Windows 10: BSOD Trend with 19h1 (Win10 Pro)

I have been experiencing a series of BSODs since the 19h1 update on Nov 12th. At first I thought it was hardware related, so I started swapping memory chips and GPUs... no fix that way.


Then I started watching my event viewer and noticed a trend related to my AMD Processor. I am running a non-OC AMD 2700X, with 32G of DDR4 at 2133 stock, again no-OC. I had an issue with the Chipset (ASMEDIA) interferring with my Commander Pro RGB Controller, so I pulled the USB Cable, but the BSODs continued. There were multiple Errors in the Event Viewer for the Corsair device, but that is a known problem with the ASMEDIA Driver Set, so I will be replacing the Motherboard to fix that issue. (meh)


Today I crashed again, but no BSOD this time. It was really weird - I attempted to move (drag) a folder from my right monitor to my left monitor, and as I let go of the folder to complete the Move, the computer black screened on me, with no response from the KB or Mouse. Caps-Lock did not light up at all. hmmm.... So, I waited a minute, and then just shut her down with the PSU Switch.


So, I went into research mode and found my way back to the Event Viewer and my Minidump folder. DL'd WinDbg and began reading the details on debugging. That's beyond my scope, so I throw it up for the MS Team analyze. My last official BSOD that created a dmp file was 23 Nov 2019, so here it is below. I have also included some interesting screenshots of things I do not understand that appear relative to the problem, however I do not know how to repair the problem.


Special Notes: This is a fresh install of Win10 Pro on an EVO 970Pro 500gb (nvme) No other hardware changes have taken place in 8 months. No other BSODs on my other SSD, this all begain after the 19h1 update.



Microsoft (R) Windows Debugger Version 10.0.19494.1001 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\112319-7781-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 18362 MP (16 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 18362.1.amd64fre.19h1_release.190318-1202
Machine Name:
Kernel base = 0xfffff807`2f000000 PsLoadedModuleList = 0xfffff807`2f448170
Debug session time: Sat Nov 23 23:23:13.252 2019 (UTC - 6:00)
System Uptime: 0 days 2:31:28.938
Loading Kernel Symbols
...............................................................
................................................................
...........................................................
Loading User Symbols
Loading unloaded module list
......
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff807`2f1c14e0 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffff9084`3dae6550=000000000000000a
11: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000004, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8072f1c88af, address which referenced memory

Debugging Details:
------------------

*** WARNING: Unable to verify checksum for win32k.sys

KEY_VALUES_STRING: 1

Key : Analysis.CPU.Sec
Value: 3

Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-AUCNKUU

Key : Analysis.DebugData
Value: CreateObject

Key : Analysis.DebugModel
Value: CreateObject

Key : Analysis.Elapsed.Sec
Value: 13

Key : Analysis.Memory.CommitPeak.Mb
Value: 70

Key : Analysis.System
Value: CreateObject


BUGCHECK_CODE: a

BUGCHECK_P1: 4

BUGCHECK_P2: 2

BUGCHECK_P3: 1

BUGCHECK_P4: fffff8072f1c88af

WRITE_ADDRESS: fffff8072f5733b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff8072f42a3c8: Unable to get Flags value from nt!KdVersionBlock
fffff8072f42a3c8: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
0000000000000004

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

TRAP_FRAME: ffff90843dae6690 -- (.trap 0xffff90843dae6690)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000004 rbx=0000000000000000 rcx=ffff90843dae6cc0
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8072f1c88af rsp=ffff90843dae6820 rbp=00000067b4bbbdff
r8=000000010000002d r9=0000000000000000 r10=ffff800200a88180
r11=ffffa18d3b080080 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr ac po cy
nt!SwapContext+0x36f:
fffff807`2f1c88af 0fc719 xrstors [rcx]
Resetting default scope

STACK_TEXT:
ffff9084`3dae6548 fffff807`2f1d32e9 : 00000000`0000000a 00000000`00000004 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
ffff9084`3dae6550 fffff807`2f1cf62b : ffffa18d`4749e010 ffffa18d`00000000 ffffa18d`49b25470 ffffa18d`43fa2df0 : nt!KiBugCheckDispatch+0x69
ffff9084`3dae6690 fffff807`2f1c88af : 00000067`b4bbbdff 00000000`00000001 ffff8002`00000000 00000001`0000002d : nt!KiPageFault+0x46b
ffff9084`3dae6820 fffff807`2f1c8266 : 00000000`00000000 00000000`00000001 00000000`000009c8 ffffa18d`4a1d6400 : nt!SwapContext+0x36f
ffff9084`3dae6860 fffff807`2f03c7bd : ffff8002`00a88180 ffffa18d`fffffffe ffff8002`ffffffff 00000000`00000001 : nt!KiSwapContext+0x76
ffff9084`3dae69a0 fffff807`2f03b644 : ffffa18d`490a7040 fffff807`00000000 ffffa18d`00000000 00000000`00000000 : nt!KiSwapThread+0xbfd
ffff9084`3dae6a40 fffff807`2f0bd96c : ffffa18d`47652040 00000000`00000000 fffff807`405b5800 ffffa18d`490a7180 : nt!KiCommitThreadWait+0x144
ffff9084`3dae6ae0 fffff807`2f0bd450 : ffffa18d`3b1029e0 ffffa18d`490a7000 fffff807`2f067b00 ffff9f58`00000008 : nt!KeRemovePriQueue+0x25c
ffff9084`3dae6b70 fffff807`2f12a7a5 : ffffa18d`490a7040 00000000`00000080 ffffa18d`3b080080 ffff9f1d`00000001 : nt!ExpWorkerThread+0xa0
ffff9084`3dae6c10 fffff807`2f1c8b2a : ffff8002`00896180 ffffa18d`490a7040 fffff807`2f12a750 00000000`00000064 : nt!PspSystemThreadStartup+0x55
ffff9084`3dae6c60 00000000`00000000 : ffff9084`3dae7000 ffff9084`3dae1000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x2a


SYMBOL_NAME: nt!SwapContext+36f

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

IMAGE_VERSION: 10.0.18362.476

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: 36f

FAILURE_BUCKET_ID: AV_nt!SwapContext

OS_VERSION: 10.0.18362.1

BUILDLAB_STR: 19h1_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {47b746a3-60bf-1f5a-5fa5-88903b6a3204}

Followup: MachineOwner
---------



Tonight's hard-crash screenshot is below, here are the details:




- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>


<Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331c3b3a-2005-44c2-ac5e-77220c37d6b4}" />
<EventID>41</EventID>
<Version>6</Version>
<Level>1</Level>
<Task>63</Task>
<Opcode>0</Opcode>
<Keywords>0x8000400000000002</Keywords>
<TimeCreated SystemTime="2019-11-28T01:20:52.011176700Z" />
<EventRecordID>3532</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>DESKTOP-AUCNKUU</Computer>
<Security UserID="S-1-5-18" />
</System>
- <EventData>
<Data Name="BugcheckCode">0</Data>
<Data Name="BugcheckParameter1">0x0</Data>
<Data Name="BugcheckParameter2">0x0</Data>
<Data Name="BugcheckParameter3">0x0</Data>
<Data Name="BugcheckParameter4">0x0</Data>
<Data Name="SleepInProgress">0</Data>
<Data Name="PowerButtonTimestamp">0</Data>
<Data Name="BootAppStatus">0</Data>
<Data Name="Checkpoint">41</Data>
<Data Name="ConnectedStandbyInProgress">false</Data>
<Data Name="SystemSleepTransitionsToOn">1</Data>
<Data Name="CsEntryScenarioInstanceId">0</Data>
<Data Name="BugcheckInfoFromEFI">false</Data>
<Data Name="CheckpointStatus">0</Data>
</EventData>
</Event>









Seeking your guidance and wisdom as this is obviously a deeper issue and a bad driver.


TIA

:)

 

Trend Micro

Windows 10 will not upgrade to the latest because it says that Trend Micro Internet Security 2009 is installed.
I have searched for any file with "Trend*.* in the file name anywhere on C drive.
I then searched the registry for the same. Having failed to find anything so far, I then searched the entire registry with no luck.
I then searched INSIDE of all files on the C drive and failed to find anything.
I have also used the removal tools provided by Trend on their website such as:

• Ti_120_win_en_Tool_TMRemnantFileRemoveTool_hfb001.exe

and

• Ti_120_win_en_Tool_UninstallTool_hfb0001.exe

None of the above has solved my problem. How can I fix this?

Thanks in advanced.

 

undetectable Trend Micro Internet Security 2008

Hello, I am trying to upgrade from Windows 7 to Windows 10. I performed the quick check, and it stated that everything was compatible except I needed to uninstall Trend Micro Internet Security 2008, as it wasn't compatible with the upgrade. I've exhausted
every option on Trend Micro's website to complete and uninstall, to no avail. It cannot be found. There is no listing of Trend Micro on my computer, whatsoever, and after installing their uninstall tool, and completing all instructions, restarting, etc.,
Windows 10 cannot complete the upgrade.

Any help/suggestions would be greatly appreciated, as I'm stumped.

 

Forgot password to uninstall Trend Micro OfficeScan

Hi,



Thank you for writing to Microsoft Community Forums.



I understand that while upgrading from Windows 7 to Windows 10, you are asked to uninstall Trend Micro OfficeScan.



Since you do not remember the password for it, let us try the methods mentioned below and see if that helps:



Uninstall using Trend Micro Diagnostic Toolkit:



I would suggest you to try uninstalling Trend Micro using the Diagnostic Toolkit provided by Trend Micro. Refer the steps mentioned in the section
How to uninstall your Trend Micro Security program using the Diagnostic Toolkit
from the article
Uninstalling Trend Micro Security software on your Windows™ PC.



If using the Dianostic Toolkit doesn’t work, we might have to modify the registry to uninstall it. Refer the steps mentioned below:



Note: Important this section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow
these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs.



Follow the steps to take backup of registry.

1. Press Windows Logo key + R, to open
   Run dialog box.
   
2. Type regedit and click on
   OK.
   
3. Now, browse to the following path: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc
   
4. Once there, on the right pane, double click on
   Allow Uninstall and change the value to 1.
   
5. Click on OK.
   
6. Close registry editor and try uninstalling
   Trend Micro.
   

If you are unable to change the registry value, you may want to boot the computer into Safe Mode and then try changing the registry. Refer the section From Settings in the article

Start your PC in safe mode in Windows 10. Once the PC is booted to Safe Mode, try changing the registry value, restart the computer and uninstall Trend Micro.



However, if you are using Enterprise Edition of the product, you may also want to check Uninstalling
clients or agents in OfficeScan.



Let us know how it goes.



Regards,

Nikhar Khare

Microsoft Community - Moderator