's actually more frequent that I first thought. 5 or 6 times a mouth, not 2.

 

[ubuysa]

BlueScreenView and the like are not terribly useful tools. Most tools like this identify ntoskrnl.exe as the failing module simply because when a driver fouls up it's not until the Windows kernel gets control back that the error is identified and the bug check happens. The Windows kernel is ntoskrnl.exe.....

We really need to see the dumps themselves. Upload them to the cloud somewhere with a link to them here.

 

[GoodBoy_Gal]

BlueScreenView and the like are not terribly useful tools. Most tools like this identify ntoskrnl.exe as the failing module simply because when a driver fouls up it's not until the Windows kernel gets control back that the error is identified and the bug check happens. The Windows kernel is ntoskrnl.exe.....

We really need to see the dumps themselves. Upload them to the cloud somewhere with a link to them here.

Hi. Thank you very much for the quick reply.

Dump - Google Drive

drive.google.com

Here is a link to a google drive folder I just created. There are the .dmp files from the windows minidump folder. Sorry I'm very new to dump files and which ones you need. Please let me know if these are correct or not. If not, where can I find the exact files you need?

Thank you very much in advanced.

 

[ubuysa]

These minidumps are fine. Thank you.

062321-5390-01.dmp (Wed Jun 23) has a stop code of BAD_POOL_CALLER, which is an error accessing a memory pool. The exception code of 0x00000046 means that an attempt was made to free an invalid pool address. The process in control was the registry. This would appear to be a RAM issue.

062521-5062-01.dmp (Fri Jun 25) has a stop code of SYSTEM_SERVICE_EXCEPTION, which means that an exception occurred in kernel mode code. The exception code of 0xc0000005 is a memory access violation. The process in control was taskhostw.exe (which runs Windows startup services that only exist as .dlls).

There is a driver error in this dump for WDFilter.sys, this is a Windows Defender filter driver.

ffffa788`d3d92158  fffff802`39f92739Unable to load image \SystemRoot\system32\drivers\wd\WdFilter.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for WdFilter.sys
 WdFilter+0x42739

There are several things that could cause this type of error.

062921-7703-01.dmp (Mon Jun 28) has a stop code of INTERNAL_POWER_ERROR, which indicates that the power policy manager had a fatal error. The exception code of 0x00000010e indiocates an error reading from the hibernation file. This could be a system drive issue or a RAM issue

071121-5218-01.dmp (Sun Jul 11) also has a stop code of INTERNAL_POWER_ERROR. The exception code here is 0x00000107, meaning that a data mismatch has occurred in the hibernation data structures. This could be a system drive issue or a RAM issue

071321-5390-01.dmp (Tue Jul 13) has a stop code of MEMORY_MANAGEMENT, which indicates that a fatal memory error has occurred. The exception code of 0x00041792 indicates that a corrupt PTE has been detected. (PTE is a page table entry, part of the mechanism used to translate virtual addresses to real addresses).

Taken in their entirety these BSODs point pretty convincingly at your RAM. If you're overclocking your RAM then either back it off some or go back to stock frequencies for a while. If it still BSODs at stock RAM frequencies then I would download Memtest, use the tool to make a bootable USB stick and boot that USB stick - Memtest will start running. Allow Memtest to complete all four iterations of the 13 specific tests, even a single error is a failure.

 

[GoodBoy_Gal]

Thank you for the detailed reply. This is great . I also thought RAM was an issue. But I have run the windows mem test many times with no issues found. I did once run memtest86 I think it was? Off a usb drive. It also came up with nothing. However I didn't let it run the full 4 passes because it was going to take many many hours. Maybe that was my mistake. I don't over clock the ram. I just run the xmp profile to get the advertised speed of 3200Mhz. I will download memtest when I get home and let that run. Thank you for your help.

 

[GoodBoy_Gal]

These minidumps are fine. Thank you.

062321-5390-01.dmp (Wed Jun 23) has a stop code of BAD_POOL_CALLER, which is an error accessing a memory pool. The exception code of 0x00000046 means that an attempt was made to free an invalid pool address. The process in control was the registry. This would appear to be a RAM issue.

062521-5062-01.dmp (Fri Jun 25) has a stop code of SYSTEM_SERVICE_EXCEPTION, which means that an exception occurred in kernel mode code. The exception code of 0xc0000005 is a memory access violation. The process in control was taskhostw.exe (which runs Windows startup services that only exist as .dlls).

There is a driver error in this dump for WDFilter.sys, this is a Windows Defender filter driver.

ffffa788`d3d92158  fffff802`39f92739Unable to load image \SystemRoot\system32\drivers\wd\WdFilter.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for WdFilter.sys
 WdFilter+0x42739

There are several things that could cause this type of error.

062921-7703-01.dmp (Mon Jun 28) has a stop code of INTERNAL_POWER_ERROR, which indicates that the power policy manager had a fatal error. The exception code of 0x00000010e indiocates an error reading from the hibernation file. This could be a system drive issue or a RAM issue

071121-5218-01.dmp (Sun Jul 11) also has a stop code of INTERNAL_POWER_ERROR. The exception code here is 0x00000107, meaning that a data mismatch has occurred in the hibernation data structures. This could be a system drive issue or a RAM issue

071321-5390-01.dmp (Tue Jul 13) has a stop code of MEMORY_MANAGEMENT, which indicates that a fatal memory error has occurred. The exception code of 0x00041792 indicates that a corrupt PTE has been detected. (PTE is a page table entry, part of the mechanism used to translate virtual addresses to real addresses).

Taken in their entirety these BSODs point pretty convincingly at your RAM. If you're overclocking your RAM then either back it off some or go back to stock frequencies for a while. If it still BSODs at stock RAM frequencies then I would download Memtest, use the tool to make a bootable USB stick and boot that USB stick - Memtest will start running. Allow Memtest to complete all four iterations of the 13 specific tests, even a single error is a failure.

I let memtest 86 run all 4 passes. It took about 3 hours. Unfortunately it came back with zero errors. Would this result rule out RAM completely? If so, what would you suggest for the logical next step?

 

[Trouble]

Personally, I think I would look towards the primary hard disk.
I noticed a couple of your dump files referenced a problem with pointer records which might suggest an issue with virtual memory.
You might try Check Disk (chkdsk), or....
Many top tier hard disk manufacturers provide proprietary tools for checking / testing their drives.
I see in your specs that it's a Samsung Evo so I'm guessing it's relatively new, still probably worth consideration.

Is there any particular computer activity that you can associate with these crash events.

 

[ubuysa]

Personally, I think I would look towards the primary hard disk.
I noticed a couple of your dump files referenced a problem with pointer records which might suggest an issue with virtual memory.
You might try Check Disk (chkdsk), or....
Many top tier hard disk manufacturers provide proprietary tools for checking / testing their drives.
I see in your specs that it's a Samsung Evo so I'm guessing it's relatively new, still probably worth consideration.

Is there any particular computer activity that you can associate with these crash events.

Yep, it certainly could be. Memtest can't prove that your RAM is good (only that it's bad) so IMO you still need to keep that in mind as a cause. It would be wise to check your system drive now though.

FWIW I've seen a fair number of M.2 drive issues that were fixed by removing and re-seating the drive. If your drive tests don't flag up anything try re-seating it.

 

[GoodBoy_Gal]

Personally, I think I would look towards the primary hard disk.
I noticed a couple of your dump files referenced a problem with pointer records which might suggest an issue with virtual memory.
You might try Check Disk (chkdsk), or....
Many top tier hard disk manufacturers provide proprietary tools for checking / testing their drives.
I see in your specs that it's a Samsung Evo so I'm guessing it's relatively new, still probably worth consideration.

Is there any particular computer activity that you can associate with these crash events.

Ok I will try check disk next. Thank you. The Samsung Evo is only a second storage drive. My main boot drive is an nvme m.2 from Viper. They don't seem to have any tools on their website.

No not really. It is very random. If I had to say though. I think on boot up it happens the most.

 

[GoodBoy_Gal]

Yep, it certainly could be. Memtest can't prove that your RAM is good (only that it's bad) so IMO you still need to keep that in mind as a cause. It would be wise to check your system drive now though.

FWIW I've seen a fair number of M.2 drive issues that were fixed by removing and re-seating the drive. If your drive tests don't flag up anything try re-seating it.

Ok great. I will try that too. Thanks for all the help guys. This is absolutely fantastic!

 

[ubuysa]

Ok I will try check disk next. Thank you. The Samsung Evo is only a second storage drive. My main boot drive is an nvme m.2 from Viper. They don't seem to have any tools on their website.

No not really. It is very random. If I had to say though. I think on boot up it happens the most.

That could still be SSD or RAM though. If your 16GB of RAM is in two sticks, try removing one for a few days and see whether the BSODs stop. If not try swapping with the other for a few days to see whether that helps. If it BSODs on each stick then it's almost certainly not RAM and you can focus more closely on the M.2 SSD.

 

[GoodBoy_Gal]

I ran chkdsk in command prompt and also by just hitting the error checking part of the properties window on both of my drives. Only took a few seconds and said no errors were found. are there any disk checking methods or software that you would recommend? I have also just removed and reseated my m.2 drive. so fingers crossed that might have helped. I guess I can try removing a stick of RAM. I was a bit reluctant to try this step in the past because of how seldom the crashes are. Would be hard to say how long I should run my pc for with one stick, before switching to the other. and I would also be with only 8gb of RAM for a while. plus I have to remove my aio radiator to get at the RAM. I will wait for the next crash before doing that to confirm the SSD reseating didn't solve the problem. In the meantime, are there any other checks I could do? Thanks again guys.

 

[Trouble]

In the meantime, are there any other checks I could do?

Nope.
Especially if you cannot force / produce the crash.
As a matter of fact it's better to restrict your number of fixes so you have a better idea of what is producing the problem.
I remember having a particularly vexing memory issue a few years back on a brand new AMD system I had just built.
I was able chase that one down, not because I could reproduce the crash but because, MemTest86 would show substantial errors pretty quickly after beginning tests, with certain memory configuration.

As it turns out...
IF I wanted to populate all four memory slots on that particular board, I had two choices to prevent it from randomly crashing.
I could either dumb the memory down and tweak the timings to run a tiny bit less than the optimal settings advertised by the manufacturer, OR...
I could simply up the memory's voltage a small fraction of a decimal point.

 

[ubuysa]

I ran chkdsk in command prompt and also by just hitting the error checking part of the properties window on both of my drives. Only took a few seconds and said no errors were found. are there any disk checking methods or software that you would recommend? I have also just removed and reseated my m.2 drive. so fingers crossed that might have helped. I guess I can try removing a stick of RAM. I was a bit reluctant to try this step in the past because of how seldom the crashes are. Would be hard to say how long I should run my pc for with one stick, before switching to the other. and I would also be with only 8gb of RAM for a while. plus I have to remove my aio radiator to get at the RAM. I will wait for the next crash before doing that to confirm the SSD reseating didn't solve the problem. In the meantime, are there any other checks I could do? Thanks again guys.

It's always work opening an elevated command prompt or PowerShell session and running the following commands:

dism /online /cleanup-image /checkhealth

That will check your Windows component store for corruptions. If the resulting message is "No component store corruption detected" then all is well. If it's anything else it may be recoverable, let us know.

If the dism command runs clean (no corruptions detected) then run the following command:

sfc /scannow

That will check certain critical Windows system files and will take a few minutes to run. If the resulting message is "Windows Resource Protection did not find any integrity violations" then that's perfect. If it reports errors found and corrected then reboot and see how it is for a while. You can also post the CBS.log file it references up here if you like.

Those two command will at least show that your BSODs are unlikely to be Windows related.

 

[GoodBoy_Gal]

Nope.
Especially if you cannot force / produce the crash.
As a matter of fact it's better to restrict your number of fixes so you have a better idea of what is producing the problem.
I remember having a particularly vexing memory issue a few years back on a brand new AMD system I had just built.
I was able chase that one down, not because I could reproduce the crash but because, MemTest86 would show substantial errors pretty quickly after beginning tests, with certain memory configuration.

As it turns out...
IF I wanted to populate all four memory slots on that particular board, I had two choices to prevent it from randomly crashing.
I good either dumb the memory down and tweak the timings to run a tiny bit less than the optimal settings advertised by the manufacturer, OR...
I could simply up the memory's voltage a small fraction of a decimal point.

Would you suggest under clocking or over volting my RAM a tad? I could deactivate the XMP profile and see if that stops it. If so then it must be my RAM right?

 

[GoodBoy_Gal]

It's always work opening an elevated command prompt or PowerShell session and running the following commands:

dism /online /cleanup-image /checkhealth

That will check your Windows component store for corruptions. If the resulting message is "No component store corruption detected" then all is well. If it's anything else it may be recoverable, let us know.

If the dism command runs clean (no corruptions detected) then run the following command:

sfc /scannow

That will check certain critical Windows system files and will take a few minutes to run. If the resulting message is "Windows Resource Protection did not find any integrity violations" then that's perfect. If it reports errors found and corrected then reboot and see how it is for a while. You can also post the CBS.log file it references up here if you like.

Those two command will at least show that your BSODs are unlikely to be Windows related.

Perfect. Will run those commands when I get home. I will keep you posted Danke

 

[ubuysa]

Would you suggest under clocking or over volting my RAM a tad? I could deactivate the XMP profile and see if that stops it. If so then it must be my RAM right?

If your RAM is already overclocked via XMP then try removing it for a few days to see whether the BSODs stop. Generally with any BSOD the first thing you should do is remove any overclocks. If they do stop that doesn't mean your RAM is bad, it just means it's not completely stable at whatever frequency you were running.

 

[GoodBoy_Gal]

If your RAM is already overclocked via XMP then try removing it for a few days to see whether the BSODs stop. Generally with any BSOD the first thing you should do is remove any overclocks. If they do stop that doesn't mean your RAM is bad, it just means it's not completely stable at whatever frequency you were running.

Yeah, but xmp just runs the ram at the advertised speeds, so if it's not stable at speeds printed on the box, then surely that warrants a replacement or refund from Corsair wouldn't you think?

 

[ubuysa]

Yeah, but xmp just runs the ram at the advertised speeds, so if it's not stable at speeds printed on the box, then surely that warrants a replacement or refund from Corsair wouldn't you think?

Ah, then in that case it's not overclocked.

If you can prove that the RAM is not stable, and the only guaranteed way to do so is to run with one stick at a time, then assuming it's in warranty Corsair will replace it. But you need proof which you don't have yet - it could still be the SSD for example.