Windows 10 Blue screen after every full night shutdown.

SnowManBawb · Feb 25, 2016

Hello.

So, I've had this problem with my pc for a while now and I just have no idea what the problem might be anymore. Ive tried posting on different sites but no one answered.

Here is the problem every time my pc has been shut down for longer then an hour, the next boot up will end up in a blue screen displaying a different error code each time. Here are is few ive seen.

IRQL_NOT_LESS_OR_EQUAL

KMODE_EXCEPTION_NOT_HANDLED

Sometimes the blue screen will happen 10 minutes after it has fully started sometimes right after i log in.

Here are my specs.

CPU Intel Core i5-4440 3.10 GHZ
Motherboard Asus H87M-PLUS
RAM 2 4gb sticks of Corsair DDR3 vengance ram
GPU Asus strix R9 390
Case Fractal Design Core 1000
Storage Samsung 850 evo 250 gb, 500GB Seagate ST500DM002, and a 1 tb external
PSU Corsair CS750M

Ive also ran Windgb and here are the results based on the latest blue screen.
Here is what it came up with.

Microsoft (R) Windows Debugger Version 10.0.10586.567 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\021516-4484-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 10586 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 10586.103.amd64fre.th2_release.160126-1819
Machine Name:
Kernel base = 0xfffff802`e1404000 PsLoadedModuleList = 0xfffff802`e16e2cf0
Debug session time: Mon Feb 15 15:26:13.882 2016 (UTC + 2:00)
System Uptime: 0 days 0:02:20.537
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
................................................................
..................................................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 139, {4, ffffe0018343dd60, ffffe0018343dcb8, 0}

Probably caused by : ntkrnlmp.exe ( nt!KiFastFailDispatch+d0 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000004, The thread's stack pointer was outside the legal stack
extents for the thread.
Arg2: ffffe0018343dd60, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffffe0018343dcb8, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------

DUMP_CLASS: 1

DUMP_QUALIFIER: 400

BUILD_VERSION_STRING: 10586.103.amd64fre.th2_release.160126-1819

SYSTEM_MANUFACTURER: ASUS

SYSTEM_PRODUCT_NAME: All Series

SYSTEM_SKU: All

SYSTEM_VERSION: System Version

BIOS_VENDOR: American Megatrends Inc.

BIOS_VERSION: 0306

BIOS_DATE: 04/07/2013

BASEBOARD_MANUFACTURER: ASUSTeK COMPUTER INC.

BASEBOARD_PRODUCT: H87M-PLUS

BASEBOARD_VERSION: Rev X.0x

DUMP_TYPE: 2

DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump

BUGCHECK_P1: 4

BUGCHECK_P2: ffffe0018343dd60

BUGCHECK_P3: ffffe0018343dcb8

BUGCHECK_P4: 0

TRAP_FRAME: 4b6778440205000e -- (.trap 0x4b6778440205000e)
Unable to read trap frame at 4b677844`0205000e

EXCEPTION_RECORD: 0000000000820003 -- (.exr 0x820003)
Cannot read Exception record @ 0000000000820003

CPU_COUNT: 4

CPU_MHZ: c1c

CPU_VENDOR: GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 3c

CPU_STEPPING: 3

CPU_MICROCODE: 6,3c,3,0 (F,M,S,R) SIG: 1E'00000000 (cache) 1E'00000000 (init)

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: ESP_OUT_OF_RANGE

BUGCHECK_STR: 0x139

PROCESS_NAME: AvastSvc.exe

CURRENT_IRQL: 1

ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE_STR: c0000409

EXCEPTION_PARAMETER1: 0000000000000004

WATSON_BKT_EVENT: BEX

ANALYSIS_SESSION_HOST: SNOWMANBAWB-PC

ANALYSIS_SESSION_TIME: 02-25-2016 23:47:29.0881

ANALYSIS_VERSION: 10.0.10586.567 amd64fre

BAD_STACK_POINTER: ffffe0018343da38

LAST_CONTROL_TRANSFER: from fffff802e1550fe9 to fffff802e1546480

FAULTING_THREAD: 0000000000000000

STACK_TEXT:
ffffe001`8343da38 fffff802`e1550fe9 : 00000000`00000139 00000000`00000004 ffffe001`8343dd60 ffffe001`8343dcb8 : nt!KeBugCheckEx
ffffe001`8343da40 fffff802`e1551310 : 00000000`00000000 00000000`00000000 00000180`00000400 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffffe001`8343db80 fffff802`e15504f3 : ffffc001`d3e6fba8 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiFastFailDispatch+0xd0
ffffe001`8343dd60 fffff802`e155b157 : ffffe001`8343e650 ffffe001`8343ee00 00000000`00000000 00000000`00000000 : nt!KiRaiseSecurityCheckFailure+0xf3
ffffe001`8343def0 fffff802`e1408d81 : 00000000`00000000 ffffb000`5fe51000 65657246`00000002 0dc38236`36a514f1 : nt! ?? ::FNODOBFM::`string'+0x6357
ffffe001`8343df20 fffff802`e14075a8 : ffffe001`8343ee38 ffffe001`8343eb50 ffffe001`8343ee38 00000000`00000001 : nt!RtlDispatchException+0x71
ffffe001`8343e620 fffff802`e15510c2 : 00000000`00820003 00000000`00000000 4b677844`0205000e 0dc38236`36a526d1 : nt!KiDispatchException+0x144
ffffe001`8343ed00 fffff802`e154edc6 : ffffe001`8343ef90 ffffe001`834416a0 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0xc2
ffffe001`8343eee0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiInvalidOpcodeFault+0x106

THREAD_SHA1_HASH_MOD_FUNC: 93ff434f099106b58fd2a86313b2862abc617562

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 6ca9d805ff691236db9ae5a22166f7ed00e151d5

THREAD_SHA1_HASH_MOD: 9f457f347057f10e1df248e166a3e95e6570ecfe

FOLLOWUP_IP:
nt!KiFastFailDispatch+d0
fffff802`e1551310 c644242000 mov byte ptr [rsp+20h],0

FAULT_INSTR_CODE: 202444c6

SYMBOL_STACK_INDEX: 2

SYMBOL_NAME: nt!KiFastFailDispatch+d0

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 56a849a9

IMAGE_VERSION: 10.0.10586.103

STACK_COMMAND: ~0s ; kb

BUCKET_ID_FUNC_OFFSET: d0

FAILURE_BUCKET_ID: 0x139_MISSING_GSFRAME_STACKPTR_ERROR_nt!KiFastFailDispatch

BUCKET_ID: 0x139_MISSING_GSFRAME_STACKPTR_ERROR_nt!KiFastFailDispatch

PRIMARY_PROBLEM_CLASS: 0x139_MISSING_GSFRAME_STACKPTR_ERROR_nt!KiFastFailDispatch

TARGET_TIME: 2016-02-15T13:26:13.000Z

OSBUILD: 10586

OSSERVICEPACK: 0

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 272

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2016-01-27 06:38:01

BUILDDATESTAMP_STR: 160126-1819

BUILDLAB_STR: th2_release

BUILDOSVER_STR: 10.0.10586.103.amd64fre.th2_release.160126-1819

ANALYSIS_SESSION_ELAPSED_TIME: 395

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0x139_missing_gsframe_stackptr_error_nt!kifastfaildispatch

FAILURE_ID_HASH: {7b0febb5-6007-4f2b-3d38-57fef278d8d5}

Followup: MachineOwner
---------

3: kd> lmvm nt
Browse full module list
start end module name
fffff802`e1404000 fffff802`e1bd0000 nt (pdb symbols) C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\ntkrnlmp.pdb\D03C5CF7862E48FE84A06333F1CFA5981\ntkrnlmp.pdb
Loaded symbol image file: ntkrnlmp.exe
Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\ntoskrnl.exe\56A849A97cc000\ntoskrnl.exe
Image path: ntkrnlmp.exe
Image name: ntkrnlmp.exe
Browse all global symbols functions data
Timestamp: Wed Jan 27 06:38:01 2016 (56A849A9)
CheckSum: 00727A26
ImageSize: 007CC000
File version: 10.0.10586.103
Product version: 10.0.10586.103
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrnlmp.exe
OriginalFilename: ntkrnlmp.exe
ProductVersion: 10.0.10586.103
FileVersion: 10.0.10586.103 (th2_release.160126-1819)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.

Neemobeer · Feb 25, 2016

It looks like your AV is the problem here. I would remove it and test. If you still get BSODs then do the following.

Check for an OS problem from an elevated command prompt type sfc /scannow and test your memory

holdum333 · Apr 22, 2016

kemical said:
Trouble is Gary many motherboards now use solid caps but inspection of the motherboard is always worthwhile..

That shows how far I'm be hide on hardware. Could still be a hair line crack in MB. Good suggestion about booting straight into safe mode.
I'll watch now!

SnowManBawb · Apr 26, 2016

kemical said:
Trouble is Gar/y many motherboards now use solid caps but inspection of the motherboard is always worthwhile..

Bawb if manually setting the RAM speed doesn't help you could try upping the voltage slightly. If your Vengence RAM runs at 2400MHz then it's voltage will be about 1.65v. Try upping it slightly but don't go over 1.7v. Failing that, do you have access to any other memory or would it be possible to perhaps borrow some off a friend?

Try something for me please, when you next reboot, expecting a bsod, boot straight into safe mode and see if the blue screen still occurs. If it does don't forget to send me the dump.

I also notice you use a Logitech Keyboard and possibly a XTD kone mouse? (I own an XTD Kone and they are an awesome mouse, anyway I digress) Bawb have you tried removing either the mouse or the keyboard and seeing if the bsod still occurs? It's a long shot I know but if you have a spare k'board and mouse see if swapping them over makes any difference.

I upped the ram speed to 1.6 and it kept crashing consistently.
Then i put back down to 1.55 and it was stable so when i tried launching the pc after the night it seemed that the bsod happened a bit later then usual might be a coincidence though.

kemical · Apr 26, 2016

SnowManBawb said:
I upped the ram speed to 1.6 and it kept crashing consistently.

Hmm...Really? That's not good. I assume that when you say '1.6' your referring to the RAM speed of 1600MHz and not the voltage of 1.6?
Link Removed
I checked which RAM you have by looking at an old dump file. You'll notice in the link above that your sticks will default to 1333mhz @ 1.5v. They have also been tested to run at the rate of 1600MHz @ 1.5v and in order to achieve this speed you either use the X.M.P. profiles or manually overclock.
This is normal practice. Your motherboard manual will tell you how to correctly configure XMP.

Now if you tried to manually overclock the sticks to 1.6mhz or 1600mhz and they crashed constantly then that is not good at all and the sticks could well be faulty.
What about if you returned the sticks beck to the default speed of 1333mhz and then tried enabling the XMP profile. As I wrote above your manual will tell you how and if you haven't got one download another from the motherboard link in earlier posts.

SnowManBawb · Apr 26, 2016

kemical said:
Hmm...Really? That's not good. I assume that when you say '1.6' your referring to the RAM speed of 1600MHz and not the voltage of 1.6?
Link Removed
I checked which RAM you have by looking at an old dump file. You'll notice in the link above that your sticks will default to 1333mhz @ 1.5v. They have also been tested to run at the rate of 1600MHz @ 1.5v and in order to achieve this speed you either use the X.M.P. profiles or manually overclock.
This is normal practice. Your motherboard manual will tell you how to correctly configure XMP.

Now if you tried to manually overclock the sticks to 1.6mhz or 1600mhz and they crashed constantly then that is not good at all and the sticks could well be faulty.
What about if you returned the sticks beck to the default speed of 1333mhz and then tried enabling the XMP profile. As I wrote above your manual will tell you how and if you haven't got one download another from the motherboard link in earlier posts.

I was talking about the voltage. They default to 1333? really? I always thought they were 1600 im so sure I looked it up multiple times as well. Well the only value that i have added manually is the voltage which 1.55 right now. And xmp is enabled but disabling xmp has not worked before.
And ill also add the new dump file just in case that says anything.

holdum333 · Apr 26, 2016

Hi I probably will get hollered at, but this is post number 65. IMHO it's time for a new mother board or a new computer.

SnowManBawb said:
Its most definitely not the power supply. As I mentioned before this has been happening for a long time and Ive swapped out parts of my PC over the course of this happening the only things that are the same since this started are the CPU, and motherboard.

kemical · Apr 26, 2016

holdum333 said:
Hi I probably will get hollered at, but this is post number 65. IMHO it's time for a new mother board or a new computer.

I've dealt with cases far longer than this one and eventually found the solution so let's not panic just yet..

holdum333 · Apr 26, 2016

N/P friend! Very strange this BSOD only happens after being shut down. Bob says every thing has been replaced except CPU and Mother Board? I'll bow out now. I'm not a BSOD expert. Just been following this thread every sense I registered on the forum.
IMHO the problem needs to be narrowed down to software or hardware. The OS has been restored many times. Every thing has been replaced.
I don't see where we go next. I'll keep watching and learning.

kemical · Apr 26, 2016

SnowManBawb said:
They default to 1333? really? I always thought they were 1600 im so sure I looked it up multiple times as well.

Yup. As I said earlier ALL RAM defaults to 1333mhz (unless it's slower than 1333mhz of course) and to achieve the speed the RAM has been tested to one has to enable the xmp or you can set the speed manually. Check the link I posted:

See the top arrow? That's pointing to SPD or serial presence detect which usually takes the form of a little chip on each memory module containing information on speed, timings and voltage.
The bottom arrow is the tested speed so when you apply xmp it will run at the speed it was tested for. If you disabled the xmp you would see the speed drop down to 1333mhz.

I would set the voltage back to 1.5v as specified in the above tech sheet.

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {ffffd000f2991320, 0, fffff801b10f2d67, 2}


Could not read faulting driver name
Probably caused by : memory_corruption

Followup: memory_corruption

All your dump files were bugcheck 50 with one blaming the gpu driver and the others blaming memory corruption.

Try clearing the bios by removing the bios battery for 30 seconds. Reboot and go straight back into the bios and enable 'optimised defaults'. You may also need to set the date and boot orders. Oh and don't forget to re-enable the xmp profile for the RAM.

When you re-installed Windows were these clean installs or back up images or upgrade installs?

holdum333 · Apr 26, 2016

kemical said:
When you re-installed Windows were these clean installs or back up images or upgrade installs?

holdum333 · Apr 26, 2016

Hi @kemical Sorry friend, but after your last reply, I just have to add this. I know I said I would bow out, and I will!!

Check for Hardware Problems: Blue screens can be caused by faulty hardware in your computer. Try Link Removed and checking its temperature to ensure that it isn’t overheating.
Reinstall Windows: Reinstalling Windows is the nuclear option. It will blow away your existing system software, replacing it with a fresh Windows system. If your computer continues to blue screen after this, you likely have a hardware problem.

kemical said:
When you re-installed Windows were these clean installs or back up images or upgrade installs?

kemical · Apr 26, 2016

Yup thanks Gary.

Bawb if you could post whether they were clean installs or not that would be great. There is a specific reason I'm asking this question so please let me know.

SnowManBawb · Apr 27, 2016

kemical said:
Yup thanks Gary.

Bawb if you could post whether they were clean installs or not that would be great. There is a specific reason I'm asking this question so please let me know.

yea sorry for late response i guess? But yea they were clean installs. off of the disk, no files saved. alright ill clear the bios and then get back to you if it blue screens.

kemical · Apr 27, 2016

Thanks Bawb, hope all goes well. Let me know how you get one.

holdum333 · Apr 27, 2016

Hi Guys! I just can't get this off my mind. MSE should not be showing up on your PC. Here's a old reply that is really bothering me and I'm wondering if this still exists! Here's a suggestion by @kemical that never really got answered! The last thing I read was that these could not be found. That doesn't sound right to me!
AsIO.sys Tue Aug 24 02:53:02 2010: Asus PCProbe Utility. This is too old for Windows 10 really and needs either removing or updating.

MpKsl89da5820.sys Wed May 20 02:50:37 2015: Microsoft Security essentials? If so please remove and just use the onboard Defender.

zamguard64.sys Mon Dec 14 10:13:23 2015: Anti Malware uninstall to test

holdum333 · Apr 27, 2016

Hi @kemical Please read this by Stephen Boots at MS!
Windows defender replacing Microsoft Security Essentials during update from W7 to W10 on one machine but not the other

kemical · Apr 27, 2016

holdum333 said:
Hi Guys! I just can't get this off my mind. MSE should not be showing up on your PC. Here's a old reply that is really bothering me and I'm wondering if this still exists! Here's a suggestion by @kemical that never really got answered! The last thing I read was that these could not be found. That doesn't sound right to me!
AsIO.sys Tue Aug 24 02:53:02 2010: Asus PCProbe Utility. This is too old for Windows 10 really and needs either removing or updating.

MpKsl89da5820.sys Wed May 20 02:50:37 2015: Microsoft Security essentials? If so please remove and just use the onboard Defender.

zamguard64.sys Mon Dec 14 10:13:23 2015: Anti Malware uninstall to test

The op looked and couldn't find the files I mentioned. This can sometimes happen and probably means something is still in the registry which relates to the apps mentioned.

I'm not even sure that is MSE at this point which is why I asked the op.

Thanks for the link.

I'm actually waiting on Bawb's next reply and depending on what that say's will determine what to try next. If the issue isn't resolved then i need to see more dump files. I don't really want to say too much at this point but I do see something in the dump files which is telling me one thing but other factors are telling me another. So in an effort to try and clear some of the confusion I'll get a second opinion from an old friend over at Sysnative (he also taught me to debug).

holdum333 · Apr 27, 2016

Sounds good! Are you talking about JC? I'll go back to observing now! I have heard that this MSE bug can cause lots of grief and wanted you to know about it!

kemical · Apr 27, 2016

Yup, thanks Gary.

SnowManBawb · Apr 28, 2016

kemical said:
Yup, thanks Gary.

Resting the BIOS did not fix the blue screen. Added the dump files

kemical · Apr 28, 2016

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {ffffd000aa4a0d49, 0, fffff801e7eb6dca, 0}


Could not read faulting driver name
Probably caused by : memory_corruption

Followup: memory_corruption

Hi Bawb,
this bsod occurred when Defender was running and indeed bugcheck 50 can be caused by AV apps. If you check your dxdiag you'll find lot's of telemetry errors to do with Defender. Also this driver:

MpKsld41914c2.sys Wed May 20 02:50:37 2015: Apparently this is a dynamic update driver for MSE, each time MSE updates the name of the driver changes slightly. Usually once MSE has finished with them they are deleted and normally they cannot be seen so something unknown is happening to trap them in the dump file. I'm not sure why this is on your system as Windows 10 is incompatible with MSE.

Have you tried to install MSE at any point?

Did you use MSE when you ran windows 7?

Please update these drivers:

HECIx64.sys Mon Dec 17 19:32:21 2012: Intel engine management driver. You'll find this under 'Utilitites'
Link Removed

Update your chipset drivers too. These are found under 'Chipset':
Link Removed

RTKVHD64.sys Tue Nov 20 11:10:14 2012: Realtek High Definition Audio Function Driver
Link Removed

LGPBTDD.sys Wed Jul 01 19:47:52 2009: Logitech GamePanel Software. This is a little old for win 10. Please update if possible:
http://www.logitech.com/en-us/support-downloads

Your using a Broadcom NetXtreme ll connection with a 2013 device driver. Please try and update:
https://www.broadcom.com/application/ethernet_nic.php#determine_driver

Ok see how you go on with those changes for now. Please let me know about those questions regarding MSE.. Thanks..

Post any new dump files.

Windows 10 Blue screen after every full night shutdown.

Member

Banned

Member

Windows Forum Admin

Member

Attachments

Banned

Windows Forum Admin

Banned

Windows Forum Admin

Banned

Banned

Windows Forum Admin

Member

Windows Forum Admin

Banned

Banned

Windows Forum Admin

Banned

Windows Forum Admin

Member

Attachments

Windows Forum Admin

Similar threads