experiencing random crashes

J0ker · Jul 22, 2016

Need some help analyzing my crash dump files, I honestly have no idea what any of it means

https://www.dropbox.com/sh/l38y87mv5zic02p/AAAASWFuVM3ZqSnI4T9XK7tRa?dl=0

EDIT: link to my thread on sysnative https://www.sysnative.com/forums/bsod-crashes-kernel-debugging/20694-multiple-bsod-windows-10-a.html

Thanks!

mimart7 · Jul 23, 2016

J0ker said:
Need some help analyzing my crash dump files, I honestly have no idea what any of it means

https://www.dropbox.com/sh/l38y87mv5zic02p/AAAASWFuVM3ZqSnI4T9XK7tRa?dl=0

Thanks!

User Nirsoft Blue Screen View, http://www.nirsoft.net/utils/blue_screen_view.html

satrow · Jul 23, 2016

SYSTEM UP-TIME

Code:

System Uptime: 0 days 0:00:35.117
System Uptime: 0 days 0:00:26.000
System Uptime: 0 days 0:00:28.950
System Uptime: 0 days 0:17:12.273
System Uptime: 6 days 2:27:12.730

[A lot of the debugging data is listed in newest first order, like the above, and Stack texts where given, read them from the bottom up.]

So we see that the PC has been stable and then went rapidly downhill, the 2 oldest crashes were very similar 0x4E with different subtypes, these are almost always driver-related:

http://www.carrona.org/bsodindx.html#0x0000004E: PFN_LIST_CORRUPT
Usual causes: Device driver, ?memory

Next up, 3x crashes during boot, the first called by a Windows security driver, then Avast self-reporting that it's own file in memory is corrupt, lastly, what looks like an NTFS call that hits a file not found type error.

Stop any overclocking, check that all hardware/cables etc. are firmly seated.

Boot into Safe Mode with Networking and see if it's stable - just allow it to sit there, check System logs for other clues, check TaskMan for oddities.

If it's stable, you need to check for malware, root/bootkits, etc., run disk checks and SFC /Scannow and have them all checked/analysed.

You have several drivers loaded that, at least in older Windows versions but not necessarily your file versions, have been known to cause or be implemented in, BSODs - CPU-Z, Corsair drivers, XBox controller drivers and, most recently and maybe the first thing to check out, Avast, which has been seen to cause some file corruption issues that can't be repaired by SFC. They'll need checking/updating where possible or removed during troubleshooting.

I think your best bet is to start at the Sysnative forum, they have experts with BSODs, malware and SFC/Windows Updates (with some recent topics on the Avast/SFC/corruption problem), etc.

Of course, if you're already a member elsewhere with similar experts (they might even be the same ones anyway!), I've no objection to you seeking help there - but, where ever you go, give us a link and keep us updated on your progress, please.

Lot's of data and some links, etc., for info only:

Code:

BugCheck 1E, {ffffffffc0000005, fffff80125c0b235, 0, 1000011a4}
Probably caused by : NTFS.sys ( NTFS!NtfsPostUsnChangeWithOverrideOption+11d )
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
BugCheck 50, {ffffc000f2365000, 2, fffff8031a33f808, 0}
Probably caused by : aswSnx.sys ( aswSnx+6af3 )
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
BugCheck C000021A, {ffffc00144400410, ffffffffc0000005, 7ff84f389c8b, a2e93e980}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::OKHAJAOM::`string'+775 )
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
BugCheck 4E, {99, 1ff636, 0, 80000000015fe36}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+37d88 )
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
BugCheck 4E, {8d, 1461c2, 450800, ffffc0007a589448}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4b024 )
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``

Code:

Debug session time: Sat Jul 23 02:40:33.429 2016 (UTC + 1:00)
Loading Dump File [C:\Users\Me\SysnativeBSODApps\072216-4375-01.dmp]
Built by: 10586.494.amd64fre.th2_release_sec.160630-1736
System Uptime: 0 days 0:00:35.117
Probably caused by : NTFS.sys ( NTFS!NtfsPostUsnChangeWithOverrideOption+11d )
BugCheck 1E, {ffffffffc0000005, fffff80125c0b235, 0, 1000011a4}
BugCheck Info: [url=http://www.carrona.org/bsodindx.html#0x0000001E]KMODE_EXCEPTION_NOT_HANDLED (1e)[/url]
Bugcheck code 0000001E
Arguments: 
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80125c0b235, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 00000001000011a4, Parameter 1 of the exception
BUGCHECK_STR:  0x1E_c0000005_R
PROCESS_NAME:  CorsairLink4.S
FAILURE_BUCKET_ID:  0x1E_c0000005_R_NTFS!NtfsPostUsnChangeWithOverrideOption
MaxSpeed:     4000
CurrentSpeed: 4000
BiosVersion = 2702
BiosReleaseDate = 10/27/2015
SystemManufacturer = ASUS
BaseBoardManufacturer = ASUSTeK COMPUTER INC.
SystemProductName = All Series
BaseBoardProduct = SABERTOOTH Z97 MARK 2/USB 3.1
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Sat Jul 23 02:37:13.312 2016 (UTC + 1:00)
Loading Dump File [C:\Users\Me\SysnativeBSODApps\072216-4984-01.dmp]
Built by: 10586.494.amd64fre.th2_release_sec.160630-1736
System Uptime: 0 days 0:00:26.000
*** WARNING: Unable to verify timestamp for aswSnx.sys
*** ERROR: Module load completed but symbols could not be loaded for aswSnx.sys
Probably caused by : aswSnx.sys ( aswSnx+6af3 )
BugCheck 50, {ffffc000f2365000, 2, fffff8031a33f808, 0}
BugCheck Info: [url=http://www.carrona.org/bsodindx.html#0x00000050]PAGE_FAULT_IN_NONPAGED_AREA (50)[/url]
Bugcheck code 00000050
Arguments: 
Arg1: ffffc000f2365000, memory referenced.
Arg2: 0000000000000002, value 0 = read operation, 1 = write operation.
Arg3: fffff8031a33f808, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000000, (reserved)
BUGCHECK_STR:  AV
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
PROCESS_NAME:  steamwebhelper
FAILURE_BUCKET_ID:  AV_INVALID_aswSnx!Unknown_Function
MaxSpeed:     4000
CurrentSpeed: 4000
BiosVersion = 2702
BiosReleaseDate = 10/27/2015
SystemManufacturer = ASUS
BaseBoardManufacturer = ASUSTeK COMPUTER INC.
SystemProductName = All Series
BaseBoardProduct = SABERTOOTH Z97 MARK 2/USB 3.1
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Thu Jul 21 07:48:53.263 2016 (UTC + 1:00)
Loading Dump File [C:\Users\Me\SysnativeBSODApps\072116-6281-01.dmp]
Built by: 10586.494.amd64fre.th2_release_sec.160630-1736
System Uptime: 0 days 0:00:28.950
Probably caused by : ntkrnlmp.exe ( nt! ?? ::OKHAJAOM::`string'+775 )
BugCheck C000021A, {ffffc00144400410, ffffffffc0000005, 7ff84f389c8b, a2e93e980}
BugCheck Info: [url=http://www.carrona.org/bsodindx.html#0xC000021A]WINLOGON_FATAL_ERROR (c000021a)[/url]
Bugcheck code c000021A
Arguments: 
Arg1: ffffc00144400410, String that identifies the problem.
Arg2: ffffffffc0000005, Error Code.
Arg3: 00007ff84f389c8b
Arg4: 0000000a2e93e980
Arg2: ffffffffc0000005, Error Code.
PROCESS_NAME:  csrss.exe
BUGCHECK_STR:  0xc000021a_c0000005_csrss.exe_Terminated
FAILURE_BUCKET_ID:  0xc000021a_c0000005_csrss.exe_Terminated_nt!_??_::OKHAJAOM::_string_
MaxSpeed:     4000
CurrentSpeed: 4000
BiosVersion = 2702
BiosReleaseDate = 10/27/2015
SystemManufacturer = ASUS
BaseBoardManufacturer = ASUSTeK COMPUTER INC.
SystemProductName = All Series
BaseBoardProduct = SABERTOOTH Z97 MARK 2/USB 3.1
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Thu Jul 21 07:31:53.584 2016 (UTC + 1:00)
Loading Dump File [C:\Users\Me\SysnativeBSODApps\072116-4093-01.dmp]
Built by: 10586.494.amd64fre.th2_release_sec.160630-1736
System Uptime: 0 days 0:17:12.273
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+37d88 )
BugCheck 4E, {99, 1ff636, 0, 80000000015fe36}
BugCheck Info: [url=http://www.carrona.org/bsodindx.html#0x0000004E]PFN_LIST_CORRUPT (4e)[/url]
Bugcheck code 0000004E
Arguments: 
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 00000000001ff636, page frame number
Arg3: 0000000000000000, current page state
Arg4: 080000000015fe36, 0
BUGCHECK_STR:  0x4E_99
PROCESS_NAME:  WWAHost.exe
FAILURE_BUCKET_ID:  0x4E_99_nt!_??_::FNODOBFM::_string_
MaxSpeed:     4000
CurrentSpeed: 4000
BiosVersion = 2702
BiosReleaseDate = 10/27/2015
SystemManufacturer = ASUS
BaseBoardManufacturer = ASUSTeK COMPUTER INC.
SystemProductName = All Series
BaseBoardProduct = SABERTOOTH Z97 MARK 2/USB 3.1
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Wed Jul 20 09:30:17.044 2016 (UTC + 1:00)
Loading Dump File [C:\Users\Me\SysnativeBSODApps\072016-5000-01.dmp]
Built by: 10586.494.amd64fre.th2_release_sec.160630-1736
System Uptime: 6 days 2:27:12.730
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4b024 )
BugCheck 4E, {8d, 1461c2, 450800, ffffc0007a589448}
BugCheck Info: [url=http://www.carrona.org/bsodindx.html#0x0000004E]PFN_LIST_CORRUPT (4e)[/url]
Bugcheck code 0000004E
Arguments: 
Arg1: 000000000000008d, 
Arg2: 00000000001461c2
Arg3: 0000000000450800
Arg4: ffffc0007a589448
BUGCHECK_STR:  0x4E_8d
PROCESS_NAME:  System
FAILURE_BUCKET_ID:  0x4E_8d_nt!_??_::FNODOBFM::_string_
MaxSpeed:     4000
CurrentSpeed: 4000
BiosVersion = 2702
BiosReleaseDate = 10/27/2015
SystemManufacturer = ASUS
BaseBoardManufacturer = ASUSTeK COMPUTER INC.
SystemProductName = All Series
BaseBoardProduct = SABERTOOTH Z97 MARK 2/USB 3.1
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``

*** 3rd PARTY DRIVER LIST ***

Code:

AsIO.sys                    Wed Aug 22 10:54:47 2012 (5034AC67)
CorsairVBusDriver.sys       Wed May  6 14:10:40 2015 (554A12D0)
CorsairVHidDriver.sys       Wed May  6 14:10:41 2015 (554A12D1)
DevAuthE.sys                Fri Oct 30 02:47:14 2015 (5632DA32)
HWiNFO64A.SYS               Tue Mar 31 10:51:32 2015 (551A6E24)
TeeDriverW8x64.sys          Tue Jul  7 18:43:32 2015 (559C0FC4)
aswHwid.sys                 Mon Jun 20 12:31:29 2016 (5767D411)
aswKbd.sys                  Mon Jun 20 12:31:49 2016 (5767D425)
aswMonFlt.sys               Mon Jun 20 12:31:35 2016 (5767D417)
aswRdr2.sys                 Mon Jun 20 12:32:13 2016 (5767D43D)
aswRvrt.sys                 Mon Jun 20 12:31:24 2016 (5767D40C)
aswSP.sys                   Tue Jul 12 16:51:06 2016 (578511EA)
aswSP.sys                   Mon Jun 27 13:29:01 2016 (57711C0D)
aswSnx.sys                  Mon Jun 20 12:32:27 2016 (5767D44B)
aswStm.sys                  Mon Jun 20 12:54:57 2016 (5767D991)
aswVmm.sys                  Mon Jun 20 12:48:57 2016 (5767D829)
cpuz139_x64.sys             Wed Jan 27 09:18:15 2016 (56A88B57)
cthda.sys                   Thu May 12 04:18:04 2016 (5733F5EC)
cthdb.sys                   Thu May 12 04:18:34 2016 (5733F60A)
dc1-controller.sys          Fri Oct 30 02:46:54 2015 (5632DA1E)
e1i63x64.sys                Thu Mar 26 20:24:57 2015 (55146B19)
intelppm.sys                Fri Oct 30 02:09:51 2015 (5632D16F)
ksUSBaud.sys                Wed Mar 23 05:17:17 2016 (56F226DD)
nvlddmkm.sys                Wed Jun 29 17:58:45 2016 (5773FE45)
xboxgip.sys                 Tue Feb 23 09:20:35 2016 (56CC2463)
xinputhid.sys               Tue Mar 29 09:16:55 2016 (56FA39F7)

J0ker · Jul 23, 2016

Thanks for the help. When I run a SSD, HDD, and RAM tests all come back fine. When I run SFC I get a message that some files couldn't be repaired, how would go about looking into those files?

https://www.sysnative.com/forums/bsod-crashes-kernel-debugging/20694-multiple-bsod-windows-10-a.html

mimart7 · Jul 23, 2016

J0ker said:
Thanks for the help. When I run a SSD, HDD, and RAM tests all come back fine. When I run SFC I get a message that some files couldn't be repaired, how would go about looking into those files?

https://www.sysnative.com/forums/bsod-crashes-kernel-debugging/20694-multiple-bsod-windows-10-a.html

Run this in a command prompt as admin:

Dism /Online /Cleanup-Image /RestoreHealth

J0ker · Jul 23, 2016

I get an error about needing a source

mimart7 · Jul 23, 2016

J0ker said:
I get an error about needing a source

You shouldn't get that error. However, you look at this:

http://www.tenforums.com/tutorials/7808-dism-repair-windows-10-image.html

satrow · Jul 23, 2016

Sysnative have an SFCFix tool and a specific section for WU/SFC issues, though it might be better initially to keep all your issues/replies in the original BSOD topic.

SFCFix instructions

Also give them full details/logs from any other scans done.

EDIT: Windows 10 -- Avast causing corrupt manifest files Fix

J0ker · Jul 24, 2016

So after checking the log file for the SFC scan I found that opencl.dll is corrupt. I'm at work now, so I can't do anymore troubleshooting tonight -_-

J0ker · Jul 24, 2016

C:\Windows\system32>SFC /Scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.

Fixed the corrupt opencl.dll

satrow · Jul 24, 2016

Fixed by just removing Avast (from the Sysnative topic), or did you run the SFCFix routine as well?

J0ker · Jul 24, 2016

I ran the SFCFix. I read up that nvidia drivers trigger this corruption

satrow · Jul 24, 2016

Nice work.

I've also read reports of Intel's driver being another cause, I use an Intel CPU without a GPU component plus a 970, I don't see the 'corruption'/FP. It would be interesting to find out exactly what causes it, but that's for another topic, I guess.

experiencing random crashes

J0ker

Registered

mimart7

Member

satrow

Member

J0ker

Registered

mimart7

Member

J0ker

Registered

mimart7

Member

satrow

Member

J0ker

Registered

J0ker

Registered

satrow

Member

J0ker

Registered

satrow

Member

Similar threads