Blue screen after every full night shutdown.

Discussion in 'Windows 10 Blue Screen of Death (BSOD)' started by SnowManBawb, Feb 25, 2016.

  1. SnowManBawb

    Joined:
    Feb 25, 2016
    Messages:
    54
    Likes Received:
    1
    Hello.



    So, I've had this problem with my pc for a while now and I just have no idea what the problem might be anymore. Ive tried posting on different sites but no one answered.



    Here is the problem every time my pc has been shut down for longer then an hour, the next boot up will end up in a blue screen displaying a different error code each time. Here are is few ive seen.



    IRQL_NOT_LESS_OR_EQUAL



    KMODE_EXCEPTION_NOT_HANDLED


    Sometimes the blue screen will happen 10 minutes after it has fully started sometimes right after i log in.



    Here are my specs.



    • CPU Intel Core i5-4440 3.10 GHZ

    • Motherboard Asus H87M-PLUS

    • RAM 2 4gb sticks of Corsair DDR3 vengance ram

    • GPU Asus strix R9 390

    • Case Fractal Design Core 1000

    • Storage Samsung 850 evo 250 gb, 500GB Seagate ST500DM002, and a 1 tb external

    • PSU Corsair CS750M

    Ive also ran Windgb and here are the results based on the latest blue screen.
    Here is what it came up with. :(


    Microsoft (R) Windows Debugger Version 10.0.10586.567 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Windows\Minidump\021516-4484-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: srv*
    Executable search path is:
    Windows 10 Kernel Version 10586 MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 10586.103.amd64fre.th2_release.160126-1819
    Machine Name:
    Kernel base = 0xfffff802`e1404000 PsLoadedModuleList = 0xfffff802`e16e2cf0
    Debug session time: Mon Feb 15 15:26:13.882 2016 (UTC + 2:00)
    System Uptime: 0 days 0:02:20.537
    Loading Kernel Symbols
    .

    Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
    Run !sym noisy before .reload to track down problems loading symbols.

    ..............................................................
    ................................................................
    ..................................................
    Loading User Symbols
    Loading unloaded module list
    .........
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 139, {4, ffffe0018343dd60, ffffe0018343dcb8, 0}

    Probably caused by : ntkrnlmp.exe ( nt!KiFastFailDispatch+d0 )

    Followup: MachineOwner
    ---------

    3: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    KERNEL_SECURITY_CHECK_FAILURE (139)
    A kernel component has corrupted a critical data structure. The corruption
    could potentially allow a malicious user to gain control of this machine.
    Arguments:
    Arg1: 0000000000000004, The thread's stack pointer was outside the legal stack
    extents for the thread.
    Arg2: ffffe0018343dd60, Address of the trap frame for the exception that caused the bugcheck
    Arg3: ffffe0018343dcb8, Address of the exception record for the exception that caused the bugcheck
    Arg4: 0000000000000000, Reserved

    Debugging Details:
    ------------------


    DUMP_CLASS: 1

    DUMP_QUALIFIER: 400

    BUILD_VERSION_STRING: 10586.103.amd64fre.th2_release.160126-1819

    SYSTEM_MANUFACTURER: ASUS

    SYSTEM_PRODUCT_NAME: All Series

    SYSTEM_SKU: All

    SYSTEM_VERSION: System Version

    BIOS_VENDOR: American Megatrends Inc.

    BIOS_VERSION: 0306

    BIOS_DATE: 04/07/2013

    BASEBOARD_MANUFACTURER: ASUSTeK COMPUTER INC.

    BASEBOARD_PRODUCT: H87M-PLUS

    BASEBOARD_VERSION: Rev X.0x

    DUMP_TYPE: 2

    DUMP_FILE_ATTRIBUTES: 0x8
    Kernel Generated Triage Dump

    BUGCHECK_P1: 4

    BUGCHECK_P2: ffffe0018343dd60

    BUGCHECK_P3: ffffe0018343dcb8

    BUGCHECK_P4: 0

    TRAP_FRAME: 4b6778440205000e -- (.trap 0x4b6778440205000e)
    Unable to read trap frame at 4b677844`0205000e

    EXCEPTION_RECORD: 0000000000820003 -- (.exr 0x820003)
    Cannot read Exception record @ 0000000000820003

    CPU_COUNT: 4

    CPU_MHZ: c1c

    CPU_VENDOR: GenuineIntel

    CPU_FAMILY: 6

    CPU_MODEL: 3c

    CPU_STEPPING: 3

    CPU_MICROCODE: 6,3c,3,0 (F,M,S,R) SIG: 1E'00000000 (cache) 1E'00000000 (init)

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: ESP_OUT_OF_RANGE

    BUGCHECK_STR: 0x139

    PROCESS_NAME: AvastSvc.exe

    CURRENT_IRQL: 1

    ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

    EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

    EXCEPTION_CODE_STR: c0000409

    EXCEPTION_PARAMETER1: 0000000000000004

    WATSON_BKT_EVENT: BEX

    ANALYSIS_SESSION_HOST: SNOWMANBAWB-PC

    ANALYSIS_SESSION_TIME: 02-25-2016 23:47:29.0881

    ANALYSIS_VERSION: 10.0.10586.567 amd64fre

    BAD_STACK_POINTER: ffffe0018343da38

    LAST_CONTROL_TRANSFER: from fffff802e1550fe9 to fffff802e1546480

    FAULTING_THREAD: 0000000000000000

    STACK_TEXT:
    ffffe001`8343da38 fffff802`e1550fe9 : 00000000`00000139 00000000`00000004 ffffe001`8343dd60 ffffe001`8343dcb8 : nt!KeBugCheckEx
    ffffe001`8343da40 fffff802`e1551310 : 00000000`00000000 00000000`00000000 00000180`00000400 00000000`00000000 : nt!KiBugCheckDispatch+0x69
    ffffe001`8343db80 fffff802`e15504f3 : ffffc001`d3e6fba8 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiFastFailDispatch+0xd0
    ffffe001`8343dd60 fffff802`e155b157 : ffffe001`8343e650 ffffe001`8343ee00 00000000`00000000 00000000`00000000 : nt!KiRaiseSecurityCheckFailure+0xf3
    ffffe001`8343def0 fffff802`e1408d81 : 00000000`00000000 ffffb000`5fe51000 65657246`00000002 0dc38236`36a514f1 : nt! ?? ::FNODOBFM::`string'+0x6357
    ffffe001`8343df20 fffff802`e14075a8 : ffffe001`8343ee38 ffffe001`8343eb50 ffffe001`8343ee38 00000000`00000001 : nt!RtlDispatchException+0x71
    ffffe001`8343e620 fffff802`e15510c2 : 00000000`00820003 00000000`00000000 4b677844`0205000e 0dc38236`36a526d1 : nt!KiDispatchException+0x144
    ffffe001`8343ed00 fffff802`e154edc6 : ffffe001`8343ef90 ffffe001`834416a0 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0xc2
    ffffe001`8343eee0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiInvalidOpcodeFault+0x106


    THREAD_SHA1_HASH_MOD_FUNC: 93ff434f099106b58fd2a86313b2862abc617562

    THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 6ca9d805ff691236db9ae5a22166f7ed00e151d5

    THREAD_SHA1_HASH_MOD: 9f457f347057f10e1df248e166a3e95e6570ecfe

    FOLLOWUP_IP:
    nt!KiFastFailDispatch+d0
    fffff802`e1551310 c644242000 mov byte ptr [rsp+20h],0

    FAULT_INSTR_CODE: 202444c6

    SYMBOL_STACK_INDEX: 2

    SYMBOL_NAME: nt!KiFastFailDispatch+d0

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME: ntkrnlmp.exe

    DEBUG_FLR_IMAGE_TIMESTAMP: 56a849a9

    IMAGE_VERSION: 10.0.10586.103

    STACK_COMMAND: ~0s ; kb

    BUCKET_ID_FUNC_OFFSET: d0

    FAILURE_BUCKET_ID: 0x139_MISSING_GSFRAME_STACKPTR_ERROR_nt!KiFastFailDispatch

    BUCKET_ID: 0x139_MISSING_GSFRAME_STACKPTR_ERROR_nt!KiFastFailDispatch

    PRIMARY_PROBLEM_CLASS: 0x139_MISSING_GSFRAME_STACKPTR_ERROR_nt!KiFastFailDispatch

    TARGET_TIME: 2016-02-15T13:26:13.000Z

    OSBUILD: 10586

    OSSERVICEPACK: 0

    SERVICEPACK_NUMBER: 0

    OS_REVISION: 0

    SUITE_MASK: 272

    PRODUCT_TYPE: 1

    OSPLATFORM_TYPE: x64

    OSNAME: Windows 10

    OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS

    OS_LOCALE:

    USER_LCID: 0

    OSBUILD_TIMESTAMP: 2016-01-27 06:38:01

    BUILDDATESTAMP_STR: 160126-1819

    BUILDLAB_STR: th2_release

    BUILDOSVER_STR: 10.0.10586.103.amd64fre.th2_release.160126-1819

    ANALYSIS_SESSION_ELAPSED_TIME: 395

    ANALYSIS_SOURCE: KM

    FAILURE_ID_HASH_STRING: km:0x139_missing_gsframe_stackptr_error_nt!kifastfaildispatch

    FAILURE_ID_HASH: {7b0febb5-6007-4f2b-3d38-57fef278d8d5}

    Followup: MachineOwner
    ---------

    3: kd> lmvm nt
    Browse full module list
    start end module name
    fffff802`e1404000 fffff802`e1bd0000 nt (pdb symbols) C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\ntkrnlmp.pdb\D03C5CF7862E48FE84A06333F1CFA5981\ntkrnlmp.pdb
    Loaded symbol image file: ntkrnlmp.exe
    Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\ntoskrnl.exe\56A849A97cc000\ntoskrnl.exe
    Image path: ntkrnlmp.exe
    Image name: ntkrnlmp.exe
    Browse all global symbols functions data
    Timestamp: Wed Jan 27 06:38:01 2016 (56A849A9)
    CheckSum: 00727A26
    ImageSize: 007CC000
    File version: 10.0.10586.103
    Product version: 10.0.10586.103
    File flags: 0 (Mask 3F)
    File OS: 40004 NT Win32
    File type: 1.0 App
    File date: 00000000.00000000
    Translations: 0409.04b0
    CompanyName: Microsoft Corporation
    ProductName: Microsoft® Windows® Operating System
    InternalName: ntkrnlmp.exe
    OriginalFilename: ntkrnlmp.exe
    ProductVersion: 10.0.10586.103
    FileVersion: 10.0.10586.103 (th2_release.160126-1819)
    FileDescription: NT Kernel & System
    LegalCopyright: © Microsoft Corporation. All rights reserved.
     
  2. Neemobeer

    Neemobeer Windows Forum Team
    Staff Member

    Joined:
    Jul 4, 2015
    Messages:
    2,404
    Likes Received:
    362
    It looks like your AV is the problem here. I would remove it and test. If you still get BSODs then do the following.

    Check for an OS problem from an elevated command prompt type sfc /scannow and test your memory
     
  3. BIGBEARJEDI

    BIGBEARJEDI Honorable Member
    Premium Supporter

    Joined:
    Jan 28, 2013
    Messages:
    1,781
    Likes Received:
    214
    If BSODs still occur after trying Neemobeer's suggestions consider that there are often Blue-screen problems with self-built PCs when attempting upgrades. What version of Windows was on this machine before W10?

    Next, I would download SEATOOLS and run BOTH short and long tests on your Samsung SSD drive. If SEATOOLS returns any errors, your drive has failed and must be replaced. As it's an SSD, you may also want to download TRIM (google it) and run that as well. Last time I looked each manufacturer has their own customized version of Trim, and I think Samsung may have their own which you'll want to get and test with.

    If your SSD drive passes these tests, you can look for other culprits with your system; things like BIOS update and drivers. Did you ensure that your ASUS Mobo has the latest version of BIOS installed by checking the ASUS website? If not, you'll want to Flash your BIOS--this is high risk, so if you haven't done it yourself, you'll definitely want to pay a Pro to do for you. This is a very important step as your Mobo hardware pre-dates the release of W10 (July 29, 2015) and your Mobo is dated 2013.

    After checking your BIOS, you'll need to run the Microsoft COMPATABILITY TEST. Even if you did this before, you should repeat it and produce a no-exception COMPATABILITY REPORT before reinstalling your W10, which I suspect you'll have to do here. If you failed to run it prior to your Upgrade or new Install on this self-built PC, you should do it now. Reinstall your W10 and recheck for Blue Screens. Doing these things should fix it; but without having your PC on my workbench, of course I can't guarantee it will work as each person does funny things when they build their computers.

    Let us know how it goes.
    Best of luck,:encouragement:
    <<<BIGBEARJEDI>>>
     
  4. SnowManBawb

    Joined:
    Feb 25, 2016
    Messages:
    54
    Likes Received:
    1
    sorry for the late responses but here ya go

    @Neemobeer Tried running the os with the AV uninstalled didnt work. And the SFC scan found a violation and replaced the files then i ran it again and it was fine.

    @BIGBEARJEDI The ssd is most definetly not the problem since i had this problem before adding it to the rig. Have yet tried updating the bios will try doing that.
     
  5. kemical

    kemical Windows Forum Admin
    Staff Member Premium Supporter Microsoft MVP

    Joined:
    Aug 28, 2007
    Messages:
    31,818
    Likes Received:
    1,565
    Hi Bawb,
    I seem to have missed your thread and have since moved it to the correct section.

    In order to help you best we/I need to see your actual dump files. The error you posted can be caused by either a dodgy device driver, system service or Virus scanner.

    If you read the thread found here it has an application which will help you grab the information we need:
    How to ask for help with a BSOD problem
     
  6. SnowManBawb

    Joined:
    Feb 25, 2016
    Messages:
    54
    Likes Received:
    1
    Sorry for getting back so late so here we go I tried updating my BIOS but that didnt help so I did what @kemical asked and uploaded the dump files with this post.
     

    Attached Files:

  7. kemical

    kemical Windows Forum Admin
    Staff Member Premium Supporter Microsoft MVP

    Joined:
    Aug 28, 2007
    Messages:
    31,818
    Likes Received:
    1,565
    Code:
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 3B, {c0000005, fffff80105c7c7b2, ffffd0018fe21af0, 0}
    
    *** WARNING: Unable to verify timestamp for aswSnx.sys
    *** ERROR: Module load completed but symbols could not be loaded for aswSnx.sys
    Probably caused by : aswSnx.sys ( aswSnx+7c7b2 )
    
    Followup: MachineOwner
    ---------
    
    Hi Bawb,
    you a number of different bugchecks although almost all point to memory corruption as the probable cause. Only two mentioned anything specific driver wise, with one blaming the gpu driver and the above blaming Avast AV.
    As your dump files only go up to the 23rd of this month they are still showing the old bios so please update if you haven't already.
    I also checked your motherboard support page and noticed there are win 10 drivers available. Please update everything:
    H87M-PLUS - Support

    Please remove Avast AV and just use the on board Defender for now. Win 10 Defender is almost a straight copy of Microsoft's server AV and is is better than the last incarnation. Plus it's super stable.

    I notice your running Zemana anti malware? Never heard of it personally but if your sure it's ok then leave it be if your not so sure then remove it.

    I'm not entirely convinced you have a RAM issue but it would be silly to ignore the dump files and if after making the above changes the bsod's continue, check your RAM.
    Windows does have a memory testing app but it can miss errors and the best app for the job is Memtest86.
    If you open the link below you'll see you can run Memtest86 in two ways. You can either burn it to disk or install it onto a USB drive it's entirely up to you. You'll then need to enter the bios to change the boot order so you can boot from either the Disk or USB stick you have Memtest86 on.
    You must test for at least 12 hours unless it becomes obvious there is a problem straight away.
    Memtest86+ - Advanced Memory Diagnostic Tool

    Please post any new dump files.
     
  8. SnowManBawb

    Joined:
    Feb 25, 2016
    Messages:
    54
    Likes Received:
    1
    Removed Avast and Zemana anti malware. Zemana was something i used long ago so dont know how reliable that is.

    I assumed to update the bios i just install the most recent file which I did a day prior of posting the dump files.

    Ill run Memtest over night since ive heard you have to run it for a longer period of time
     
  9. kemical

    kemical Windows Forum Admin
    Staff Member Premium Supporter Microsoft MVP

    Joined:
    Aug 28, 2007
    Messages:
    31,818
    Likes Received:
    1,565
    Ok Bawb thanks for the update. Hope all goes well and I'll await your next reply.
     
  10. SnowManBawb

    Joined:
    Feb 25, 2016
    Messages:
    54
    Likes Received:
    1
    memtest reported 0 errors over 10 passes over 13 hours of testing. Ill shut down my pc for the night check if it blue screens and then send you the dump file from that.
     
  11. kemical

    kemical Windows Forum Admin
    Staff Member Premium Supporter Microsoft MVP

    Joined:
    Aug 28, 2007
    Messages:
    31,818
    Likes Received:
    1,565
    Ok Bawb thanks for the update. If it does bsod there are still things we can try but first let's see if that bridge has to be crossed.. :)
     
  12. SnowManBawb

    Joined:
    Feb 25, 2016
    Messages:
    54
    Likes Received:
    1
    Still crashed. Not that big of a surprise since I didnt really fix anthing since the last test. As mentioned the dump files.
     

    Attached Files:

  13. kemical

    kemical Windows Forum Admin
    Staff Member Premium Supporter Microsoft MVP

    Joined:
    Aug 28, 2007
    Messages:
    31,818
    Likes Received:
    1,565
    Hi Bawb,
    are sure your getting an actual bsod?
    The only reason I'm asking is because the dump files sent are exactly the same as those sent on the 26th. See my screenshot:
    dump.

    Try going into the minidump folder and clearing it of dump files. Also check your event logs to see if you had an event 41 on the night in question.
     
  14. SnowManBawb

    Joined:
    Feb 25, 2016
    Messages:
    54
    Likes Received:
    1
    Well I cleared it yesterday. Shutdown my pc for the night. And as a surprise to no one had a blue screen. after that i updated my gpu driver and got the dump files for you.
     

    Attached Files:

  15. kemical

    kemical Windows Forum Admin
    Staff Member Premium Supporter Microsoft MVP

    Joined:
    Aug 28, 2007
    Messages:
    31,818
    Likes Received:
    1,565
    Code:
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 50, {ffffd000671d6270, 0, fffff800b133cdd8, 2}
    
    
    Could not read faulting driver name
    Probably caused by : memory_corruption
    
    Followup: memory_corruption
    
    Hi Bawb,
    thats a lot better thank you. You had sent two dump files one being a bugcheck 3B (faulty system service, graphics issues) and the above, a bugcheck 50. This can be cause by AV apps, faulty system service, ntfs issues and hardware errors (usually RAM).
    I can see in the dump file driver stack that this is still installed:

    zamguard64.sys Mon Dec 14 10:13:23 2015: Zemana ZAM AntiMalware driver

    I also found this:
    MpKslb199f6cb.sys Wed May 20 02:50:37 2015: So far I cannot find any information regarding this driver. Any ideas?

    Please run these scans:
    File scans
    Right click on the Start menu icon and from the revealed list choose 'admin command prompt'. Type:
    sfc /scannow
    press enter and await results

    In the same command prompt and after the above scan has finished type:
    dism /online /cleanup-image /restorehealth
    Press enter and await results (longer this time).

    If the first scan found files it could not repair but the second scan is successful, run the first scan again using the same command prompt box and this time it should repair the files found.

    As the above dump file could not read the faulting drivers name let's run the driver verifier. First you will need to create a recovery disk/USB. The reason you might need this is because the verifier stress's each driver on start up. This may cause a bsod and capture the driver in a dump file but it may also cause a bsod loop on start up. If this happens you can use the recovery disk/usb to boot from, enter the recovery console and safe mode. You can then turn the verifier off.
    Creating a recovery drive - Windows Help -

    Verifier
    How do I fix a Blue Screen in Windows using Driver Verifier?

    Post any resulting dump files.
     
  16. SnowManBawb

    Joined:
    Feb 25, 2016
    Messages:
    54
    Likes Received:
    1
    Alright I did the command prompt commands the first one found some files that it repaired.
    Then I ran the clean up and then I did scannow just in case and it didnt find anything. ill do the 2nd part later today :p
     
  17. kemical

    kemical Windows Forum Admin
    Staff Member Premium Supporter Microsoft MVP

    Joined:
    Aug 28, 2007
    Messages:
    31,818
    Likes Received:
    1,565
    Ok Bawb, thanks for the update.
     
  18. SnowManBawb

    Joined:
    Feb 25, 2016
    Messages:
    54
    Likes Received:
    1
    I dont have a 8gb drive to try that out yet. So ill do it by tomorrow. And when im done ill still need to test so ill get back to you sunday. So untill then have a good weekend Kemical :)
     
  19. kemical

    kemical Windows Forum Admin
    Staff Member Premium Supporter Microsoft MVP

    Joined:
    Aug 28, 2007
    Messages:
    31,818
    Likes Received:
    1,565
    You too Bawb! :)
     
  20. SnowManBawb

    Joined:
    Feb 25, 2016
    Messages:
    54
    Likes Received:
    1
    For some reason i cant use my 8GB flash. It only shows my sotrage drive and my external hard drive
     

Share This Page

Loading...