Windows 10: Random Freezing from hardware error, event name LiveKernelEvent

Have you checked for Dump files in the Windows\LiveKernelReports folder?

At one time, folks with the Killer Wireless were getting Blue Screens from an old install of that software.

 

I checked into the LiveKernelReports as Saltgrass suggested, and I found the same problem reported by Caledon Ken, plus other dump files. I attach all the reports here.
The thing I don't understand is that the issue reported relates to the Intel Graphics Kernel Mode driver Igdkmd64.sys, but it is always the wireless network adapter that gets disabled after each freeze (which I manage to restore through chkdsk /f, but that's really annoying).

I will try to fix this Igdkmd64.sys thing even though I am not entirely sure how...

LiveKernelReports.txt

 

Run the DM log collector and post a zip in the thread:

Language - Add, Remove, and Change in Windows 10 General Tips Tutorials
BSOD - Posting Instructions - Windows 10 Forums

Find and post into the thread the memory dump file:
%SystemRoot%\MEMORY.DMP or C:\Windows\MEMORY.DMP
Use file explorer > this PC > local C: drive > right upper corner search enter each of the above to find results > post into the thread using a one drive or drop box share link.

 

dear zbook,
the is no MEMORY.DMP, nor minidumps either, there are only the dmp files in the LiveKernelReports that Saltgrass mentioned.
I also tried to uninstall Italian, but even after changing all settings (even date and format) from both Control Panel/Language/Advanced Settings and Settings/Region and Language, and even having Italian typing uninstalled, I cannot remove Italian completely.
If I try to uninstall the display language I can only uninstall English, since Italian "is the system languae (default language of the user interface)"... so I have no idea how to upload a Log report completely in English

 

1) Download and install:
Resplendence Software - WhoCrashed, automatic crash dump analyzer
2) Above analyze click on tools > crash dump test > type: ACCEPT
3) Click Analyze > look for dead or deaddead
4) Post the results into the thread.
5) After the above steps run the DM log collector:
BSOD - Posting Instructions - Windows 10 Forums

6) Please indicate the progress with the steps in posts 12 and 13.

7) Run HDTune: HD Tune website
to check the health,
scan for errors, no quick scan but full scan
run a benchmark.
It may take some time, but please take the time you need to perform it properly.
When above is done please make screenshots of the following
the health,
the error scan,
the benchmark incl. following
transfer rate,
access time,
burst rate,
cpu usage.
Take Screenshot in Windows 10 General Tips Tutorials

 

1-4)
Crash dump directory: C:\WINDOWS\Minidump

Crash dumps are enabled on your computer.

You have performed a crash dump test. The test succeeded and the crash dump file was properly written out.

On Fri 15/12/2017 11:00:21 GMT your computer crashed
crash dump file: C:\WINDOWS\Minidump\121517-38718-01.dmp
This was probably caused by the following module: Unknown ()
Bugcheck code: 0x0 (0x0, 0x0, 0x0, 0x0)
Error: CUSTOM_ERROR
A third party driver was identified as the probable root cause of this system error.
Google query: CUSTOM_ERROR



On Fri 15/12/2017 10:58:33 GMT your computer crashed
crash dump file: C:\WINDOWS\memory.dmp
This was probably caused by the following module: rspcrash64.sys (rspCrash64+0x108B)
Bugcheck code: 0xDEADDEAD (0x0, 0x0, 0x19AE2C3D, 0x3C2A58ED)
Error: MANUALLY_INITIATED_CRASH1
file path: C:\WINDOWS\system32\drivers\rspcrash64.sys
product: WhoCrashed
company: Resplendence Software Projects Sp.
description: Resplendence WhoCrashed Crash Dump Test
Bug check description: This indicates that the user deliberately initiated a crash dump from either the kernel debugger or the keyboard.
This bug check belongs to the crash dump test that you have performed with WhoCrashed or other software. It means that a crash dump file was properly written out.



5)DOLCO-15_12_2017_120921_91.zip


6A)I have un-checked automatic restart
6B)Lpksetup /u : see previous post: I can only uninstall English but not Italian (I get the message: The language can't be selected because it is the system language (default language of the user interface). )


I'll do 7) and post soon

 

Operating System: Windows 10 Home 64-bit (10.0, Build 16299) (16299.rs3_release.170928-1534)
Language: English (Regional Setting: English)

For these commands please use a camera or smart phone camera to take a picture and post the image into the thread:

1) open administrative command prompt and copy and paste these commands:
2) sfc /scannow
3) Lpksetup /u

Take a picture of the above result and post into the thread.

4) Copy and paste this whole command. It will post to the desktop. Please zip or post a share link into the thread:

md "%USERPROFILE%\Desktop\CollectedFiles"&wmic /output:"%USERPROFILE%\Desktop\CollectedFiles\hotfix.txt" qfe list full /format:table&copy %SystemRoot%\minidump\*.dmp "%USERPROFILE%\Desktop\CollectedFiles"&type %SystemRoot%\System32\drivers\etc\hosts >> "%USERPROFILE%\Desktop\CollectedFiles\hosts.txt"&systeminfo > "%USERPROFILE%\Desktop\CollectedFiles\systeminfo.tmp"&findstr /v "Owner." "%USERPROFILE%\Desktop\CollectedFiles\systeminfo.tmp" > "%USERPROFILE%\Desktop\CollectedFiles\systeminfo.txt"&del "%USERPROFILE%\Desktop\CollectedFiles\systeminfo.tmp"&driverquery /v > "%USERPROFILE%\Desktop\CollectedFiles\drivers.txt"&msinfo32 /nfo "%USERPROFILE%\Desktop\CollectedFiles\msinfo32.nfo"&wevtutil qe System /f:text > "%USERPROFILE%\Desktop\CollectedFiles\eventlog.txt"&reg export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall "%USERPROFILE%\Desktop\CollectedFiles\uninstall.txt"&reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components" "%USERPROFILE%\Desktop\CollectedFiles\installed.txt"&net start > "%USERPROFILE%\Desktop\CollectedFiles\services.txt"&sc query type= driver state= all > "%USERPROFILE%\Desktop\CollectedFiles\driver_status.txt"&sc query type= service state= inactive > "%USERPROFILE%\Desktop\CollectedFiles\inactive_services_status.txt"&sc query type= service state= all > "%USERPROFILE%\Desktop\CollectedFiles\all_services_status.txt"&REM wmic service list full /format:htable >%USERPROFILE%\Desktop\CollectedFiles\service.html&REM wmic /output:%USERPROFILE%\Desktop\CollectedFiles\nics.html nicconfig list /format:hform

5) open device manager > click view > show hidden devices > expand all rows > post images into the thread for any rows with icons that have yellow triangles and black exclamation marks

Code: 14/11/2017 18:42 Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Non disponibile Cab Id: 0 Problem signature: P1: 1000009f P2: 4 P3: 12c P4: ffff9f8643160040 P5: fffff8005625b910 P6: 10_0_16299 P7: 0_0 P8: 768_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\111417-40656-01.dmp \\?\C:\WINDOWS\TEMP\WER-495375-0.sysdata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4C45.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4C56.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4CA5.tmp.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_1000009f_f4a5868d7af9bf815acf193339ee0947d937dc5_00000000_cab_1a345986 Analysis symbol: Rechecking for solution: 0 Report ID: 61743be8-b755-436d-bcaf-002de178303c Report Status: 2049 Hashed bucket:14/11/2017 09:40 Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Non disponibile Cab Id: 0 Problem signature: P1: 1000009f P2: 4 P3: 12c P4: ffff9f8643160040 P5: fffff8005625b910 P6: 10_0_16299 P7: 0_0 P8: 768_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\111417-40656-01.dmp \\?\C:\WINDOWS\TEMP\WER-495375-0.sysdata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4C45.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4C56.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4CA5.tmp.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_1000009f_f4a5868d7af9bf815acf193339ee0947d937dc5_00000000_039c4cb1 Analysis symbol: Rechecking for solution: 0 Report ID: 61743be8-b755-436d-bcaf-002de178303c Report Status: 4 Hashed bucket: 11/12/2017 23:00 Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Not available Cab Id: 0 Problem signature: P1: 1000009f P2: 4 P3: 12c P4: ffffae81ace57700 P5: ffffee8342437910 P6: 10_0_16299 P7: 0_0 P8: 768_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\121117-38640-01.dmp \\?\C:\WINDOWS\TEMP\WER-530093-0.sysdata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERCABB.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERCBA5.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERCBC6.tmp.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_1000009f_9bb3a9483d16c5836556f8a488d432e437a09f3e_00000000_cab_1348ce36 Analysis symbol: Rechecking for solution: 0 Report ID: 9691d7ca-9383-4896-aa6f-0a5cec220944 Report Status: 2049 Hashed bucket: 11/12/2017 23:00 Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Not available Cab Id: 0 Problem signature: P1: 1000009f P2: 4 P3: 12c P4: ffffae81ace57700 P5: ffffee8342437910 P6: 10_0_16299 P7: 0_0 P8: 768_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\121117-38640-01.dmp \\?\C:\WINDOWS\TEMP\WER-530093-0.sysdata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERCABB.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERCBA5.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERCBC6.tmp.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_1000009f_9bb3a9483d16c5836556f8a488d432e437a09f3e_00000000_0384cbf4 Analysis symbol: Rechecking for solution: 0 Report ID: 9691d7ca-9383-4896-aa6f-0a5cec220944 Report Status: 4 Hashed bucket: 15/12/2017 11:09 Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Not available Cab Id: 0 Problem signature: P1: deaddead P2: 0 P3: 0 P4: 19ae2c3d P5: 3c2a58ed P6: 10_0_16299 P7: 0_0 P8: 768_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\121517-38718-01.dmp \\?\C:\WINDOWS\TEMP\WER-539421-0.sysdata.xml \\?\C:\WINDOWS\MEMORY.DMP \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4B65.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4B67.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4BB6.tmp.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_deaddead_da47481e66bb18cb05934cb7725cb69449748_00000000_cab_30d55680 Analysis symbol: Rechecking for solution: 0 Report ID: d2710c21-1ebd-46d7-a487-128dd692eefd Report Status: 2049 Hashed bucket: 15/12/2017 11:09 Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Not available Cab Id: 0 Problem signature: P1: deaddead P2: 0 P3: 0 P4: 19ae2c3d P5: 3c2a58ed P6: 10_0_16299 P7: 0_0 P8: 768_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\121517-38718-01.dmp \\?\C:\WINDOWS\TEMP\WER-539421-0.sysdata.xml \\?\C:\WINDOWS\MEMORY.DMP \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4B65.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4B67.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4BB6.tmp.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_deaddead_da47481e66bb18cb05934cb7725cb69449748_00000000_03a94bb3 Analysis symbol: Rechecking for solution: 0 Report ID: d2710c21-1ebd-46d7-a487-128dd692eefd Report Status: 4 Hashed bucket: 09/12/2017 23:46 Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Not available Cab Id: 0 Problem signature: P1: ef P2: ffff8a027a8365c0 P3: 0 P4: 0 P5: 0 P6: 10_0_16299 P7: 0_0 P8: 768_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\121017-39546-01.dmp \\?\C:\WINDOWS\TEMP\WER-684765-0.sysdata.xml \\?\C:\WINDOWS\MEMORY.DMP \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER22C5.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER2353.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER2383.tmp.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_ef_4e85388945c173b196ac41c771b83a4aeb7c943_00000000_cab_22372b9e Analysis symbol: Rechecking for solution: 0 Report ID: 4dde555b-9e99-4859-a07b-3e3d23f312c0 Report Status: 2049 Hashed bucket: 09/12/2017 23:46 Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Not available Cab Id: 0 Problem signature: P1: ef P2: ffff8a027a8365c0 P3: 0 P4: 0 P5: 0 P6: 10_0_16299 P7: 0_0 P8: 768_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\121017-39546-01.dmp \\?\C:\WINDOWS\TEMP\WER-684765-0.sysdata.xml \\?\C:\WINDOWS\MEMORY.DMP \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER22C5.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER2353.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER2383.tmp.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_ef_4e85388945c173b196ac41c771b83a4aeb7c943_00000000_03872380 Analysis symbol: Rechecking for solution: 0 Report ID: 4dde555b-9e99-4859-a07b-3e3d23f312c0 Report Status: 4 Hashed bucket:[/quote]

 

7) (from previous post):


Attachment 168351

1-3)
Attachment 168352



4)
CollectedFiles.zip

one file was not saved:
C:\WINDOWS\minidump\121517-38718-01.dmpC:\WINDOWS\minidump\121617-47218-01.dmpThe process cannot access the file because it is being used by another process.
5) there are no rows with icons that have yellow triangles and/or black exclamation marks

 

This is what WhoCrashed says about the dmp file that could not be read:


On Sat 16/12/2017 00:57:57 GMT your computer crashed
crash dump file: C:\WINDOWS\Minidump\121617-47218-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x168FD6)
Bugcheck code: 0x1000009F (0x4, 0x12C, 0xFFFFC60408B51700, 0xFFFFFB810A237910)
Error: CUSTOM_ERROR
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

On Sat 16/12/2017 00:57:57 GMT your computer crashed
crash dump file: C:\WINDOWS\memory.dmp
This was probably caused by the following module: ntkrnlmp.exe (nt!KeBugCheckEx+0x0)
Bugcheck code: 0x9F (0x4, 0x12C, 0xFFFFC60408B51700, 0xFFFFFB810A237910)
Error: DRIVER_POWER_STATE_FAILURE
Bug check description: This bug check indicates that the driver is in an inconsistent or invalid power state.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

 

1) Create a brand new restore point
2) Backup all files
3) Create a backup image using Macrium:
Macrium Software | Macrium Reflect Free
3) Place the backup image onto another drive or into the cloud
4) Find a flash drive that you can format (the iso is approximately 4 GB))
5) Create a bootable Windows 10 iso:
Download Windows 10

6) The log files are in a foreign language and can not be scanned or read.
When Windows was installed what was the primary language?
7) Are you able to perform a clean install to improve the troubleshooting?


8) Run Sea tools for windows on your drive using SMART, short and long generic tests:
When the tests have completed post an image into the thread:
Take Screenshot in Windows 10 General Tips Tutorials

How to use SeaTools for Windows
http://www.seagate.com/support/downl...ls-win-master/
How to use SeaTools for Windows
http://www.seagate.com/support/downloads/seatools/

9) Read these links on Windows driver verifier and learn the multiple methods to turn off the tool using the windows advanced troubleshooting menu.
Driver Verifier-- tracking down a mis-behaving driver. - Microsoft Community
Enable and Disable Driver Verifier in Windows 10 Performance Maintenance Tutorials