Windows 10: BSOD Randomly when doing anything - Build 10056

Hi.

I'm getting a BSOD I've googled the error code and could see it was a RAM Memory Issue. This is not the case. I'm on Build 10056. Tested other RAM in the computer and the same issue occurs. It's random and I can't say when it happens Only apps I use are Skype, Chrome, Steam, BitDefender and Razer Synapse.

Attachment 17228

:)

 

[Windows 10] Airplane mode OSD won't show up after reboot

Tracking back to Windows 10 build 10056, can't reproduce this issue.

 

Random BSOD Kernel Security Check Failures Windows 10

I've recently had a lot of problems with BSOD kernel security check failures. They seem to happen pretty randomly, not when I'm doing anything in particular. My laptop was stuck in a BSOD unexpected kernel trap earlier but I restored it to a previous state.
Currently, the BSODs happen about 2-3 times a day. Just wondering if there are some tests I can run to see what may be wrong. So far, I've run the the command sfc /scannow which came back fine.

Minidump files if they're useful:

Microsoft OneDrive - Access files anywhere. Create docs with free Office Online.

Thanks!

 

Most BSOD's show up in RAM. This is because it's one of the prime conditions that can cause Windows to "fail fast". When the errors cause problems in RAM, the RAM can self-destruct if it's not stopped - so the Windows stops it in order to save the hardware.

While BSOD's may seem random, it's my theory that they aren't. It's just that we haven't discovered the pattern yet (and the pattern may not even be visible to us under normal use).

In this case, it seems that the NTFS.sys driver is shown as causing problems in each of the memory dumps.
The NTFS.sys driver is a driver that controls the NTFS file system on your hard drive.
When Windows drivers are blamed in a memory dump - in most cases it's not the actual cause.

So, now let's start the analysis.....

You have no Windows Updates installed. This is most likely because there are none available for the leaked build that you are using.
One of the drawbacks of using a leaked build is that there's no way of knowing what's wrong with it and why it wasn't released to the Fast update track. As such we will have to proceed as if there is no problem with the build itself - but this can make troubleshooting very frustrating.

Your BIOS/UEFI dates from August of 2014. I'd suggest ensuring that you have the latest available BIOS/UEFI for your system
You currently have version 2107. As there is no info on what model Asus you have, I'm unable to see if there is a more updated version available.

If using the H81M-D PLUS motherboard (from the memory dumps), then the latest BIOS/UEFI version available is version 2303 dated from 17 April 2015 ( ASUSTeK Computer Inc. -Support- Driver & Tools - H81M-D PLUS
)

These devices have problems in Device Manager:

These are drivers for the chipset of your system. At a minimum I'd suggest installing the latest, Win8.1 compatible chipset drivers from the Asus website. But, if able, I'd get the latest available chipset drivers from the Intel website. These are likely to be more current and may even have been tested with Win10.

Many Windows Update failures in the WER section of MSINFO32. I suspect that these are due to this being a leaked build (so WIndows Update doesn't recognize the device), but can't be sure as there's no info to compare this to. If you can search the web for the Windows Update error codes, you may be able to make an association with leaked builds.

Daemon Tools has long been known to cause BSOD's on some Windows systems (starting with Win7 and occurring in Win8 and 8.1): I've seen one issue with it in Win10, so I suspect that this is also a problem in Win10. Here's my canned speech about it:

Also, you have these 3 drivers on the system:

These are file system drivers of different sorts, and it's possible that they impact on the NTFS.sys driver - and could be causing the BSOD's. The test for this is to remove the programs associated with them and see if that stops the BSOD's.

While the xusb22.sys driver hasn't been implicated in many BSOD's, it's present in a lot of systems that have BSOD's (may be related or may just be a coincidence). It's predecessor (xusb21.sys) was a known BSOD cause in Windows systems. This driver is related to a wireless XBox controller. In order to test it for BSOD's, uninstall the software for it and then physically remove the device from the system while testing.

These 2 drivers appear to be new Windows drivers, but there is very little info on them on the web, and they appear to only have been spotted in Russia. I would expect that there would be information from other countries, but this is speculation as we don't know the spread of the leaked build (both in time and in location).

The point in discussing them is if they are Windows drivers, there's not a problem with them (as we can't do anything with them). BUT, if they aren't Windows drivers, then they can be a problem on the system. They can be untested drivers for some other program/device on your system, or they could even be malware.

Are there any other members using build 10056 who can check to see if these new drivers are on their systems?
Also, try comparing the location that the build was acquired from to help rule out that you are using the exact same build.

Beyond that, I'd then try these free hardware diagnostics: Hardware Diagnostics
As the errors point to NTFS.sys, I'd start with hard drive diagnostics first.
Good luck!

Analysis:
The following is for informational purposes only.
Code: **************************Mon Apr 20 16:58:05.499 2015 (UTC - 4:00)************************** Loading Dump File [C:\Users\John\SysnativeBSODApps\042015-26562-01.dmp] *** WARNING: Unable to verify timestamp for ntoskrnl.exe *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe Windows 8 Kernel Version 10056 MP (4 procs) Free x64 Built by: 10056.0.amd64fre.fbl_impressive.150405-1348 System Uptime:0 days 3:26:37.203 *** WARNING: Unable to verify timestamp for ntoskrnl.exe *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe *** WARNING: Unable to verify timestamp for NTFS.sys *** ERROR: Module load completed but symbols could not be loaded for NTFS.sys Probably caused by :NTFS.sys ( NTFS+18f2d ) BugCheck 3B, {c0000005, fffff801dd738f2d, ffffd00023d6abd0, 0} BugCheck Info: SYSTEM_SERVICE_EXCEPTION (3b) Arguments: Arg1: 00000000c0000005, Exception code that caused the bugcheck Arg2: fffff801dd738f2d, Address of the instruction which caused the bugcheck Arg3: ffffd00023d6abd0, Address of the context record for the exception that caused the bugcheck Arg4: 0000000000000000, zero. BUGCHECK_STR: 0x3B DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT FAILURE_BUCKET_ID: WRONG_SYMBOLS CPUID: "Intel(R) Core(TM) i5-4590 CPU @ 3.30GHz" MaxSpeed: 3300 CurrentSpeed: 3300 BIOS Version 2107 BIOS Release Date 08/08/2014 Manufacturer ASUS Baseboard Manufacturer ASUSTeK COMPUTER INC. Product Name All Series Baseboard Product H81M-D PLUS ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨`` **************************Mon Apr 20 13:30:56.497 2015 (UTC - 4:00)************************** Loading Dump File [C:\Users\John\SysnativeBSODApps\042015-33703-01.dmp] *** WARNING: Unable to verify timestamp for ntoskrnl.exe *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe Windows 8 Kernel Version 10056 MP (4 procs) Free x64 Built by: 10056.0.amd64fre.fbl_impressive.150405-1348 System Uptime:0 days 10:43:29.201 *** WARNING: Unable to verify timestamp for ntoskrnl.exe *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe *** WARNING: Unable to verify timestamp for NTFS.sys *** ERROR: Module load completed but symbols could not be loaded for NTFS.sys Probably caused by :NTFS.sys ( NTFS+18f2d ) BugCheck 3B, {c0000005, fffff80068e18f2d, ffffd0016ab7cbd0, 0} BugCheck Info: SYSTEM_SERVICE_EXCEPTION (3b) Arguments: Arg1: 00000000c0000005, Exception code that caused the bugcheck Arg2: fffff80068e18f2d, Address of the instruction which caused the bugcheck Arg3: ffffd0016ab7cbd0, Address of the context record for the exception that caused the bugcheck Arg4: 0000000000000000, zero. BUGCHECK_STR: 0x3B DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT FAILURE_BUCKET_ID: WRONG_SYMBOLS CPUID: "Intel(R) Core(TM) i5-4590 CPU @ 3.30GHz" MaxSpeed: 3300 CurrentSpeed: 3300 BIOS Version 2107 BIOS Release Date 08/08/2014 Manufacturer ASUS Baseboard Manufacturer ASUSTeK COMPUTER INC. Product Name All Series Baseboard Product H81M-D PLUS ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨`` **************************Sun Apr 19 17:27:32.433 2015 (UTC - 4:00)************************** Loading Dump File [C:\Users\John\SysnativeBSODApps\041915-23906-01.dmp] *** WARNING: Unable to verify timestamp for ntoskrnl.exe *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe Windows 8 Kernel Version 10056 MP (4 procs) Free x64 Built by: 10056.0.amd64fre.fbl_impressive.150405-1348 System Uptime:0 days 1:18:26.140 *** WARNING: Unable to verify timestamp for ntoskrnl.exe *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe *** WARNING: Unable to verify timestamp for NTFS.sys *** ERROR: Module load completed but symbols could not be loaded for NTFS.sys Probably caused by :NTFS.sys ( NTFS+18f2d ) BugCheck 3B, {c0000005, fffff8015cd38f2d, ffffd0006846fbd0, 0} BugCheck Info: SYSTEM_SERVICE_EXCEPTION (3b) Arguments: Arg1: 00000000c0000005, Exception code that caused the bugcheck Arg2: fffff8015cd38f2d, Address of the instruction which caused the bugcheck Arg3: ffffd0006846fbd0, Address of the context record for the exception that caused the bugcheck Arg4: 0000000000000000, zero. BUGCHECK_STR: 0x3B DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT FAILURE_BUCKET_ID: WRONG_SYMBOLS CPUID: "Intel(R) Core(TM) i5-4590 CPU @ 3.30GHz" MaxSpeed: 3300 CurrentSpeed: 3300 BIOS Version 2107 BIOS Release Date 08/08/2014 Manufacturer ASUS Baseboard Manufacturer ASUSTeK COMPUTER INC. Product Name All Series Baseboard Product H81M-D PLUS ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨`` **************************Sun Apr 19 15:27:09.849 2015 (UTC - 4:00)************************** Loading Dump File [C:\Users\John\SysnativeBSODApps\041915-34546-01.dmp] *** WARNING: Unable to verify timestamp for ntoskrnl.exe *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe Windows 8 Kernel Version 10056 MP (4 procs) Free x64 Built by: 10056.0.amd64fre.fbl_impressive.150405-1348 System Uptime:0 days 1:17:26.554 *** WARNING: Unable to verify timestamp for ntoskrnl.exe *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe *** WARNING: Unable to verify timestamp for NTFS.sys *** ERROR: Module load completed but symbols could not be loaded for NTFS.sys Probably caused by :NTFS.sys ( NTFS+18f2d ) BugCheck 3B, {c0000005, fffff800df948f2d, ffffd00022035bd0, 0} BugCheck Info: SYSTEM_SERVICE_EXCEPTION (3b) Arguments: Arg1: 00000000c0000005, Exception code that caused the bugcheck Arg2: fffff800df948f2d, Address of the instruction which caused the bugcheck Arg3: ffffd00022035bd0, Address of the context record for the exception that caused the bugcheck Arg4: 0000000000000000, zero. BUGCHECK_STR: 0x3B DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT FAILURE_BUCKET_ID: WRONG_SYMBOLS CPUID: "Intel(R) Core(TM) i5-4590 CPU @ 3.30GHz" MaxSpeed: 3300 CurrentSpeed: 3300 BIOS Version 2107 BIOS Release Date 08/08/2014 Manufacturer ASUS Baseboard Manufacturer ASUSTeK COMPUTER INC. Product Name All Series Baseboard Product H81M-D PLUS ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨`` [/quote] 3rd Party Drivers:
The following is for information purposes only.
Any drivers in red should be updated or removed from your system. And should have been discussed in the body of my post.
Code: **************************Mon Apr 20 16:58:05.499 2015 (UTC - 4:00)************************** AsIO.sys Wed Aug 22 05:54:47 2012 (5034AC67) trufos.sys Wed Mar 6 06:47:58 2013 (51372CEE) avc3.sys Thu Apr 11 04:31:58 2013 (516674FE) avckf.sys Thu Apr 11 04:35:04 2013 (516675B8) gzflt.sys Mon Apr 22 06:21:00 2013 (51750F0C) rzpmgrk.sys Thu Apr 17 15:36:12 2014 (53502D2C) nvhda64v.sys Thu Oct 9 13:02:27 2014 (5436BFA3) rzpnk.sys Fri Oct 17 15:38:10 2014 (54417022) nvvad64v.sys Thu Nov 20 10:33:54 2014 (546E09E2) dtlitescsibus.sys Mon Dec 8 05:13:10 2014 (548579B6) rt640x64.sys Wed Jan 28 16:19:48 2015 (54C95274) RTKVHD64.sys Mon Mar 2 04:57:24 2015 (54F43404) rzendpt.sys Mon Mar 9 22:48:03 2015 (54FE5B63) rzudd.sys Mon Mar 9 22:48:05 2015 (54FE5B65) nvlddmkm.sys Wed Mar 11 15:48:01 2015 (55009BF1) NvStreamKms.sys Tue Mar 17 02:19:52 2015 (5507C788) WindowsTrustedRTProxy.sys Sun Apr 5 20:32:52 2015 (5521D434) WindowsTrustedRT.sys Sun Apr 5 20:32:52 2015 (5521D434) intelppm.sys Sun Apr 5 20:36:20 2015 (5521D504) filecrypt.sys Sun Apr 5 20:45:55 2015 (5521D743) mirahid.sys Sun Apr 5 21:00:18 2015 (5521DAA2) storqosflt.sys Sun Apr 5 21:06:34 2015 (5521DC1A) xusb22.sys Sun Apr 5 21:42:19 2015 (5521E47B) nvvadarm.sys Wed Apr 8 16:53:37 2015 (55259551) [/quote] http://www.carrona.org/drivers/driver.php?id=AsIO.sys
http://www.carrona.org/drivers/driver.php?id=trufos.sys
http://www.carrona.org/drivers/driver.php?id=avc3.sys
http://www.carrona.org/drivers/driver.php?id=avckf.sys
http://www.carrona.org/drivers/driver.php?id=gzflt.sys
http://www.carrona.org/drivers/driver.php?id=rzpmgrk.sys
http://www.carrona.org/drivers/driver.php?id=nvhda64v.sys
http://www.carrona.org/drivers/driver.php?id=rzpnk.sys
http://www.carrona.org/drivers/driver.php?id=nvvad64v.sys
dtlitescsibus.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
rt640x64.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
http://www.carrona.org/drivers/driver.php?id=RTKVHD64.sys
http://www.carrona.org/drivers/driver.php?id=rzendpt.sys
http://www.carrona.org/drivers/driver.php?id=rzudd.sys
http://www.carrona.org/drivers/driver.php?id=nvlddmkm.sys
http://www.carrona.org/drivers/driver.php?id=NvStreamKms.sys
WindowsTrustedRTProxy.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
WindowsTrustedRT.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
http://www.carrona.org/drivers/driver.php?id=intelppm.sys
filecrypt.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
mirahid.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
storqosflt.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
http://www.carrona.org/drivers/driver.php?id=xusb22.sys
http://www.carrona.org/drivers/driver.php?id=nvvadarm.sys

 

While not necessary at this point, you may want to run Driver Verifier to see if it'll help point out the actual problem.
If you do this, do it before removing any programs - as you may remove the problem, and then Driver Verifier won't show anything.
Instructions for Driver Verifier here: Driver Verifier Settings (I haven't updated it for Win10, and there may be a tutorial in the Tutorials section for Win10).

Good luck!

 

There is a W10 Driver Verifier tutorial here if you ever need one.

Driver Verifier - Enable and Disable in Windows 10 - Windows 10 Forums