Windows 10: BSOD kmode_exception_not_handled (classpnp.sys)

Since last weekend, I've been seeing the BSOD a couple of time per day on average with the same KMODE CLASSPNP.SYS error message.

I AM running Kaspersky, but I have an older version of Firefox (52.5.0 32 bit ESR). What I've noticed so far, is that if I don't use my VPN (WiTopia), I've not seen the BSOD. As of now, this is only anecdotal, so I'm wondering if anyone else is using the same or similar VPN as well?

Thanks, and I'll be "reading the mail".

 

No VPN here, BSOD only when using Firefox 57.x

 

Hi all I started getting this error with multiple BSOD's today. kmode_exception_not_handled (classpnp.sys). I have Kaspersky Internet Security 2018 and Firefox 57.0.1. My computer Blue Screens when doing something in Firefox. Have no issues using Opera. I will try disabling Kaspersky to see if it will stop. Seems like on Kaspersky forums it is a bug on their end.

 

For any viewers: if you want to troubleshoot BSOD on your computer please continue to follow this thread as needed but also create a new thread so that the computer environment can be troubleshooted. Please use English as the default language and post a DM log collector zip for troubleshooting:

Language - Add, Remove, and Change in Windows 10 General Tips Tutorials
BSOD - Posting Instructions - Windows 10 Forums

 

Have had Kaspersky disabled for a day - no blue screens at all since then despite heavy firefox use. Will now try maybe just disabling the browser extension and see if it works for me.

 

Kaspersky has answered on bugzilla:

"It is our (Kaspersky) fault. We have “anti-cryptor” feature, which can safe user files, if malicious software crypt it.
There were bug in this feature driver, which sometimes lead to BSOD. There was one more bug, FireFox 57 identifies as unknown software, which should be deeply monitored. Combination of this two bugs lead to often BSOD if Kaspersky 2018 and FireFox 57 installed on the computer.
Tomorrow we are going to update our bases, to minimize the problem. I let you know, when update happens.
Complete fix will be with KIS2018 patch E before 15-Dec-2017. Also let you know."

 

Switched language to english, updated log is attached.

As previously stated, no more issues since removing Kaspersky and updating the Intel driver. Firefox version was 57.0.1 until a few minutes ago, just got an update.

 

There were no mini dump files.
The last BSOD with bugcheck 1E was on 12/2/2017
Kmode exception not handled
If there are BSOD the mini and memory dumps will be useful in the troubleshooting.
Make sure that the software is modified to retain the dumps in case there are future problems.

The logs displayed entries with possible drive corruption, paging errors, retried blocks, and recovered graphics driver


The HD studies posted into the thread only displayed error scans.
HD fail with normal error scans.
There are multiple tests needed to evaluate drives.
1) For HD Tune perform the following test:
a) Health > post images into the thread
b) Benchmark > post images into the thread

2) Open administrative command prompt and type or copy and paste: chkdsk /x /f /r
Use the syntax for the comannds: chkdsk /x /f /r c: or chkdsk /x f/ /r d: changing the letter to the applicable drive letter.
The chkdsk commands may take hours to run so plan to run them overnight.
3) Post the chkdsk results into the thread from the event viewer using the information in this link:
Read Chkdsk Log in Event Viewer in Windows 10 Performance Maintenance Tutorials

4) If Ccleaner is used > click windows tab > scroll down to system and advanced > post an image in the thread
5) In the left lower corner search type: clean > open disk cleanup > scroll up and down and post images into the thread
6) In the left lower corner search type: system > open system control panel > on the left pane click advanced system settings > on the advanced tab under startup and recovery click settings > post an image into the thread.

7) The Nvidia graphics card stopped responding and recovered.
For this you can watch over time.
Alternatively you can replace the video card.






Code: Event[590]: Log Name: System Source: Microsoft-Windows-Ntfs Date: 2017-11-12T09:48:47.403 Event ID: 140 Task: N/A Level: Warning Opcode: Info Keyword: N/A User: S-1-5-18 User Name: NT-AUTORITÄT\SYSTEM Computer: Tobi-PC Description: The system failed to flush data to the transaction log. Corruption may occur in VolumeId: P:, DeviceName: \Device\HarddiskVolume10.({Device Timeout}The specified I/O operation on %hs was not completed before the time-out period expired.)[/quote] Code: Event[596]: Log Name: System Source: Microsoft-Windows-Ntfs Date: 2017-11-12T09:49:08.408 Event ID: 140 Task: N/A Level: Warning Opcode: Info Keyword: N/A User: S-1-5-21-4132993005-648098970-1811722454-1001 User Name: TOBI-PC\Tobi Computer: Tobi-PC Description: The system failed to flush data to the transaction log. Corruption may occur in VolumeId: P:, DeviceName: \Device\HarddiskVolume10.({Device Timeout}The specified I/O operation on %hs was not completed before the time-out period expired.)[/quote] Code: Event[643]: Log Name: System Source: Microsoft-Windows-Ntfs Date: 2017-11-12T09:52:03.200 Event ID: 140 Task: N/A Level: Warning Opcode: Info Keyword: N/A User: S-1-5-18 User Name: NT-AUTORITÄT\SYSTEM Computer: Tobi-PC Description: The system failed to flush data to the transaction log. Corruption may occur in VolumeId: P:, DeviceName: \Device\HarddiskVolume10.(The I/O device reported an I/O error.)[/quote] Code: Event[1261]: Log Name: System Source: Disk Date: 2017-11-18T15:44:37.802 Event ID: 51 Task: N/A Level: Warning Opcode: N/A Keyword: Classic User: N/A User Name: N/A Computer: Tobi-PC Description: An error was detected on device \Device\Harddisk2\DR2 during a paging operation.Event[1262]: Log Name: System Source: Disk Date: 2017-11-18T15:44:37.802 Event ID: 51 Task: N/A Level: Warning Opcode: N/A Keyword: Classic User: N/A User Name: N/A Computer: Tobi-PC Description: An error was detected on device \Device\Harddisk2\DR2 during a paging operation.Event[1263]: Log Name: System Source: Disk Date: 2017-11-18T15:44:37.803 Event ID: 51 Task: N/A Level: Warning Opcode: N/A Keyword: Classic User: N/A User Name: N/A Computer: Tobi-PC Description: An error was detected on device \Device\Harddisk2\DR2 during a paging operation.Event[1264]: Log Name: System Source: Disk Date: 2017-11-18T15:44:37.803 Event ID: 51 Task: N/A Level: Warning Opcode: N/A Keyword: Classic User: N/A User Name: N/A Computer: Tobi-PC Description: An error was detected on device \Device\Harddisk2\DR2 during a paging operation.Event[1265]: Log Name: System Source: Disk Date: 2017-11-18T15:44:37.804 Event ID: 51 Task: N/A Level: Warning Opcode: N/A Keyword: Classic User: N/A User Name: N/A Computer: Tobi-PC Description: An error was detected on device \Device\Harddisk2\DR2 during a paging operation.Event[1266]: Log Name: System Source: Disk Date: 2017-11-18T15:44:37.804 Event ID: 51 Task: N/A Level: Warning Opcode: N/A Keyword: Classic User: N/A User Name: N/A Computer: Tobi-PC Description: An error was detected on device \Device\Harddisk2\DR2 during a paging operation.Event[1267]: Log Name: System Source: Disk Date: 2017-11-18T15:44:37.805 Event ID: 51 Task: N/A Level: Warning Opcode: N/A Keyword: Classic User: N/A User Name: N/A Computer: Tobi-PC Description: An error was detected on device \Device\Harddisk2\DR2 during a paging operation.Event[1268]: Log Name: System Source: Disk Date: 2017-11-18T15:44:37.805 Event ID: 51 Task: N/A Level: Warning Opcode: N/A Keyword: Classic User: N/A User Name: N/A Computer: Tobi-PC Description: An error was detected on device \Device\Harddisk2\DR2 during a paging operation.Event[1269]: Log Name: System Source: Disk Date: 2017-11-18T15:44:37.806 Event ID: 51 Task: N/A Level: Warning Opcode: N/A Keyword: Classic User: N/A User Name: N/A Computer: Tobi-PC Description: An error was detected on device \Device\Harddisk2\DR2 during a paging operation.Event[1270]: Log Name: System Source: Disk Date: 2017-11-18T15:44:37.806 Event ID: 51 Task: N/A Level: Warning Opcode: N/A Keyword: Classic User: N/A User Name: N/A Computer: Tobi-PC Description: An error was detected on device \Device\Harddisk2\DR2 during a paging operation.Event[1271]: Log Name: System Source: Disk Date: 2017-11-18T15:44:37.807 Event ID: 51 Task: N/A Level: Warning Opcode: N/A Keyword: Classic User: N/A User Name: N/A Computer: Tobi-PC Description: An error was detected on device \Device\Harddisk2\DR2 during a paging operation.Event[1272]: Log Name: System Source: Disk Date: 2017-11-18T15:44:37.807 Event ID: 51 Task: N/A Level: Warning Opcode: N/A Keyword: Classic User: N/A User Name: N/A Computer: Tobi-PC Description: An error was detected on device \Device\Harddisk2\DR2 during a paging operation.Event[1273]: Log Name: System Source: Disk Date: 2017-11-18T15:44:37.808 Event ID: 51 Task: N/A Level: Warning Opcode: N/A Keyword: Classic User: N/A User Name: N/A Computer: Tobi-PC Description: An error was detected on device \Device\Harddisk2\DR2 during a paging operation.Event[1274]: Log Name: System Source: Disk Date: 2017-11-18T15:44:37.808 Event ID: 51 Task: N/A Level: Warning Opcode: N/A Keyword: Classic User: N/A User Name: N/A Computer: Tobi-PC Description: An error was detected on device \Device\Harddisk2\DR2 during a paging operation.[/quote] Code: Event[1489]: Log Name: System Source: Display Date: 2017-11-24T14:42:36.763 Event ID: 4101 Task: N/A Level: Warning Opcode: Info Keyword: Classic User: N/A User Name: N/A Computer: Tobi-PC Description: Display driver nvlddmkm stopped responding and has successfully recovered.[/quote] Code: Event[565]: Log Name: System Source: UASPStor Date: 2017-11-12T09:45:51.025 Event ID: 129 Task: N/A Level: Warning Opcode: N/A Keyword: Classic User: N/A User Name: N/A Computer: Tobi-PC Description: Reset to device, \Device\RaidPort1, was issued.[/quote] Code: Event[563]: Log Name: System Source: Disk Date: 2017-11-12T09:45:34.025 Event ID: 153 Task: N/A Level: Warning Opcode: N/A Keyword: Classic User: N/A User Name: N/A Computer: Tobi-PC Description: The IO operation at logical block address 0x13dcf8 for Disk 4 (PDO name: \Device\0000007a) was retried.Event[564]: Log Name: System Source: Disk Date: 2017-11-12T09:45:37.365 Event ID: 153 Task: N/A Level: Warning Opcode: N/A Keyword: Classic User: N/A User Name: N/A Computer: Tobi-PC Description: The IO operation at logical block address 0x5a4760 for Disk 4 (PDO name: \Device\0000007a) was retried.[/quote]

Code: 02/12/2017 21:09 Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Nicht verfügbar Cab Id: 0 Problem signature: P1: 1e P2: ffffffffc0000005 P3: fffff802360e3fb7 P4: 0 P5: 2c P6: 10_0_16299 P7: 0_0 P8: 768_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\120217-5640-01.dmp \\?\C:\WINDOWS\TEMP\WER-26093-0.sysdata.xml \\?\C:\WINDOWS\MEMORY.DMP \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8898.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER88D7.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER88F7.tmp.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_1e_534650a36749b860192dfc60a94abec86e84f5_00000000_cab_284889e0 Analysis symbol: Rechecking for solution: 0 Report Id: b480bc1b-8794-4bdd-bc9c-334450c291c4 Report Status: 2049 Hashed bucket:02/12/2017 21:09 Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Nicht verfügbar Cab Id: 0 Problem signature: P1: 1e P2: ffffffffc0000005 P3: fffff802360e3fb7 P4: 0 P5: 2c P6: 10_0_16299 P7: 0_0 P8: 768_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\120217-5640-01.dmp \\?\C:\WINDOWS\TEMP\WER-26093-0.sysdata.xml \\?\C:\WINDOWS\MEMORY.DMP \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8898.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER88D7.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER88F7.tmp.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_1e_534650a36749b860192dfc60a94abec86e84f5_00000000_02e488f6 Analysis symbol: Rechecking for solution: 0 Report Id: b480bc1b-8794-4bdd-bc9c-334450c291c4 Report Status: 4 Hashed bucket:30/11/2017 20:08 Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Nicht verfügbar Cab Id: 0 Problem signature: P1: 1e P2: ffffffffc0000005 P3: fffff805c1c03fb7 P4: 0 P5: 2c P6: 10_0_16299 P7: 0_0 P8: 768_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\113017-5546-01.dmp \\?\C:\WINDOWS\TEMP\WER-20953-0.sysdata.xml \\?\C:\WINDOWS\MEMORY.DMP \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER82FB.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER831A.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8657.tmp.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_1e_43cef9ff772aec13ec35125f97d768d3c34f3cab_00000000_cab_247086e3 Analysis symbol: Rechecking for solution: 0 Report Id: c73726b3-6851-40c4-bca0-f11ed36111a8 Report Status: 2049 Hashed bucket:30/11/2017 20:08 Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Nicht verfügbar Cab Id: 0 Problem signature: P1: 1e P2: ffffffffc0000005 P3: fffff805c1c03fb7 P4: 0 P5: 2c P6: 10_0_16299 P7: 0_0 P8: 768_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\113017-5546-01.dmp \\?\C:\WINDOWS\TEMP\WER-20953-0.sysdata.xml \\?\C:\WINDOWS\MEMORY.DMP \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER82FB.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER831A.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8657.tmp.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_1e_43cef9ff772aec13ec35125f97d768d3c34f3cab_00000000_03248666 Analysis symbol: Rechecking for solution: 0 Report Id: c73726b3-6851-40c4-bca0-f11ed36111a8 Report Status: 4 Hashed bucket:01/12/2017 19:49 Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Nicht verfügbar Cab Id: 0 Problem signature: P1: 1e P2: ffffffffc0000005 P3: fffff806b9933fb7 P4: 0 P5: 2c P6: 10_0_16299 P7: 0_0 P8: 768_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\120117-5781-01.dmp \\?\C:\WINDOWS\TEMP\WER-29828-0.sysdata.xml \\?\C:\WINDOWS\MEMORY.DMP \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8B77.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8BE4.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8C04.tmp.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_1e_bea263192828e80dd43252b4f0cf57e8ab5ac5_00000000_cab_2c2c8ca0 Analysis symbol: Rechecking for solution: 0 Report Id: 49b2b3c5-88c6-4526-a851-2c4326459b7c Report Status: 2049 Hashed bucket:01/12/2017 19:49 Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Nicht verfügbar Cab Id: 0 Problem signature: P1: 1e P2: ffffffffc0000005 P3: fffff806b9933fb7 P4: 0 P5: 2c P6: 10_0_16299 P7: 0_0 P8: 768_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\120117-5781-01.dmp \\?\C:\WINDOWS\TEMP\WER-29828-0.sysdata.xml \\?\C:\WINDOWS\MEMORY.DMP \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8B77.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8BE4.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8C04.tmp.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_1e_bea263192828e80dd43252b4f0cf57e8ab5ac5_00000000_03408c03 Analysis symbol: Rechecking for solution: 0 Report Id: 49b2b3c5-88c6-4526-a851-2c4326459b7c Report Status: 4 Hashed bucket:01/12/2017 17:53 Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Nicht verfügbar Cab Id: 0 Problem signature: P1: 1e P2: ffffffffc0000005 P3: fffff808152c3fb7 P4: 0 P5: 2c P6: 10_0_16299 P7: 0_0 P8: 768_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\120117-5437-01.dmp \\?\C:\WINDOWS\TEMP\WER-23031-0.sysdata.xml \\?\C:\WINDOWS\MEMORY.DMP \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER7530.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER754F.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER7E68.tmp.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_1e_a728c8b7199075292722a993aedad3db5b51cee9_00000000_cab_2f0c7ef4 Analysis symbol: Rechecking for solution: 0 Report Id: 19a7362b-44fd-41b9-bd60-a8c4258078dd Report Status: 2049 Hashed bucket:01/12/2017 17:53 Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Nicht verfügbar Cab Id: 0 Problem signature: P1: 1e P2: ffffffffc0000005 P3: fffff808152c3fb7 P4: 0 P5: 2c P6: 10_0_16299 P7: 0_0 P8: 768_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\120117-5437-01.dmp \\?\C:\WINDOWS\TEMP\WER-23031-0.sysdata.xml \\?\C:\WINDOWS\MEMORY.DMP \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER7530.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER754F.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER7E68.tmp.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_1e_a728c8b7199075292722a993aedad3db5b51cee9_00000000_03247e67 Analysis symbol: Rechecking for solution: 0 Report Id: 19a7362b-44fd-41b9-bd60-a8c4258078dd Report Status: 4 Hashed bucket:02/12/2017 15:45 Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Nicht verfügbar Cab Id: 0 Problem signature: P1: 1e P2: ffffffffc0000005 P3: fffff80c6cf33fb7 P4: 0 P5: 2c P6: 10_0_16299 P7: 0_0 P8: 768_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\120217-7312-01.dmp \\?\C:\WINDOWS\TEMP\WER-24515-0.sysdata.xml \\?\C:\WINDOWS\MEMORY.DMP \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER162.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1EF.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1FF.tmp.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_1e_f4371295d704580f5c267feeccc5b46c9f2fbf2_00000000_cab_043d028b Analysis symbol: Rechecking for solution: 0 Report Id: 1140db64-ad0b-4179-998f-cb0db61fc8a1 Report Status: 2049 Hashed bucket:02/12/2017 15:45 Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Nicht verfügbar Cab Id: 0 Problem signature: P1: 1e P2: ffffffffc0000005 P3: fffff80c6cf33fb7 P4: 0 P5: 2c P6: 10_0_16299 P7: 0_0 P8: 768_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\120217-7312-01.dmp \\?\C:\WINDOWS\TEMP\WER-24515-0.sysdata.xml \\?\C:\WINDOWS\MEMORY.DMP \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER162.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1EF.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1FF.tmp.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_1e_f4371295d704580f5c267feeccc5b46c9f2fbf2_00000000_032101fe Analysis symbol: Rechecking for solution: 0 Report Id: 1140db64-ad0b-4179-998f-cb0db61fc8a1 Report Status: 4 Hashed bucket:[/quote] Code: 01/12/2017 17:59 Windows Error Reporting Fault bucket , type 0 Event Name: ScriptedDiagFailure Response: Nicht verfügbar Cab Id: 0 Problem signature: P1: Microsoft Corporation.BlueScreenDiagnostic.1.1 P2: Default P3: 1.0.0.0 P4: Default P5: P6: P7: P8: P9: P10: Attached files: These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_Microsoft Corpor_da15eef057dffa683da5341c73ad0cfb08a39b4_00000000_06a99a82 Analysis symbol: Rechecking for solution: 0 Report Id: 7790dbdc-73ef-492a-9b9a-0da09bd18185 Report Status: 4 Hashed bucket:[/quote] Code: 01/12/2017 17:59 Windows Error Reporting Fault bucket 127915145080, type 5 Event Name: ScriptedDiagFailure Response: Nicht verfügbar Cab Id: 0 Problem signature: P1: Microsoft Corporation.BlueScreenDiagnostic.1.1 P2: Default P3: 1.0.0.0 P4: Default P5: P6: P7: P8: P9: P10: Attached files: \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER9AA1.tmp.WERInternalMetadata.xml These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Microsoft Corpor_da15eef057dffa683da5341c73ad0cfb08a39b4_00000000_0e99a4c3 Analysis symbol: Rechecking for solution: 0 Report Id: 7790dbdc-73ef-492a-9b9a-0da09bd18185 Report Status: 268435456 Hashed bucket: 6c3ebb8d12cafe7a1d859b3e218ee0c6[/quote]

 

I've run the chkdsk on C, but the Wininit event log it created is in German, which I guess isn't much of a use? Language is still set to English.

 

If the chkdsk was ran with all 3 switches you can post and translate.
If it was not run with the r switch then please re-run it on the partition overnight.

 

Since I didn't delete the minidump files, I guess they got deleted automatically, and I'd have to save them manually if I wanted to keep them?

1a) b)
Health/Benchmark C










Health/Benchmark D










Benchmark T (didn't give any health info)





2/3)
Wininit C:
Code: Level Date and Time Source Event ID Task Category Information 08/12/2017 20:48:01 Microsoft-Windows-Wininit 1001 None " Dateisystem auf C: wird überprüft. Der Typ des Dateisystems ist NTFS. Die Volumebezeichnung lautet Windows. Eine Datenträgerüberprüfung ist geplant. Die Datenträgerüberprüfung wird jetzt ausgeführt. Phase 1: Die Basisdatei-Systemstruktur wird untersucht... Instanzkennung für Datei 0x41311 wird aufgeräumt. 492800 Datensätze verarbeitet. Dateiüberprüfung beendet. 7281 große Datensätze verarbeitet. 0 ungültige Datensätze verarbeitet. Phase 2: Die Dateinamenverknüpfung wird untersucht... 1841 Analysedatensätze verarbeitet. 598244 Indexeinträge verarbeitet. Indexüberprüfung beendet. 0 nicht indizierte Dateien überprüft. 0 nicht indizierte Dateien wiederhergestellt. 1841 Analysedatensätze verarbeitet. Phase 3: Sicherheitsbeschreibungen werden untersucht... 5216 nicht verwendete Indexeinträge aus Index $SII der Datei 0x9 werden aufgeräumt. 5216 nicht verwendete Indexeinträge aus Index $SDH der Datei 0x9 werden aufgeräumt. 5216 nicht verwendete Sicherheitsbeschreibungen werden aufgeräumt. Überprüfung der Sicherheitsbeschreibungen beendet. 52723 Datendateien verarbeitet. CHKDSK überprüft USN-Journal... Die Überprüfung von USN-Journal ist abgeschlossen. Phase 4: Es wird nach fehlerhaften Clustern in Benutzerdateidaten gesucht... 492784 Dateien wurden verarbeitet. Dateidatenüberprüfung beendet. Phase 5: Es wird nach fehlerhaften, freien Clustern gesucht... 43919123 freie Cluster verarbeitet. Verifizierung freien Speicherplatzes ist beendet. Es wurden Korrekturen am Dateisystem vorgenommen. Es sind keine weiteren Aktionen erforderlich. 248850431 KB Speicherplatz auf dem Datenträger insgesamt 72465728 KB in 195551 Dateien 134956 KB in 52724 Indizes 0 KB in fehlerhaften Sektoren 573251 KB vom System benutzt 65536 KB von der Protokolldatei belegt 175676496 KB auf dem Datenträger verfügbar 4096 Bytes in jeder Zuordnungseinheit 62212607 Zuordnungseinheiten auf dem Datenträger insgesamt 43919124 Zuordnungseinheiten auf dem Datenträger verfügbar Interne Informationen: 00 85 07 00 66 c9 03 00 00 f4 06 00 00 00 00 00 ....f........... e1 06 00 00 50 00 00 00 00 00 00 00 00 00 00 00 ....P........... Die Überprüfung des Datenträgers wurde abgeschlossen. Bitte warten Sie bis der Computer neu gestartet wurde. "[/quote]
Chkdsk D
Code: Level Date and Time Source Event ID Task Category Information 09/12/2017 01:59:03 Chkdsk 26214 None "Chkdsk was executed in read/write mode. Checking file system on D: The type of the file system is NTFS. Volume dismounted. All opened handles to this volume are now invalid. Stage 1: Examining basic file system structure ... 790272 file records processed. File verification completed. 550 large file records processed. 0 bad file records processed. Stage 2: Examining file name linkage ... 15053 reparse records processed. 875450 index entries processed. Index verification completed. 0 unindexed files scanned. 0 unindexed files recovered to lost and found. 15053 reparse records processed. Stage 3: Examining security descriptors ... Cleaning up 42 unused index entries from index $SII of file 0x9. Cleaning up 42 unused index entries from index $SDH of file 0x9. Cleaning up 42 unused security descriptors. Security descriptor verification completed. 42590 data files processed. CHKDSK is verifying Usn Journal... 38999776 USN bytes processed. Usn Journal verification completed. Stage 4: Looking for bad clusters in user file data ... 790256 files processed. File data verification completed. Stage 5: Looking for bad, free clusters ... 238085608 free clusters processed. Free space verification is complete. Windows has scanned the file system and found no problems. No further action is required. 1953382399 KB total disk space. 999967440 KB in 426777 files. 118128 KB in 42591 indexes. 0 KB in bad sectors. 954395 KB in use by the system. 65536 KB occupied by the log file. 952342436 KB available on disk. 4096 bytes in each allocation unit. 488345599 total allocation units on disk. 238085609 allocation units available on disk. "[/quote]
Chkdsk T (external)
Code: Level Date and Time Source Event ID Task Category Information 09/12/2017 13:40:51 Chkdsk 26214 None "Chkdsk was executed in read/write mode. Checking file system on T: The type of the file system is NTFS. Volume dismounted. All opened handles to this volume are now invalid. Volume label is My Passport. Stage 1: Examining basic file system structure ... 285440 file records processed. File verification completed. 4 large file records processed. 0 bad file records processed. Stage 2: Examining file name linkage ... 17 reparse records processed. 346820 index entries processed. Index verification completed. 0 unindexed files scanned. 0 unindexed files recovered to lost and found. 17 reparse records processed. Stage 3: Examining security descriptors ... Cleaning up 35 unused index entries from index $SII of file 0x9. Cleaning up 35 unused index entries from index $SDH of file 0x9. Cleaning up 35 unused security descriptors. Security descriptor verification completed. 30691 data files processed. CHKDSK is verifying Usn Journal... 679504 USN bytes processed. Usn Journal verification completed. Stage 4: Looking for bad clusters in user file data ... 285424 files processed. File data verification completed. Stage 5: Looking for bad, free clusters ... 154615377 free clusters processed. Free space verification is complete. CHKDSK discovered free space marked as allocated in the master file table (MFT) bitmap. Windows has made corrections to the file system. No further action is required. 976728063 KB total disk space. 357821828 KB in 162499 files. 62776 KB in 30692 indexes. 0 KB in bad sectors. 381947 KB in use by the system. 65536 KB occupied by the log file. 618461512 KB available on disk. 4096 bytes in each allocation unit. 244182015 total allocation units on disk. 154615378 allocation units available on disk. "[/quote]
4) don't have CCleaner installed

5)














6)

 

For startup and recovery settings > un-check automatic restart
For chkdsk all of the commands were run months ago.
Please re-run the chkdsk on all partitions using the command: chkdsk /x /f /r C:
Change the letter C: to the applicable drive letter.

C:\Windows\system32>chkdsk /x /f /r
The type of the file system is NTFS.
Cannot lock current drive.


Chkdsk cannot run because the volume is in use by another
process. Would you like to schedule this volume to be
checked the next time the system restarts? (Y/N)

Type: Y
reboot

This may take many hours so plan to run overnight.



Open file explorer > this PC > C: > right upper corner type: C:\windows\memory.dmp
Post the file into the thread using a one drive or drop box share link.

 

Both wininit and chkdsk were run today/yesterday with the exact command you posted. Date also says that, 8th and 9th of December respectively.

No memory.dmp file found within c:\windows.

 

The reports that were posted into the thread are dated: 08/12/2017 and 9/2017
So they are old tests.


Download and install: Whocrashed:
Resplendence Software - WhoCrashed, automatic crash dump analyzer
In the left upper corner above analyze click tools > crash dump test > type: ACCEPT
After the dump click analyze > view the results > it should display dead or deaddead > post the results into the thead
After the crash dump test > run the DM log collecter > post a zip into the thread:
BSOD - Posting Instructions - Windows 10 Forums

 

It's the DD/MM/YYYY format, so yesterday and today.