Windows 10 Blue screen after every full night shutdown.

[SnowManBawb]

Hello.



So, I've had this problem with my pc for a while now and I just have no idea what the problem might be anymore. Ive tried posting on different sites but no one answered.



Here is the problem every time my pc has been shut down for longer then an hour, the next boot up will end up in a blue screen displaying a different error code each time. Here are is few ive seen.



IRQL_NOT_LESS_OR_EQUAL



KMODE_EXCEPTION_NOT_HANDLED


Sometimes the blue screen will happen 10 minutes after it has fully started sometimes right after i log in.



Here are my specs.

• CPU Intel Core i5-4440 3.10 GHZ
  
  
• Motherboard Asus H87M-PLUS
  
  
• RAM 2 4gb sticks of Corsair DDR3 vengance ram
  
  
• GPU Asus strix R9 390
  
  
• Case Fractal Design Core 1000
  
  
• Storage Samsung 850 evo 250 gb, 500GB Seagate ST500DM002, and a 1 tb external
  
  
• PSU Corsair CS750M

Ive also ran Windgb and here are the results based on the latest blue screen.
Here is what it came up with.


Microsoft (R) Windows Debugger Version 10.0.10586.567 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\021516-4484-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 10586 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 10586.103.amd64fre.th2_release.160126-1819
Machine Name:
Kernel base = 0xfffff802`e1404000 PsLoadedModuleList = 0xfffff802`e16e2cf0
Debug session time: Mon Feb 15 15:26:13.882 2016 (UTC + 2:00)
System Uptime: 0 days 0:02:20.537
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
................................................................
..................................................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 139, {4, ffffe0018343dd60, ffffe0018343dcb8, 0}

Probably caused by : ntkrnlmp.exe ( nt!KiFastFailDispatch+d0 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000004, The thread's stack pointer was outside the legal stack
extents for the thread.
Arg2: ffffe0018343dd60, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffffe0018343dcb8, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------


DUMP_CLASS: 1

DUMP_QUALIFIER: 400

BUILD_VERSION_STRING: 10586.103.amd64fre.th2_release.160126-1819

SYSTEM_MANUFACTURER: ASUS

SYSTEM_PRODUCT_NAME: All Series

SYSTEM_SKU: All

SYSTEM_VERSION: System Version

BIOS_VENDOR: American Megatrends Inc.

BIOS_VERSION: 0306

BIOS_DATE: 04/07/2013

BASEBOARD_MANUFACTURER: ASUSTeK COMPUTER INC.

BASEBOARD_PRODUCT: H87M-PLUS

BASEBOARD_VERSION: Rev X.0x

DUMP_TYPE: 2

DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump

BUGCHECK_P1: 4

BUGCHECK_P2: ffffe0018343dd60

BUGCHECK_P3: ffffe0018343dcb8

BUGCHECK_P4: 0

TRAP_FRAME: 4b6778440205000e -- (.trap 0x4b6778440205000e)
Unable to read trap frame at 4b677844`0205000e

EXCEPTION_RECORD: 0000000000820003 -- (.exr 0x820003)
Cannot read Exception record @ 0000000000820003

CPU_COUNT: 4

CPU_MHZ: c1c

CPU_VENDOR: GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 3c

CPU_STEPPING: 3

CPU_MICROCODE: 6,3c,3,0 (F,M,S,R) SIG: 1E'00000000 (cache) 1E'00000000 (init)

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: ESP_OUT_OF_RANGE

BUGCHECK_STR: 0x139

PROCESS_NAME: AvastSvc.exe

CURRENT_IRQL: 1

ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE_STR: c0000409

EXCEPTION_PARAMETER1: 0000000000000004

WATSON_BKT_EVENT: BEX

ANALYSIS_SESSION_HOST: SNOWMANBAWB-PC

ANALYSIS_SESSION_TIME: 02-25-2016 23:47:29.0881

ANALYSIS_VERSION: 10.0.10586.567 amd64fre

BAD_STACK_POINTER: ffffe0018343da38

LAST_CONTROL_TRANSFER: from fffff802e1550fe9 to fffff802e1546480

FAULTING_THREAD: 0000000000000000

STACK_TEXT:
ffffe001`8343da38 fffff802`e1550fe9 : 00000000`00000139 00000000`00000004 ffffe001`8343dd60 ffffe001`8343dcb8 : nt!KeBugCheckEx
ffffe001`8343da40 fffff802`e1551310 : 00000000`00000000 00000000`00000000 00000180`00000400 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffffe001`8343db80 fffff802`e15504f3 : ffffc001`d3e6fba8 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiFastFailDispatch+0xd0
ffffe001`8343dd60 fffff802`e155b157 : ffffe001`8343e650 ffffe001`8343ee00 00000000`00000000 00000000`00000000 : nt!KiRaiseSecurityCheckFailure+0xf3
ffffe001`8343def0 fffff802`e1408d81 : 00000000`00000000 ffffb000`5fe51000 65657246`00000002 0dc38236`36a514f1 : nt! ?? ::FNODOBFM::`string'+0x6357
ffffe001`8343df20 fffff802`e14075a8 : ffffe001`8343ee38 ffffe001`8343eb50 ffffe001`8343ee38 00000000`00000001 : nt!RtlDispatchException+0x71
ffffe001`8343e620 fffff802`e15510c2 : 00000000`00820003 00000000`00000000 4b677844`0205000e 0dc38236`36a526d1 : nt!KiDispatchException+0x144
ffffe001`8343ed00 fffff802`e154edc6 : ffffe001`8343ef90 ffffe001`834416a0 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0xc2
ffffe001`8343eee0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiInvalidOpcodeFault+0x106


THREAD_SHA1_HASH_MOD_FUNC: 93ff434f099106b58fd2a86313b2862abc617562

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 6ca9d805ff691236db9ae5a22166f7ed00e151d5

THREAD_SHA1_HASH_MOD: 9f457f347057f10e1df248e166a3e95e6570ecfe

FOLLOWUP_IP:
nt!KiFastFailDispatch+d0
fffff802`e1551310 c644242000 mov byte ptr [rsp+20h],0

FAULT_INSTR_CODE: 202444c6

SYMBOL_STACK_INDEX: 2

SYMBOL_NAME: nt!KiFastFailDispatch+d0

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 56a849a9

IMAGE_VERSION: 10.0.10586.103

STACK_COMMAND: ~0s ; kb

BUCKET_ID_FUNC_OFFSET: d0

FAILURE_BUCKET_ID: 0x139_MISSING_GSFRAME_STACKPTR_ERROR_nt!KiFastFailDispatch

BUCKET_ID: 0x139_MISSING_GSFRAME_STACKPTR_ERROR_nt!KiFastFailDispatch

PRIMARY_PROBLEM_CLASS: 0x139_MISSING_GSFRAME_STACKPTR_ERROR_nt!KiFastFailDispatch

TARGET_TIME: 2016-02-15T13:26:13.000Z

OSBUILD: 10586

OSSERVICEPACK: 0

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 272

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2016-01-27 06:38:01

BUILDDATESTAMP_STR: 160126-1819

BUILDLAB_STR: th2_release

BUILDOSVER_STR: 10.0.10586.103.amd64fre.th2_release.160126-1819

ANALYSIS_SESSION_ELAPSED_TIME: 395

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0x139_missing_gsframe_stackptr_error_nt!kifastfaildispatch

FAILURE_ID_HASH: {7b0febb5-6007-4f2b-3d38-57fef278d8d5}

Followup: MachineOwner
---------

3: kd> lmvm nt
Browse full module list
start end module name
fffff802`e1404000 fffff802`e1bd0000 nt (pdb symbols) C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\ntkrnlmp.pdb\D03C5CF7862E48FE84A06333F1CFA5981\ntkrnlmp.pdb
Loaded symbol image file: ntkrnlmp.exe
Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\ntoskrnl.exe\56A849A97cc000\ntoskrnl.exe
Image path: ntkrnlmp.exe
Image name: ntkrnlmp.exe
Browse all global symbols functions data
Timestamp: Wed Jan 27 06:38:01 2016 (56A849A9)
CheckSum: 00727A26
ImageSize: 007CC000
File version: 10.0.10586.103
Product version: 10.0.10586.103
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrnlmp.exe
OriginalFilename: ntkrnlmp.exe
ProductVersion: 10.0.10586.103
FileVersion: 10.0.10586.103 (th2_release.160126-1819)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.

 

[Neemobeer]

It looks like your AV is the problem here. I would remove it and test. If you still get BSODs then do the following.

Check for an OS problem from an elevated command prompt type sfc /scannow and test your memory

 

[BIGBEARJEDI]

If BSODs still occur after trying Neemobeer's suggestions consider that there are often Blue-screen problems with self-built PCs when attempting upgrades. What version of Windows was on this machine before W10?

Next, I would download SEATOOLS and run BOTH short and long tests on your Samsung SSD drive. If SEATOOLS returns any errors, your drive has failed and must be replaced. As it's an SSD, you may also want to download TRIM (google it) and run that as well. Last time I looked each manufacturer has their own customized version of Trim, and I think Samsung may have their own which you'll want to get and test with.

If your SSD drive passes these tests, you can look for other culprits with your system; things like BIOS update and drivers. Did you ensure that your ASUS Mobo has the latest version of BIOS installed by checking the ASUS website? If not, you'll want to Flash your BIOS--this is high risk, so if you haven't done it yourself, you'll definitely want to pay a Pro to do for you. This is a very important step as your Mobo hardware pre-dates the release of W10 (July 29, 2015) and your Mobo is dated 2013.

After checking your BIOS, you'll need to run the Microsoft COMPATABILITY TEST. Even if you did this before, you should repeat it and produce a no-exception COMPATABILITY REPORT before reinstalling your W10, which I suspect you'll have to do here. If you failed to run it prior to your Upgrade or new Install on this self-built PC, you should do it now. Reinstall your W10 and recheck for Blue Screens. Doing these things should fix it; but without having your PC on my workbench, of course I can't guarantee it will work as each person does funny things when they build their computers.

Let us know how it goes.
Best of luck,
<<<BIGBEARJEDI>>>

 

[SnowManBawb]

sorry for the late responses but here ya go

@Neemobeer Tried running the os with the AV uninstalled didnt work. And the SFC scan found a violation and replaced the files then i ran it again and it was fine.

@BIGBEARJEDI The ssd is most definetly not the problem since i had this problem before adding it to the rig. Have yet tried updating the bios will try doing that.

 

[kemical]

Hi Bawb,
I seem to have missed your thread and have since moved it to the correct section.

In order to help you best we/I need to see your actual dump files. The error you posted can be caused by either a dodgy device driver, system service or Virus scanner.

If you read the thread found here it has an application which will help you grab the information we need:
How to ask for help with a BSOD problem

 

[SnowManBawb]

Sorry for getting back so late so here we go I tried updating my BIOS but that didnt help so I did what @kemical asked and uploaded the dump files with this post.

 

[kemical]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80105c7c7b2, ffffd0018fe21af0, 0}

*** WARNING: Unable to verify timestamp for aswSnx.sys
*** ERROR: Module load completed but symbols could not be loaded for aswSnx.sys
Probably caused by : aswSnx.sys ( aswSnx+7c7b2 )

Followup: MachineOwner
---------

Hi Bawb,
you a number of different bugchecks although almost all point to memory corruption as the probable cause. Only two mentioned anything specific driver wise, with one blaming the gpu driver and the above blaming Avast AV.
As your dump files only go up to the 23rd of this month they are still showing the old bios so please update if you haven't already.
I also checked your motherboard support page and noticed there are win 10 drivers available. Please update everything:
H87M-PLUS - Support

Please remove Avast AV and just use the on board Defender for now. Win 10 Defender is almost a straight copy of Microsoft's server AV and is is better than the last incarnation. Plus it's super stable.

I notice your running Zemana anti malware? Never heard of it personally but if your sure it's ok then leave it be if your not so sure then remove it.

I'm not entirely convinced you have a RAM issue but it would be silly to ignore the dump files and if after making the above changes the bsod's continue, check your RAM.
Windows does have a memory testing app but it can miss errors and the best app for the job is Memtest86.
If you open the link below you'll see you can run Memtest86 in two ways. You can either burn it to disk or install it onto a USB drive it's entirely up to you. You'll then need to enter the bios to change the boot order so you can boot from either the Disk or USB stick you have Memtest86 on.
You must test for at least 12 hours unless it becomes obvious there is a problem straight away.
Memtest86+ - Advanced Memory Diagnostic Tool

Please post any new dump files.

 

[SnowManBawb]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80105c7c7b2, ffffd0018fe21af0, 0}

*** WARNING: Unable to verify timestamp for aswSnx.sys
*** ERROR: Module load completed but symbols could not be loaded for aswSnx.sys
Probably caused by : aswSnx.sys ( aswSnx+7c7b2 )

Followup: MachineOwner
---------

Hi Bawb,
you a number of different bugchecks although almost all point to memory corruption as the probable cause. Only two mentioned anything specific driver wise, with one blaming the gpu driver and the above blaming Avast AV.
As your dump files only go up to the 23rd of this month they are still showing the old bios so please update if you haven't already.
I also checked your motherboard support page and noticed there are win 10 drivers available. Please update everything:
H87M-PLUS - Support

Please remove Avast AV and just use the on board Defender for now. Win 10 Defender is almost a straight copy of Microsoft's server AV and is is better than the last incarnation. Plus it's super stable.

I notice your running Zemana anti malware? Never heard of it personally but if your sure it's ok then leave it be if your not so sure then remove it.

I'm not entirely convinced you have a RAM issue but it would be silly to ignore the dump files and if after making the above changes the bsod's continue, check your RAM.
Windows does have a memory testing app but it can miss errors and the best app for the job is Memtest86.
If you open the link below you'll see you can run Memtest86 in two ways. You can either burn it to disk or install it onto a USB drive it's entirely up to you. You'll then need to enter the bios to change the boot order so you can boot from either the Disk or USB stick you have Memtest86 on.
You must test for at least 12 hours unless it becomes obvious there is a problem straight away.
Memtest86+ - Advanced Memory Diagnostic Tool

Please post any new dump files.

Removed Avast and Zemana anti malware. Zemana was something i used long ago so dont know how reliable that is.

I assumed to update the bios i just install the most recent file which I did a day prior of posting the dump files.

Ill run Memtest over night since ive heard you have to run it for a longer period of time

 

[kemical]

Ok Bawb thanks for the update. Hope all goes well and I'll await your next reply.

 

[SnowManBawb]

Ok Bawb thanks for the update. Hope all goes well and I'll await your next reply.

memtest reported 0 errors over 10 passes over 13 hours of testing. Ill shut down my pc for the night check if it blue screens and then send you the dump file from that.

 

[kemical]

Ok Bawb thanks for the update. If it does bsod there are still things we can try but first let's see if that bridge has to be crossed..

 

[SnowManBawb]

Ok Bawb thanks for the update. If it does bsod there are still things we can try but first let's see if that bridge has to be crossed..

Still crashed. Not that big of a surprise since I didnt really fix anthing since the last test. As mentioned the dump files.

 

[kemical]

Hi Bawb,
are sure your getting an actual bsod?
The only reason I'm asking is because the dump files sent are exactly the same as those sent on the 26th. See my screenshot:

Try going into the minidump folder and clearing it of dump files. Also check your event logs to see if you had an event 41 on the night in question.

 

[SnowManBawb]

Hi Bawb,
are sure your getting an actual bsod?
The only reason I'm asking is because the dump files sent are exactly the same as those sent on the 26th. See my screenshot:
View attachment 32112

Try going into the minidump folder and clearing it of dump files. Also check your event logs to see if you had an event 41 on the night in question.

Well I cleared it yesterday. Shutdown my pc for the night. And as a surprise to no one had a blue screen. after that i updated my gpu driver and got the dump files for you.

 

[kemical]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {ffffd000671d6270, 0, fffff800b133cdd8, 2}


Could not read faulting driver name
Probably caused by : memory_corruption

Followup: memory_corruption

Hi Bawb,
thats a lot better thank you. You had sent two dump files one being a bugcheck 3B (faulty system service, graphics issues) and the above, a bugcheck 50. This can be cause by AV apps, faulty system service, ntfs issues and hardware errors (usually RAM).
I can see in the dump file driver stack that this is still installed:

zamguard64.sys Mon Dec 14 10:13:23 2015: Zemana ZAM AntiMalware driver

I also found this:
MpKslb199f6cb.sys Wed May 20 02:50:37 2015: So far I cannot find any information regarding this driver. Any ideas?

Please run these scans:
File scans
Right click on the Start menu icon and from the revealed list choose 'admin command prompt'. Type:
sfc /scannow
press enter and await results

In the same command prompt and after the above scan has finished type:
dism /online /cleanup-image /restorehealth
Press enter and await results (longer this time).

If the first scan found files it could not repair but the second scan is successful, run the first scan again using the same command prompt box and this time it should repair the files found.

As the above dump file could not read the faulting drivers name let's run the driver verifier. First you will need to create a recovery disk/USB. The reason you might need this is because the verifier stress's each driver on start up. This may cause a bsod and capture the driver in a dump file but it may also cause a bsod loop on start up. If this happens you can use the recovery disk/usb to boot from, enter the recovery console and safe mode. You can then turn the verifier off.
Creating a recovery drive - Windows Help -

Verifier
How do I fix a Blue Screen in Windows using Driver Verifier?

Post any resulting dump files.

 

[SnowManBawb]

Alright I did the command prompt commands the first one found some files that it repaired.
Then I ran the clean up and then I did scannow just in case and it didnt find anything. ill do the 2nd part later today

 

[kemical]

Ok Bawb, thanks for the update.

 

[SnowManBawb]

Ok Bawb, thanks for the update.

I dont have a 8gb drive to try that out yet. So ill do it by tomorrow. And when im done ill still need to test so ill get back to you sunday. So untill then have a good weekend Kemical

 

[kemical]

You too Bawb!

 

[SnowManBawb]

You too Bawb!

For some reason i cant use my 8GB flash. It only shows my sotrage drive and my external hard drive