Windows 10 Blue screen after every full night shutdown.

[SnowManBawb]

Hello.



So, I've had this problem with my pc for a while now and I just have no idea what the problem might be anymore. Ive tried posting on different sites but no one answered.



Here is the problem every time my pc has been shut down for longer then an hour, the next boot up will end up in a blue screen displaying a different error code each time. Here are is few ive seen.



IRQL_NOT_LESS_OR_EQUAL



KMODE_EXCEPTION_NOT_HANDLED


Sometimes the blue screen will happen 10 minutes after it has fully started sometimes right after i log in.



Here are my specs.

• CPU Intel Core i5-4440 3.10 GHZ
  
  
• Motherboard Asus H87M-PLUS
  
  
• RAM 2 4gb sticks of Corsair DDR3 vengance ram
  
  
• GPU Asus strix R9 390
  
  
• Case Fractal Design Core 1000
  
  
• Storage Samsung 850 evo 250 gb, 500GB Seagate ST500DM002, and a 1 tb external
  
  
• PSU Corsair CS750M

Ive also ran Windgb and here are the results based on the latest blue screen.
Here is what it came up with.


Microsoft (R) Windows Debugger Version 10.0.10586.567 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\021516-4484-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 10586 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 10586.103.amd64fre.th2_release.160126-1819
Machine Name:
Kernel base = 0xfffff802`e1404000 PsLoadedModuleList = 0xfffff802`e16e2cf0
Debug session time: Mon Feb 15 15:26:13.882 2016 (UTC + 2:00)
System Uptime: 0 days 0:02:20.537
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
................................................................
..................................................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 139, {4, ffffe0018343dd60, ffffe0018343dcb8, 0}

Probably caused by : ntkrnlmp.exe ( nt!KiFastFailDispatch+d0 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000004, The thread's stack pointer was outside the legal stack
extents for the thread.
Arg2: ffffe0018343dd60, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffffe0018343dcb8, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------


DUMP_CLASS: 1

DUMP_QUALIFIER: 400

BUILD_VERSION_STRING: 10586.103.amd64fre.th2_release.160126-1819

SYSTEM_MANUFACTURER: ASUS

SYSTEM_PRODUCT_NAME: All Series

SYSTEM_SKU: All

SYSTEM_VERSION: System Version

BIOS_VENDOR: American Megatrends Inc.

BIOS_VERSION: 0306

BIOS_DATE: 04/07/2013

BASEBOARD_MANUFACTURER: ASUSTeK COMPUTER INC.

BASEBOARD_PRODUCT: H87M-PLUS

BASEBOARD_VERSION: Rev X.0x

DUMP_TYPE: 2

DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump

BUGCHECK_P1: 4

BUGCHECK_P2: ffffe0018343dd60

BUGCHECK_P3: ffffe0018343dcb8

BUGCHECK_P4: 0

TRAP_FRAME: 4b6778440205000e -- (.trap 0x4b6778440205000e)
Unable to read trap frame at 4b677844`0205000e

EXCEPTION_RECORD: 0000000000820003 -- (.exr 0x820003)
Cannot read Exception record @ 0000000000820003

CPU_COUNT: 4

CPU_MHZ: c1c

CPU_VENDOR: GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 3c

CPU_STEPPING: 3

CPU_MICROCODE: 6,3c,3,0 (F,M,S,R) SIG: 1E'00000000 (cache) 1E'00000000 (init)

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: ESP_OUT_OF_RANGE

BUGCHECK_STR: 0x139

PROCESS_NAME: AvastSvc.exe

CURRENT_IRQL: 1

ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE_STR: c0000409

EXCEPTION_PARAMETER1: 0000000000000004

WATSON_BKT_EVENT: BEX

ANALYSIS_SESSION_HOST: SNOWMANBAWB-PC

ANALYSIS_SESSION_TIME: 02-25-2016 23:47:29.0881

ANALYSIS_VERSION: 10.0.10586.567 amd64fre

BAD_STACK_POINTER: ffffe0018343da38

LAST_CONTROL_TRANSFER: from fffff802e1550fe9 to fffff802e1546480

FAULTING_THREAD: 0000000000000000

STACK_TEXT:
ffffe001`8343da38 fffff802`e1550fe9 : 00000000`00000139 00000000`00000004 ffffe001`8343dd60 ffffe001`8343dcb8 : nt!KeBugCheckEx
ffffe001`8343da40 fffff802`e1551310 : 00000000`00000000 00000000`00000000 00000180`00000400 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffffe001`8343db80 fffff802`e15504f3 : ffffc001`d3e6fba8 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiFastFailDispatch+0xd0
ffffe001`8343dd60 fffff802`e155b157 : ffffe001`8343e650 ffffe001`8343ee00 00000000`00000000 00000000`00000000 : nt!KiRaiseSecurityCheckFailure+0xf3
ffffe001`8343def0 fffff802`e1408d81 : 00000000`00000000 ffffb000`5fe51000 65657246`00000002 0dc38236`36a514f1 : nt! ?? ::FNODOBFM::`string'+0x6357
ffffe001`8343df20 fffff802`e14075a8 : ffffe001`8343ee38 ffffe001`8343eb50 ffffe001`8343ee38 00000000`00000001 : nt!RtlDispatchException+0x71
ffffe001`8343e620 fffff802`e15510c2 : 00000000`00820003 00000000`00000000 4b677844`0205000e 0dc38236`36a526d1 : nt!KiDispatchException+0x144
ffffe001`8343ed00 fffff802`e154edc6 : ffffe001`8343ef90 ffffe001`834416a0 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0xc2
ffffe001`8343eee0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiInvalidOpcodeFault+0x106


THREAD_SHA1_HASH_MOD_FUNC: 93ff434f099106b58fd2a86313b2862abc617562

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 6ca9d805ff691236db9ae5a22166f7ed00e151d5

THREAD_SHA1_HASH_MOD: 9f457f347057f10e1df248e166a3e95e6570ecfe

FOLLOWUP_IP:
nt!KiFastFailDispatch+d0
fffff802`e1551310 c644242000 mov byte ptr [rsp+20h],0

FAULT_INSTR_CODE: 202444c6

SYMBOL_STACK_INDEX: 2

SYMBOL_NAME: nt!KiFastFailDispatch+d0

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 56a849a9

IMAGE_VERSION: 10.0.10586.103

STACK_COMMAND: ~0s ; kb

BUCKET_ID_FUNC_OFFSET: d0

FAILURE_BUCKET_ID: 0x139_MISSING_GSFRAME_STACKPTR_ERROR_nt!KiFastFailDispatch

BUCKET_ID: 0x139_MISSING_GSFRAME_STACKPTR_ERROR_nt!KiFastFailDispatch

PRIMARY_PROBLEM_CLASS: 0x139_MISSING_GSFRAME_STACKPTR_ERROR_nt!KiFastFailDispatch

TARGET_TIME: 2016-02-15T13:26:13.000Z

OSBUILD: 10586

OSSERVICEPACK: 0

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 272

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2016-01-27 06:38:01

BUILDDATESTAMP_STR: 160126-1819

BUILDLAB_STR: th2_release

BUILDOSVER_STR: 10.0.10586.103.amd64fre.th2_release.160126-1819

ANALYSIS_SESSION_ELAPSED_TIME: 395

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0x139_missing_gsframe_stackptr_error_nt!kifastfaildispatch

FAILURE_ID_HASH: {7b0febb5-6007-4f2b-3d38-57fef278d8d5}

Followup: MachineOwner
---------

3: kd> lmvm nt
Browse full module list
start end module name
fffff802`e1404000 fffff802`e1bd0000 nt (pdb symbols) C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\ntkrnlmp.pdb\D03C5CF7862E48FE84A06333F1CFA5981\ntkrnlmp.pdb
Loaded symbol image file: ntkrnlmp.exe
Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\ntoskrnl.exe\56A849A97cc000\ntoskrnl.exe
Image path: ntkrnlmp.exe
Image name: ntkrnlmp.exe
Browse all global symbols functions data
Timestamp: Wed Jan 27 06:38:01 2016 (56A849A9)
CheckSum: 00727A26
ImageSize: 007CC000
File version: 10.0.10586.103
Product version: 10.0.10586.103
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrnlmp.exe
OriginalFilename: ntkrnlmp.exe
ProductVersion: 10.0.10586.103
FileVersion: 10.0.10586.103 (th2_release.160126-1819)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.

 

[SnowManBawb]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {ffffd000aa4a0d49, 0, fffff801e7eb6dca, 0}


Could not read faulting driver name
Probably caused by : memory_corruption

Followup: memory_corruption

Hi Bawb,
this bsod occurred when Defender was running and indeed bugcheck 50 can be caused by AV apps. If you check your dxdiag you'll find lot's of telemetry errors to do with Defender. Also this driver:

MpKsld41914c2.sys Wed May 20 02:50:37 2015: Apparently this is a dynamic update driver for MSE, each time MSE updates the name of the driver changes slightly. Usually once MSE has finished with them they are deleted and normally they cannot be seen so something unknown is happening to trap them in the dump file. I'm not sure why this is on your system as Windows 10 is incompatible with MSE.

Have you tried to install MSE at any point?

Did you use MSE when you ran windows 7?

Please update these drivers:

HECIx64.sys Mon Dec 17 19:32:21 2012: Intel engine management driver. You'll find this under 'Utilitites'
Link Removed

Update your chipset drivers too. These are found under 'Chipset':
Link Removed

RTKVHD64.sys Tue Nov 20 11:10:14 2012: Realtek High Definition Audio Function Driver
Link Removed

LGPBTDD.sys Wed Jul 01 19:47:52 2009: Logitech GamePanel Software. This is a little old for win 10. Please update if possible:
http://www.logitech.com/en-us/support-downloads

Your using a Broadcom NetXtreme ll connection with a 2013 device driver. Please try and update:
https://www.broadcom.com/application/ethernet_nic.php#determine_driver

Ok see how you go on with those changes for now. Please let me know about those questions regarding MSE.. Thanks..

Post any new dump files.

I have little to no knowledge about MSE so if I did run it i didnt know about it. Ill try updating the drivers.

 

[holdum333]

Hi Sorry for butting in, but MSE is very hard to remove on W10 and every thing I read says roll back and uninstall MSE and then install W10!
You could try this. IMHO MSE is causing your BSODs@kemical
If Security Essentials is still installed and running on the machine - please execute the following command from an elevated command prompt (Search > cmd.exe > (Right-Click) > 'Run as Administrator')



MsiExec.exe /X{75812722-F85F-4E5B-BEAF-3B7DA97A40D5}







A dialog box will prompt you to continue.



This will start the uninstall and automatically enable Windows Defender.

 

[kemical]

I have little to no knowledge about MSE so if I did run it i didn't know about it. Ill try updating the drivers.

Does it help any if I call it Microsoft security essentials?

It's puzzling that these drivers are on the system. If you had tried to install MSE with Windows 10 installed it would have or should have refused saying it's incompatible.
Another way they could possibly be on the system is that MSE was installed when you were using Windows 7 and you upgraded to Windows 10 which should normally see MSE replaced with Defender although in some cases MSE drivers are left behind. The trouble is with this theory is that you have said that you did a clean install which would have wiped the drive clean.
There's a slight chance it might be malware so run a quick scan of malwarebytes.
May I ask are you absolutely sure that you booted from the Windows 10 disk/USB and did a clean install wiping the drive clean in the process?

 

[holdum333]

My thinking is that this is a MS bug and only affects very few PCs. The upgrade should have removed MSE and replaced it with Windows Defender. It appears that didn't happen. I also would think a clean install should have left the drive clean. If you are seeing left overs from MSE, after a clean install we have a problem.
I looks to me like that may be the case here. I'll bow out now and go back to observing.
You are doing a great job @kemical and you are appreciated.

 

[kemical]

I'd rather see what Bawb say's before committing to it's either this or that. Dump files are notorious for red herrings..

 

[holdum333]

I'd rather see what Bawb say's before committing to it's either this or that. Dump files are notorious for red herrings..

Hi @kemical Your the expert my friend, but I'll bet you a beer it's MSE causing these BSODOr Bawb is not getting a clean install.
Read post #2 by @Neemobeer Many moons ago!

 

[kemical]

Hi Bawb,
Something else I meant to ask earlier is what speed did you burn the Windows install disk?

Did you verify the files after burning? What condition is the disk in, good or bad?

Apologies for all the questions but it does help.

 

[SnowManBawb]

Hi Bawb,
Something else I meant to ask earlier is what speed did you burn the Windows install disk?

Did you verify the files after burning? What condition is the disk in, good or bad?

Apologies for all the questions but it does help.

alright so
every time I did I install of windows I did it from a windows 7 disk. I purchased the disk with my first build. the disk is in perfect shape.

I upgraded from windows 7 to windows 10 so thats why it might still be there. I didnt really verify the files everything seemed fine.

And no I have no clue about MSE. For a while I had Norton AV and then i just switched to Avast which ive removed now.

Even if it wasnt a clean install the OS drive has changed and I did not copy the OS from the old drive to the ssd I did a clean install on the ssd.

 

[kemical]

I did a clean install on the ssd.

By this do you mean that you first installed windows 7 and then upgraded to windows 10 or did you use an actual Windows 10 disk or USB?

 

[SnowManBawb]

By this do you mean that you first installed windows 7 and then upgraded to windows 10 or did you use an actual Windows 10 disk or USB?

I used the windows 7 disk then to 10. Guess its not completely clean but yea

 

[kemical]

I used the windows 7 disk then to 10. Guess its not completely clean but yea

I had a sneaking feeling that a proper clean install had not been performed which is why I kept asking you about it. Anyway this is real progress of sorts as we now know why it's possibly occurring (the bsod that is).
Ok so Bawb you will need to download and burn to either disk or USB the Windows 10 iso. You will then be able to boot from the actual Windows 10 disk and wipe the drive clean.
Link Removed
Do not worry about activation. When you get an activation screen simply click skip as Windows 10 will be activated automatically once your online.

Bawb, just a word to the wise. Download your drivers first and store them somewhere safe until you need them. This is just in case your network isn't working until you install the driver. (my board is like this and won't connect until I install the network driver)
Link Removed

https://www.broadcom.com/application/ethernet_nic.php#determine_driver

Link Removed

Best of luck! Any problems please post back

 

[SnowManBawb]

I had a sneaking feeling that a proper clean install had not been performed which is why I kept asking you about it. Anyway this is real progress of sorts as we now know why it's possibly occurring (the bsod that is).
Ok so Bawb you will need to download and burn to either disk or USB the Windows 10 iso. You will then be able to boot from the actual Windows 10 disk and wipe the drive clean.
Link Removed
Do not worry about activation. When you get an activation screen simply click skip as Windows 10 will be activated automatically once your online.

Bawb, just a word to the wise. Download your drivers first and store them somewhere safe until you need them. This is just in case your network isn't working until you install the driver. (my board is like this and won't connect until I install the network driver)
Link Removed

https://www.broadcom.com/application/ethernet_nic.php#determine_driver

Link Removed

Best of luck! Any problems please post back

That might actually work. Cause the disk has not changed as well. Its always been the same windows 7 disk. damn. Alright ill try that.

I'm connected via Ethernet cable wouldn't that work even with old drivers?

 

[holdum333]

Hey Bawb! I'm going to seek a little reply in on your thread. The reason @kemical suggests the network driver is because you can always get the other drivers if you can connect to the internet. If you can't connect to the internet, it makes it harder to get the other drivers.
Good luck! I'm thinking your issue is close to being solved!

 

[kemical]

I'm connected via Ethernet cable wouldn't that work even with old drivers?

If Windows 10 carries a copy of the driver then yes you'll be fine but if like me then it doesn't.(if you have some old network drivers saved somewhere then yes sure they'll get you started) I also use an ethernet connection and until I pop the network driver on windows won't connect. To be honest i actually quite like this method. It means I can install my drivers in peace knowing that windows update can't download and install them. I usually install all my drivers leaving the network driver till last.
I just checked which network chip you have and it's a Realtek, chances are Windows 10 will carry the driver but I'd still get a copy just in case.

So use the link I provided to download a copy of the windows 10 iso and burn it to disk. Don't burn any faster than 4x.

As I'm sure your aware you will need to change your boot order so that the DVD player is first, oh and don't forget to watch for the prompt to 'Press any key' otherwise it will just boot to desktop.

Once you get to the point of choosing where you want to install Windows you see options to delete the partitions already on the C drive. I'd clear the lot and simply click next.

Do not forget about the activation page, you will be given the option to either skip or you'll see some blue writing 'I don't have a key' or words to that effect, that's the option you want. Windows will activate automatically.

Best of luck Bawb and any problems please post back.

 

[holdum333]

Nice reply @kemical I prefer the USB flash option over the disk however!. Also skip the up dates when doing the up grade. You can get them latter!
Good luck Bawb!

 

[kemical]

As I explained in post #91 one can use either a disk or USB.

 

[holdum333]

As I explained in post #91 one can use either a disk or USB.

Yes sir I read your post #91. I read all your replies! I was just saying I prefer the USB, and I recommend skipping the up dates when doing the upgrade. Of course if you're going to boot with the media, you need to make sure your PC has that option! The up dates can be added latter.
I have done several of these upgrades in my retirement village with the USB. Your the greatest on BSODs @kemical
I'm really hoping this is the solution to Bawb's issue!

 

[kemical]

One thing i forgot to mention is please don't use any driver update utilities. Use the drivers found on the motherboard support page and your machine will be a lot happier for it.
Link Removed
Regarding your chipset drivers.
You will find one download under 'Chipset' ( choose the latest version ). The other chipset driver you'll find under 'Utilities' and is called Intel engine management driver. I wouldn't bother with anything else in that Utilities section.
Good luck!

 

[SnowManBawb]

One thing i forgot to mention is please don't use any driver update utilities. Use the drivers found on the motherboard support page and your machine will be a lot happier for it.
Link Removed
Regarding your chipset drivers.
You will find one download under 'Chipset' ( choose the latest version ). The other chipset driver you'll find under 'Utilities' and is called Intel engine management driver. I wouldn't bother with anything else in that Utilities section.
Good luck!

Well The new os is installed everything that was left of the old os is gone. So now I guess ill just wait and see what happens tomorrow

 

[kemical]

Ok Bawb, thank you for the update. Hope all goes well but if not post back.