Windows 10: Random BSOD, need help reading DUMP file

Hi everyone,

I bought a new computer a few days ago. I put it together with my brother, this wasn't the first machine we assembled, so everything should be fine on that front.
Then, i installed up-to-date drivers from the manufacturer's homepages for my Mainboard and Graphics Card and installed a few necessary programs and my games (Kaspersky Internet Security, Teamspeak, Discord, BDO, GW2, Thunderbird etc.).

At first, i got a few BSODs (first three dump files attached) with the error code "Memory_Management". They happened quite frequently and i believe these were due to an outdated BIOS. The latest BIOS update even listed in the change log, that compatibility with my M2-SSD was improved (see here). BIOS is also up-to-date now.

The System ran for 24 hours+ without crash on occasion. But after a day or so after waking up, i realized my computer crashed while running over night. And today it happened again while i was eating dinner, so i don't know what was listed as failure on the BSOD (i disabled automatic restart so i should be able to read it next time).

Stuff i tried so far:

• I ran memtest86 over night through 5.5 passes without any errors.
• While testing driver verifier, Windows didn't start because of kl1.sys until system repair (which disabled driver verifier)
• I also tried using Windbg, but i didn't understand the Dump-File

Here is the Hardware in my System:

MB: MSI Gaming M5 Z270
CPU: i5 7600K
GPU: Asus GTX 1070 STRIX G8
RAM: G.Skill Trident Z RGB (2x 8GB) DDR4-2400
SSD: 250GB Samsung 960 Evo M.2
HDD: 2000GB WD Blue WD20EZRZ (put in after the first random BSOD)
Power Supply: 600W Corsair CX

The DM-Log Collector zip is attached.

This Software was definitely running during both random crashes:

Black Desert Online (and xingcode3 anti-cheat)
Logitech Gaming Software
Kaspersky Internet Security
Killer Control Center
Intel Rapid Storage Technology
Realtek HD Audiomanager


I hope some of you guys can help me, thanks!

:)

 

Need help reading dump file. PC has BSOD ... need help!

Thank you so much! I'll try this, will flag as resolved if I get no problems after a week.

 

Need help reading dump file. PC has BSOD ... need help!

Can anyone give me any information on the dump file? I don't know if this is software or hardware related...

.dmp file from minidump folder (onedrive):

120517-8734-01.dmp

Event logger says:

L: -
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

L: -
<System>

<Provider
Name="Microsoft-Windows-Kernel-Power" Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" />

<EventID>41</EventID>

<Version>6</Version>

<Level>1</Level>

<Task>63</Task>

<Opcode>0</Opcode>

<Keywords>0x8000400000000002</Keywords>

<TimeCreated
SystemTime="2017-12-05T09:02:32.837357700Z" />

<EventRecordID>123475</EventRecordID>

<Correlation
/>

<Execution
ProcessID="4" ThreadID="8" />

<Channel>System</Channel>

<Computer>DESKTOP</Computer>

<Security
UserID="S-1-5-18" />

</System>

L: -
<EventData>

<Data Name="BugcheckCode">209</Data>

<Data Name="BugcheckParameter1">0x28</Data>

<Data Name="BugcheckParameter2">0x2</Data>

<Data Name="BugcheckParameter3">0x0</Data>

<Data Name="BugcheckParameter4">0xfffff80f256e5299</Data>

<Data Name="SleepInProgress">0</Data>

<Data Name="PowerButtonTimestamp">0</Data>

<Data Name="BootAppStatus">0</Data>

<Data Name="Checkpoint">0</Data>

<Data Name="ConnectedStandbyInProgress">false</Data>

<Data Name="SystemSleepTransitionsToOn">3</Data>

<Data Name="CsEntryScenarioInstanceId">0</Data>

<Data Name="BugcheckInfoFromEFI">true</Data>

<Data Name="CheckpointStatus">0</Data>

</EventData>

</Event>

PC is completely new laptop running W10x64 pro

Moved from: Windows / Windows 10 / Devices & drivers

 

Hi Tomok,

The logs are in a foreign language. Please modify the language to English and resubmit the logs so that we can troubleshoot them.

Code: BugCheck 109, {a39fbf6225e8b547, b3b6cbe8786a2082, fffff80aff800000, 0}Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )[/quote] Code: BugCheck 12B, {ffffffffc00002c4, a95, fcc6ee0, ffffc681dcbb0000}*** WARNING: Unable to verify checksum for win32k.sysProbably caused by : memory_corruption[/quote] Code: BugCheck 1A, {41792, ffff8100003a8ff0, 2, 0}Probably caused by : memory_corruption[/quote] Code: BugCheck 1A, {41792, ffffd700dfe4fff0, 2, 0}Probably caused by : memory_corruption[/quote] Code: BugCheck 1A, {41792, ffffd4802c850ef0, 2, 0}Probably caused by : memory_corruption ( ONE_BIT )[/quote] A) Have you been doing any over clocking?
B) Are you using either hardware or software raid?



Open administrative command prompt and type or copy and paste these commands:


1) winver (in the pop up about windows > view your windows version and build > type this information into the thread)


2) sfc /scannow


3) dism /online /cleanup-image /restorehealth


4) chkdsk /scan


When these have completed > right click on the top bar or title bar of the administrative command prompt box > left click on edit then select all > right click on the top bar again > left click on copy > paste into the thread


5) Run memtest86+ version 5.01 for at least 8 runs. This may take hours so plan to run it overnight.
Memtest86+ - Advanced Memory Diagnostic Tool

Memory problems. - Microsoft Community


When Memtest86+ has completed 8 or more runs make an image of the results to post into the thread.


6) Make sure that there is no over clocking while troubleshooting.

Sometimes there are problems in the bios that produce bsod. The bios in your computer: BIOS-Version/-Datum American Megatrends Inc. 1.60, 31.03.2017


To ensure that there are no improper bios settings please reset the bios.
Sometimes there can be failure to boot after resetting the bios. So please make sure your files are backed up. Please make a backup image with Macrium:
Macrium Software | Macrium Reflect Free
And please create a restore point.


If possible please resubmit the zip file in English so that we can troubleshoot the logs.

 

A: No, I am not overclocking anything on purpose. But i think my CPU overclocks a bit on it's own.

B: I had to google what RAID is and no, i don't think i am not using it. I have 2 Drives installed (one SSD and one HDD) and 2 drives are shown in windows explorer.

1) My Windows 10 Version is 1703, Build 15063.413

2-4)
Microsoft Windows [Version 10.0.15063]
(c) 2017 Microsoft Corporation. All rights reserved.


C:\Windows\system32>winver


C:\Windows\system32>sfc /scannow


Beginning system scan. This process will take some time.


Beginning verification phase of system scan.
Verification 100% complete.


Windows Resource Protection did not find any integrity violations.


C:\Windows\system32>dism /online /cleanup-image /restorehealth


Deployment Image Servicing and Management tool
Version: 10.0.15063.0


Image Version: 10.0.15063.0


[==========================100.0%==========================] The restore operation completed successfully.
The operation completed successfully.


C:\Windows\system32>chkdsk /scan
The type of the file system is NTFS.
Volume label is SSD.


Stage 1: Examining basic file system structure ...
208896 file records processed.
File verification completed.
5218 large file records processed.
0 bad file records processed.


Stage 2: Examining file name linkage ...
273590 index entries processed.
Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered to lost and found.


Stage 3: Examining security descriptors ...
Security descriptor verification completed.
32348 data files processed.
CHKDSK is verifying Usn Journal...
39282504 USN bytes processed.
Usn Journal verification completed.


Windows has scanned the file system and found no problems.
No further action is required.


243684351 KB total disk space.
129695124 KB in 166747 files.
111960 KB in 32349 indexes.
0 KB in bad sectors.
323023 KB in use by the system.
65536 KB occupied by the log file.
113554244 KB available on disk.


4096 bytes in each allocation unit.
60921087 total allocation units on disk.
28388561 allocation units available on disk.


C:\Windows\system32>

5) I will run memtest86 over night again and wait for the 8 passes this time, expect results tomorrow afternoon

6) Same settings, no Overclocking

I will reset my BIOS after submitting this Post.

Also note that i uninstalled the G.Skill Trident RGB Software (My RAM) after realizing that it supposedly has compatibility issues with my Asus Aura and MSI Gaming App (reference). I was too excited and didn't bother reading before *Shock

New (hopefully English) logs are attached.

Thanks!

Attachment 141562

Edit: Bios reset, i only changed the boot order afterwards to boot from my SSD.

 

Memtest86+ ran through 8 passes with the following results:

IMG_20170629_174546.jpg - Google Drive

Guess this means returning the RAM to the retailer and claim a new one?

 

The first run of Memtest86+ was a false negative with 5 runs.
The second run of Memtest86+ was a true positive with 9 runs displaying 124160 errors.
Please post information on the number of DIMM and the size of the RAM in each DIMM.
Now you need to differentiate RAM from DIMM/MB problems.
Remove all RAM and insert just one into a dim. Run memtest86+ for 8 or more runs.
If this RAM stick has errors switch RAM stick and repeat.
If you find on RAM with no errors at 8 or more runs then switch to a different DIMM and repeat.
This way you will have checked all ram and all DIMM.

 

zbook u can read those hardware infos via windbg command !sysinfo smbios
sysinfo | Microsoft Docs

Code: [Memory Device (Type 17) - Length 40 - Handle 003eh] Physical Memory Array Handle 003ch Memory Error Info Handle [Not Provided] Total Width 64 bits Data Width 64 bits Size 8192MB Form Factor 09h - DIMM Device Set [None] Device Locator ChannelA-DIMM1 Bank Locator BANK 1 Memory Type 1ah - Specification Reserved Type Detail 0080h - Synchronous Speed 2133MHz Manufacturer 04CD Serial Number Asset Tag Number Part Number F4-2400C15-8GTZR[/quote] Code: [Memory Device (Type 17) - Length 40 - Handle 0040h] Physical Memory Array Handle 003ch Memory Error Info Handle [Not Provided] Total Width 64 bits Data Width 64 bits Size 8192MB Form Factor 09h - DIMM Device Set [None] Device Locator ChannelB-DIMM1 Bank Locator BANK 3 Memory Type 1ah - Specification Reserved Type Detail 0080h - Synchronous Speed 2133MHz Manufacturer 04CD Serial Number Asset Tag Number Part Number F4-2400C15-8GTZR[/quote]

 

1. Have a look at mainboard model then look online after the specs.
2. Number of DIMM slots can only be seen in the .dmp files via sysinfo command

Yes, u see 4 DIMM slots, but only two of them are stocked with two 8 GB RAM modules

This Info cannot retrieved correctly via the log files.

Let me show u this via one of the dmps with this windbg command:
Code: !sysinfo smbios[/quote] Code: [Physical Memory Array (Type 16) - Length 23 - Handle 003ch] Location 03h - SystemBoard/Motherboard Use 03h - System Memory Memory Error Correction 03h - None Maximum Capacity 67108864KB Memory Error Inf Handle [Not Provided] Number of Memory Devices 4 -> Number of SLOTS[/quote]
Slot 1 - empty
Code: [Memory Device (Type 17) - Length 40 - Handle 003dh] Physical Memory Array Handle 003ch Memory Error Info Handle [Not Provided] Total Width 0 bits Data Width 0 bits Size [Not Populated] Form Factor 02h - Unknown Device Set [None] Device Locator ChannelA-DIMM0 Bank Locator BANK 0 Memory Type 02h - Unknown Type Detail 0000h - Speed 0MHz Manufacturer [String Not Specified] Serial Number [String Not Specified] Asset Tag Number [String Not Specified] Part Number [String Not Specified][/quote]
Slot 2 - STOCKED with 8 GB:
Code: [Memory Device (Type 17) - Length 40 - Handle 003eh] Physical Memory Array Handle 003ch Memory Error Info Handle [Not Provided] Total Width 64 bits Data Width 64 bits Size 8192MB Form Factor 09h - DIMM Device Set [None] Device Locator ChannelA-DIMM1 Bank Locator BANK 1 Memory Type 1ah - Specification Reserved Type Detail 0080h - Synchronous Speed 2133MHz Manufacturer 04CD Serial Number Asset Tag Number Part Number F4-2400C15-8GTZR[/quote]
Slot 3 - empty:
Code: [Memory Device (Type 17) - Length 40 - Handle 003fh] Physical Memory Array Handle 003ch Memory Error Info Handle [Not Provided] Total Width 0 bits Data Width 0 bits Size [Not Populated] Form Factor 02h - Unknown Device Set [None] Device Locator ChannelB-DIMM0 Bank Locator BANK 2 Memory Type 02h - Unknown Type Detail 0000h - Speed 0MHz Manufacturer [String Not Specified] Serial Number [String Not Specified] Asset Tag Number [String Not Specified] Part Number [String Not Specified][/quote]
Slot 4 - STOCKED with 8 GB:
Code: [Memory Device (Type 17) - Length 40 - Handle 0040h] Physical Memory Array Handle 003ch Memory Error Info Handle [Not Provided] Total Width 64 bits Data Width 64 bits Size 8192MB Form Factor 09h - DIMM Device Set [None] Device Locator ChannelB-DIMM1 Bank Locator BANK 3 Memory Type 1ah - Specification Reserved Type Detail 0080h - Synchronous Speed 2133MHz Manufacturer 04CD Serial Number Asset Tag Number Part Number F4-2400C15-8GTZR[/quote]

1. Have a look at mainboard model then look online after the specs.
2. Number of DIMM slots can only be seen in the .dmp files via sysinfo command

 

Was included in my opening post, I am using 2x 8GB Module in the DIMMA2 and DIMMB2 Slot - as suggested in my MB's Manual.
Here's a Screenshot:
https://i.gyazo.com/8bb6b7f67ed5d0e3...3b62872756.png

As for testing the different DIMM Slots and RAM Modules, please correct my if I got something wrong:

• If memtest runs through 8 passes without an error, both the used RAM Module and DIMM Slot are good
• If a Module has Errors in a fine DIMM Slot, the Module is faulty
  • If this is the case, we basicly identified one problem (other Dimm-Slots might still be broken, but I'm optimistic) and the Ram-Module definitely needs to be exchanged, correct?

Lastly, testing through 8 passes with one RAM Module takes ~8 hours, is there any way to speed it up or would it mess with the testing results (like force multi-threading)?

 

In the forum we recently had a failure that took over 20 runs.
The fewer the runs the more likely there will be a false negative.
So 8 is the minimum and the longer the better.
We also had someone recently let their computer have 86 runs.
http://www.memtest.org/https://answe...f-ecc7b7ff6461


Frequently the Memtest86+ is run when there are 2 or more dimm slots in use. So for a failure the ram has to be checked one at a time. Then a good ram has to be checked in each dimm to check each dimm. It takes many hours to rule in or rule out ram/dimm problems. Fortunately it can run while your doing other things.

 

So after a bunch of memtesting i had several good DIMM-Slots that had Errors with one RAM Module. I exchanged the Modules at my retailer and now I have 8 passes of Error-free RAM.

Thanks a lot for your patience and advice, I'm really happy it didn't turn out to be the Mainboard.

 

Glad to hear that your problem is now fixed. Let us know if there are any other problems.