Windows 10: Random BSOD even with fresh reset, can't find the cause

Hi,

I'm having BSODs on my laptop since months and I struggle finding the reason.
I asked for help on the Microsoft community, but I thought I should give a try here as well.

I work on a Lenovo T440P and the BSODs seem to happen more frequently when I stress the machine (prime95, OCCT, CPU intensive tasks). No overclocking or undervolting. The temperatures are normal.
I ran the Intel processor diagnostic tool and the Lenovo BIOS diagnostic, everything OK.
When I run prime95 or memtest on Windows, I will have a BSOD for sure in the next hour.
However, Memtest86 on a USB key ran perfectly more than 10 hours. Same for prime95 when launched from a live Linux.

I discovered these two links a few weeks ago:
Driver Verifier-- tracking down a mis-behaving driver.
BSOD Finding and fixing them
They helped me finding some problematic drivers, but it looks like almost all my drivers are causing crashes, so I guess I'm not on the right way.

I used the driver verifier with the settings mentioned in the previous article. I ran it for each non-Microsoft driver separately, because when I ticked everything it wouldn't even boot.

So far I encountered driver verifier errors with the following drivers/programs : VirtualBox, Intel Extreme Tuning Utility, Intel Bluetooth Driver for AC7260, Realtek PCIe SDCard reader are a few examples. Most of them were installed by the Lenovo system update, so I guess they were verified by Lenovo before being pushed to all the laptops. Therefore, something else may be wrong...

I put some of the minidumps associated with the faulty driver on my OneDrive, as well as the msinfo32 output:
Microsoft OneDrive - Access files anywhere. Create docs with free Office Online.
I put away from the Windows directory all the drivers that failed the verification but still get BSODs when stressing the system, mostly MEMORY_MANAGEMENT.

From that, the Microsoft community told me to do a fresh reset from the Windows settings (Fall creators update), and that is what I did. I'm now running a "fresh" install but still having the same faulty behavior.

Here is a dump of my fresh install that has already encoutered some crashes:
ANTOINE-POULET-23_10_2017_150326,19.zip

Honestly I don't know where I should start to continue my investigation...

Any help will be greatly appreciated.

Thank you in advance, and have a nice day!

:)

 

Windows 10 kernel security check failure after upgrade

I'm constantly getting kernel security check failure at random times and I cant figure out why. Even after a fresh install of the anniversary update I still get bsod.

 

BSOD on Windows 10

• The last time i accessed was computer was today as I can log on but randomly causes BSOD's at random times
• Not much althought I have reset my computer which did not eliminate my BSOD, safe mode does not get rid of my bsod either.

 

Rule 4
No piracy or discussion of piracy allowed at all. Such as software, music, videos and other intellectual property violations (e.g. downloading youtube videos locally etc) - it is forum policy that no help shall be given to people who knowingly steal software or services.


One of the main reasons for this is that the act of pirating the software will inevitably change the working of the software and make investigation and repair impossible. Please install a legitimate copy of the software and if you are still experiencing the issue we will be pleased to assist - No further assistance will be provided until we are satisfied that the software is genuine.

 

Hi,
Could you please give more information about what is pirated concerning my installation ?
My Windows install is legitimate. The only pirated software I have installed is some Adobe components. I don't want to discuss the purpose of piracy here, but is it this software you are talking about ? If so, I would be pleased to uninstall this and continue finding the cause of the issue.
Thanks!

 

Adobe software.

If you uninstall the software we can provide help.

 

Hi,
Thank you. I've uninstalled Adobe software and tried a prime95 stress test again, but it went to a BSOD with the same kind of error in few minutes.

I've posted another dump file to check if everything is "correct" ?

Have a nice day

 

Run windows memory diags for a good few passes.

 

Okay. Will 3 passes be enough ?
Before posting here I already tried 3 passes (extended test) without issue. It ran also memtest86+ for 10 hours without any error.
Maybe I should try the ram sticks one by one ?
I keep you informed on the memory test which is running right now.
Edit : 3 passes, successful!

 

The files are in a foreign language and cannot be scanned or read. Please change the default language to English and re-post the log collector so that the files can be troubleshooted:

BSOD - Posting Instructions - Windows 10 Forums

 

Oops, sorry. I hope this is working now, it's displayed in English on my laptop:
ANTOINE-POULET-Tue_10_24_2017_155614_43.zip
Is that okay?

 

During this upgrade period windbg has had incomplete debugging.
Some debugging commands work and others don't.
So based on the working commands there was 1 misbehaving hardware driver.
The event log displayed drive problems.

Perform the following steps:
1) open administrative command prompt and type or copy and paste:
2) sfc /scannow
3) dism /online /cleanup-image /restorehealth
4) When these have completed > right click on the top bar or title bar of the administrative command prompt box > left click on edit then select all > right click on the top bar again > left click on edit then copy > paste into the thread
5) chkdsk /x /r (on every drive)
This command may take many hours to run so plan to run overnight.
6) To find and post the chkdsk report into the thread use the information in this link:
Read Chkdsk Log in Event Viewer in Windows 10 Performance Maintenance Tutorials
7) Run HDTune: (on all drives)
http://www.hdtune.com/
to check the health,
scan for errors, no quick scan but full scan
run a benchmark.


It may take some time, but please take the time you need to perform it properly.
When above is done please make screenshots of the following
the health,
the error scan,
the benchmark incl. following
transfer rate,
access time,
burst rate,
cpu usage.
Take Screenshot in Windows 10 General Tips Tutorials

8) Run Sea tools for windows on your drive using SMART, short and long generic tests:


How to use SeaTools for Windows
http://www.seagate.com/support/downl...ls-win-master/
How to use SeaTools for Windows
http://www.seagate.com/support/downloads/seatools/

9) Update the Intel(R) Dual Band Wireless-AC 7260Adapter: netwbw02.sys
Updating a driver: Updating a driver. - Microsoft Community

10) Run memtest86+ version 5.01 for at least 8 passes. Memtest86+ - Advanced Memory Diagnostic Tool


This may take hours so plan to run it overnight.


Please make sure you use the Memtest86+ version 5.01 with the link below.
Memtest86+ - Advanced Memory Diagnostic Tool


The testing is done not by time but by passes.


The more passes the better.


There are a significant number of false negatives if fewer than 8 passes are made.


A false negative is a pass when there is malfunctioning RAM.


There is 16 GB of RAM on the computer.


Memtest86+ version 5.01 testing takes approximately 1 - 2 hours /GB RAM


Just 1 error is a fail and you can abort testing.


Then test 1 RAM module at a time in the same DIMM each for 8 or more passes.


Again the more passes the better.


If both RAM pass when tested 1 at a time after failing when tested together test the next DIMM with 1 RAM module for 8 or more passes. This will help to differentiate malfunctioning RAM from malfunctioning DIMM /Motherboard.


Memtest86+ - Advanced Memory Diagnostic Tool
Memtest86+ - Advanced Memory Diagnostic Tool


Microsoft Community
Memory problems. - Microsoft Community


11) When Memtest86+ has completed 8 or more passes use a camera or smart phone camera to take a picture and post an image of the results into the thread.


MemTest86+ - Test RAM Windows 10 BSOD Tutorials
MemTest86+ - Test RAM BSOD Tutorials


Code: Event[379]: Log Name: System Source: Disk Date: 2017-10-12T13:50:30.096 Event ID: 11 Task: N/A Level: Error Opcode: N/A Keyword: Classic User: N/A User Name: N/A Computer: Antoine-Poulet Description: The driver detected a controller error on \Device\Harddisk2\DR2.[/quote] Code: Event[881]: Log Name: System Source: Disk Date: 2017-10-12T15:05:43.713 Event ID: 11 Task: N/A Level: Error Opcode: N/A Keyword: Classic User: N/A User Name: N/A Computer: Antoine-Poulet Description: The driver detected a controller error on \Device\Harddisk3\DR3.[/quote] Code: Event[6108]: Log Name: System Source: Disk Date: 2017-10-24T10:56:00.630 Event ID: 11 Task: N/A Level: Error Opcode: N/A Keyword: Classic User: N/A User Name: N/A Computer: Antoine-Poulet Description: The driver detected a controller error on \Device\Harddisk2\DR2.[/quote] Code: Name [00000002] Intel(R) Dual Band Wireless-AC 7260Adapter Type Ethernet 802.3Product Type Intel(R) Dual Band Wireless-AC 7260Installed YesPNP Device ID PCI\VEN_8086&DEV_08B2&SUBSYS_C2708086&REV_83\4&2252D3DE&0&00E1Last Reset 10/24/2017 3:54 PMIndex 2Service Name NETwNb64IP Address 192.168.43.12, fe80::2d0b:db43:6fdd:2024IP Subnet 255.255.255.0, 64Default IP Gateway 192.168.43.1DHCP Enabled YesDHCP Server 192.168.43.1DHCP Lease Expires 10/24/2017 4:55 PMDHCP Lease Obtained 10/24/2017 3:55 PMMAC Address ‪90:2E:1C:33:E8:8E‬Memory Address 0xF0400000-0xF04FFFFFIRQ Channel IRQ 4294967293Driver c:\windows\system32\drivers\netwbw02.sys (18.33.7.2, 3.35 MB (3,517,696 bytes), 4/13/2017 2:10 PM)[/quote] Code: 10/15/2017 9:34 PM Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Non disponible Cab Id: 0 Problem signature: P1: 109 P2: a3a008e20b8f64eb P3: 0 P4: d3f438c258fa01cd P5: 101 P6: 10_0_15063 P7: 0_0 P8: 256_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\101517-7234-01.dmp \\?\C:\Windows\Temp\WER-9281-0.sysdata.xml \\?\C:\WINDOWS\MEMORY.DMP \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER395F.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER396F.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER397F.tmp.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_109_418576cf9feb834ddffb665a825f0a951567f_00000000_cab_190cb2f4 Analysis symbol: Rechecking for solution: 0 Report Id: 88ee5a37-b7dd-4cb2-8745-1a1c5247eb1b Report Status: 2049 Hashed bucket:10/15/2017 9:33 PM Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Non disponible Cab Id: 0 Problem signature: P1: 109 P2: a3a008e20b8f64eb P3: 0 P4: d3f438c258fa01cd P5: 101 P6: 10_0_15063 P7: 0_0 P8: 256_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\101517-7234-01.dmp \\?\C:\Windows\Temp\WER-9281-0.sysdata.xml \\?\C:\WINDOWS\MEMORY.DMP \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER395F.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER396F.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER397F.tmp.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_109_418576cf9feb834ddffb665a825f0a951567f_00000000_0378397e Analysis symbol: Rechecking for solution: 0 Report Id: 88ee5a37-b7dd-4cb2-8745-1a1c5247eb1b Report Status: 4 Hashed bucket: 10/23/2017 11:19 AM Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Non disponible Cab Id: 0 Problem signature: P1: 1a P2: 403 P3: fffffe8000253e80 P4: 81000003d8cc2867 P5: fffffe800003fae0 P6: 10_0_15063 P7: 0_0 P8: 256_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\102317-6625-01.dmp \\?\C:\Windows\Temp\WER-9984-0.sysdata.xml \\?\C:\WINDOWS\MEMORY.DMP \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER34BC.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER3558.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER3559.tmp.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_1a_3f3256cd2a1672de7c242e3c6fef29b647a99fe5_00000000_cab_23fb066a Analysis symbol: Rechecking for solution: 0 Report Id: ff46fc6c-8a62-4177-9a29-c0a76ef065e9 Report Status: 2049 Hashed bucket: 10/23/2017 11:12 AM Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Non disponible Cab Id: 0 Problem signature: P1: 1a P2: 403 P3: fffffe8000253e80 P4: 81000003d8cc2867 P5: fffffe800003fae0 P6: 10_0_15063 P7: 0_0 P8: 256_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\102317-6625-01.dmp \\?\C:\Windows\Temp\WER-9984-0.sysdata.xml \\?\C:\WINDOWS\MEMORY.DMP \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER34BC.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER3558.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER3559.tmp.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_1a_3f3256cd2a1672de7c242e3c6fef29b647a99fe5_00000000_03603567 Analysis symbol: Rechecking for solution: 0 Report Id: ff46fc6c-8a62-4177-9a29-c0a76ef065e9 Report Status: 4 Hashed bucket: 10/16/2017 10:09 PM Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Non disponible Cab Id: 0 Problem signature: P1: 1a P2: 41793 P3: ffff858000013e80 P4: 9e P5: 9d P6: 10_0_15063 P7: 0_0 P8: 256_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\101717-9093-01.dmp \\?\C:\Windows\Temp\WER-39828-0.sysdata.xml \\?\C:\WINDOWS\MEMORY.DMP \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER3D33.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER3D81.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER3D91.tmp.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_1a_cafabc9fe8543fee1eecc78ae65e3f9b2d09fc_00000000_cab_2efda8ce Analysis symbol: Rechecking for solution: 0 Report Id: 0dda5fad-5052-458b-95b5-bc5fa73f3f82 Report Status: 2049 Hashed bucket: 10/16/2017 10:09 PM Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Non disponible Cab Id: 0 Problem signature: P1: 1a P2: 41793 P3: ffff858000013e80 P4: 9e P5: 9d P6: 10_0_15063 P7: 0_0 P8: 256_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\101717-9093-01.dmp \\?\C:\Windows\Temp\WER-39828-0.sysdata.xml \\?\C:\WINDOWS\MEMORY.DMP \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER3D33.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER3D81.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER3D91.tmp.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_1a_cafabc9fe8543fee1eecc78ae65e3f9b2d09fc_00000000_03713d90 Analysis symbol: Rechecking for solution: 0 Report Id: 0dda5fad-5052-458b-95b5-bc5fa73f3f82 Report Status: 4 Hashed bucket: 10/15/2017 3:15 PM Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Non disponible Cab Id: 0 Problem signature: P1: c2 P2: 7 P3: 6264444e P4: 41d0007 P5: ffff960b69bf48a0 P6: 10_0_15063 P7: 0_0 P8: 256_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\101517-7515-01.dmp \\?\C:\Windows\Temp\WER-9843-0.sysdata.xml \\?\C:\WINDOWS\MEMORY.DMP \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER3AC6.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER3AE6.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER3AF6.tmp.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_c2_2671284aee885e3d379765d243f551a3ae1ef358_00000000_cab_1fe459f7 Analysis symbol: Rechecking for solution: 0 Report Id: 18c893a0-4ecc-43d6-b826-d1cc56356c55 Report Status: 2049 Hashed bucket: 10/15/2017 3:15 PM Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Non disponible Cab Id: 0 Problem signature: P1: c2 P2: 7 P3: 6264444e P4: 41d0007 P5: ffff960b69bf48a0 P6: 10_0_15063 P7: 0_0 P8: 256_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\101517-7515-01.dmp \\?\C:\Windows\Temp\WER-9843-0.sysdata.xml \\?\C:\WINDOWS\MEMORY.DMP \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER3AC6.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER3AE6.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER3AF6.tmp.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_c2_2671284aee885e3d379765d243f551a3ae1ef358_00000000_03943af5 Analysis symbol: Rechecking for solution: 0 Report Id: 18c893a0-4ecc-43d6-b826-d1cc56356c55 Report Status: 4 Hashed bucket:[/quote] NETwbw02.sys Intel® Wireless WiFi Link Driver - Intel® Wireless WiFi Link Adapter Drivers & Software

 

Hi zbook,
Thank you for your post.
I took the time to go through all the steps. Here are all the relevant outputs and screenshots in the attached zip file:
BSOD troubleshot steps.zip

What I could see with HDTune is there is a SMART error with my SSD. I don't know if it's related. I remember I hotswaped it a few times with a Sata->USB cable so it might be the explanation.

You're right memtest86+ is so damn long to run ! I stopped after 11 passes (33 hours of testing), with no error (phew). I only tested with both sticks since there was no visible error. Should I still try each stick separately?

I also updated the Intel wifi driver. I remember I already did it previously to my first post here. but I was still having the issue. Well, guess what ? Now I can run prime95 for 30min with any driver without BSOD. I didn't change anything else, except a windows chkdsk and having changed the system language from French to English...

Can you tell me what you think about this report ? In the meantime, I'll let the laptop run prime95 with the new Intel drivers for a few hours...

Have a nice day!

 

Nice progress.
How come the C: chkdsk report was in a foreign language and the D: was in English?



The RAM testing passed with 11 passes 0 errors 16 GB RAM.
With a pass testing both at the same time there is no need to test them 1 at a time.
The ST drive looks good.
The Samsung drive displayed 1 problem in the health report and had corruption on the drive.
The operating system integrity testing passed.

Please translate:
Correction des erreurs dans l’attribut BITMAP de la table de fichiersmaîtres (MFT).
Correction des erreurs dans le carte du volume.

Has it been 1 or 2 days since you updated the driver?
If there are any new BSOD please post a new zip.

During the Windows upgrade period some of our Windbg commands are not working. So the debugging can be incomplete or complete depending on whether the commands can or cannot be processed.

Use the computer under typical use and see if there are any new BSOD.

For the drives:
Make a brand new restore point.
Download and install Macrium:
Macrium Software | Macrium Reflect Free
Make a backup image of each drive and place the backup on another drive or into the cloud.
Backup all of the files on the Samsung drive.
Every month revise the Macrium backup image.
If you add files frequently then update the backup image weekly or more frequently.

Download and install the Intel Processor Diagnostic Tool


When the test completes please use the Microsoft snipping tool to post an image into the thread.


Download Intel® Processor Diagnostic Tool:
Download Intel® Processor Diagnostic Tool
The Intel® Processor Diagnostic Tool:
The Intel® Processor Diagnostic Tool

 

Thanks !

Actually chkdsk on the C: drive needed to do it during boot, so I guess Windows went back to its default language, which is French on my laptop. Even if I change the system language, some things such as the boot manager won't change.

In the text file I also put a translation I did myself, I'm not sure if these are the exact words but it should match more or less the English version :

-------------------------------------------------------------------

Checking file system on C:The type of the file system is NTFS.
Volume label is SSD.

Stage 1: Examining basic file system structure ... 2892288 file records processed. File verification completed. 46544 large file records processed. 0 bad file records processed.

Stage 2: Examining file name linkage ... 3626232 index entries processed. Index verification completed. 0 unindexed files scanned. 0 unindexed files recovered to lost and found.

Stage 3 : Examining security descriptors ...Cleaning up 24797 unused index entries from index $SII of file 0x9.Cleaning up 24797 unused index entries from index $SDH of file 0x9.Cleaning up 24797 unused security descriptors.CHKDSK is compacting the security descriptor fluxSecurity descriptor verification completed. 366973 data files processed. CHKDSK is verifying Usn Journal... 37892840 USN bytes processed. Usn Journal verification completed.

Stage 4: Looking for bad clusters in user file data ... files processed. File data verification completed.

Stage 5: Looking for bad, free clusters ... 272116427 free clusters processed. Free space verification is complete.Correcting errors in the master files BITMAP attribute table (MFT).Correcting errors in the volume card (not sure about the translation ?).Windows has scanned the file system.No further action is required. 486949252 KB total disk space. 238301048 KB in 2290768 files. 919556 KB in 366976 indexes. 0 KB in bad sectors. 3036452 KB in use by the system. 65536 KB ocupied by the log file. 244692196 KB available on disk. 4096 bytes in each allocation unit. 121737313 total allocation units on disk. 61173049 allocation units available on disk.Internal information :00 22 2c 00 4a a4 26 00 30 2c 38 00 00 00 00 00 .",.J.&.0,8.....a4 08 00 00 7d 00 00 00 00 00 00 00 00 00 00 00 ....}...........

Windows finished verifying your drive.Please wait during computer restart.

-------------------------------------------------------------------

For the driver, unfortunately I forgot to update it before running memtest86+. So I updated it this morning right after having stopped memtest86+ and then I was running prime95 (for 2 hours now).

I just created a restore point. Is the macrium step really required if I don't mind loosing my data ? Actually all my important data on this laptop is replicated using various services (Dropbox, Syncthing), I'm safe if the laptop explodes or gets stolen. I also created a "Windows 7" backup on the SSD just in case, after my fresh install, to avoid loosing time and have an faster recovery process. But this backup is on the SSHD. I'm on a trip and I don't have any other drive with me for now.

Here is the result with the Intel processor diagnostic tool:





I'll keep using the computer under typical use and run prime95 when I'm away.