Windows 10: Two Random Blue Screen & restarts. Please help.

Can i post the zip file of my system's information a public forum safely?

 

Click on Windows 10 Forums
BSOD Crashes and Debugging and view other zip files that were submitted so that you can view the information collected. There should be no personal information. It should only be msinfo32 and multiple log files that provide information about the computer environment.

 

Note: since running the diagnostics, i had a pop-up saying there was a problem with Microsoft.Net framework, so I had enabled all Microsoft.Net framework. Maybe there is a conflict between my Garmin GPS and Microsoft.Net framework. However, also since this the recent blue screen, Mcaffee Livesafe did not automatically start after the boot. I had to start it myself.

 

Code: BugCheck 50, {fffff801dd25ea40, 10, fffff801dd25ea40, 2}Could not read faulting driver name*** WARNING: Unable to verify timestamp for win32k.sys*** ERROR: Module load completed but symbols could not be loaded for win32k.sysProbably caused by : memory_corruption[/quote] Code: BugCheck 139, {3, ffffa90052b6b770, ffffa90052b6b6c8, 0}Probably caused by : ntkrnlmp.exe ( nt!KiFastFailDispatch+d0 )[/quote] Code: BugCheck A, {ffffc68d6be2c000, 2, 0, fffff80120223be5}*** WARNING: Unable to verify timestamp for win32k.sys*** ERROR: Module load completed but symbols could not be loaded for win32k.sysProbably caused by : memory_corruption[/quote] OLDER BSOD 3/4/2017
Code: BugCheck 80, {4f4454, 0, 0, 0}Probably caused by : intelppm.sys ( intelppm!MWaitIdle+18 )[/quote] 2/6/2017
Code: BugCheck 139, {3, ffffdc80e406f6f0, ffffdc80e406f648, 0}*** WARNING: Unable to verify timestamp for win32k.sys*** ERROR: Module load completed but symbols could not be loaded for win32k.sysProbably caused by : memory_corruption[/quote] 1/8/2016
Code: BugCheck 1A, {41201, fffffd80f3e6c008, ffffffff, ffff9b0bc18b87b0}Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+260aa )[/quote]
Event log:

Code: {Registry Hive Recovered} Registry hive (file): '\??\C:\Users\Joshua\AppData\Local\Microsoft\Windows\UsrClass.dat' was corrupted and it has been recovered. Some data might have been lost.[/quote] Code: The system failed to flush data to the transaction log. Corruption may occur in VolumeId: G:, DeviceName: \Device\HarddiskVolume6.(A device which does not exist was specified.)[/quote] Code: File System Filter 'wcifs' (Version 10.0, ?2016?-?09?-?15T09:42:03.000000000Z) failed to attach to volume '\Device\HarddiskVolumeShadowCopy5'. The filter returned a non-standard final status of 0xC000000D. This filter and/or its supporting applications should handle this condition. If this condition persists, contact the vendor.[/quote] Code: The driver \Driver\WUDFRd failed to load for the device ACPI\INT3400\2&daba3ff&1.[/quote] Code: Installation Failure: Windows failed to install the following update with error 0x80070430: Intel Corporation - Bluetooth - 4/7/2017 12:00:00 AM - 19.60.0.3.[/quote] Code: {Delayed Write Failed} Windows was unable to save all the data for the file . The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Please try to save this file elsewhere.[/quote] Code: {Delayed Write Failed} Windows was unable to save all the data for the file \:$I30:$INDEX_ALLOCATION. The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Please try to save this file elsewhere.[/quote]
Open administrative command prompt and type or copy and paste:
1) winver (in the pop up about windows > view your windows version and build > type this information into the thread)
2) sfc /scannow
3) dism /online /cleanup-image /restorehealth
4) chkdsk /scan

When these have completed > right click on the top bar or title bar of the administrative command prompt box > left click on edit then select all > right click on the top bar again > left click on copy > paste into the thread

5) Run memtest86+ version 5.01 for at least 8 runs. This may take hours so plan to run it overnight.Memtest86+ - Advanced Memory Diagnostic Tool

Memory problems. - Microsoft Community


For the memory testing please see the above link. Making at least 8 runs is important for memory testing. Sometimes it runs in the teens to find faulty ram.

If the memory test displays no errors the Windows application driver verifier is used to stimulate drivers and make misbehaving drivers produce bsods. The minidump files from the bsods are then debugged. Uninstalling drivers or applications is then performed. New drivers or applications are found that do not produce bsods. Eventually windows driver verifier is used for 36 hours of typical computer use. If there are no longer any bsod the troubleshooting will be completed and preventative maintenance will have been performed.

In order to use windows driver verifier you must back up your files, create a restore point, and become familiar with the windows recovery or advanced troubleshooting menu.

To become familiar with the windows advanced troubleshooting menu open administrative command prompt and type or copy and paste this command: shutdown /r /o /f /t 00
You will reboot to the windows recovery or advanced troubleshooting menu.
Then you will navigate to startup options (not startup repair) and in startup options you will restart and select #6 safe mode with command prompt. When you turn off windows driver verifier you will type or copy and paste: verifier /reset
Then you will reboot to the desktop. On the desktop you will use 2 software programs to analyze the bsod: Bluescreenview and Whocrashed. With their analysis you will then use device manager and/or control panel to uninstall any misbehaving drivers or applications.
To continue troubleshooting you can either find a driver to reinstall or continue using windows driver verifier to find the next misbehaving driver. It is personal preference whether to uninstall the install or uninstall all first and then reinstall later. The end result should be the same.
When bsod are produced by windows driver verifer they will display a stop code. The stop code is typically driver verifier detected violation. Sometimes the misbehaving is displayed in the form *.sys. If you see the misbehaving driver identified please record it for later use.

Before using windows driver verifer make sure you change the bsod so that automatic restart is unchecked allowing you time to view the bsod:
BSOD Finding and fixing them - Microsoft Community

This link has the customized settngs for using windows driver verifier:
Driver Verifier-- tracking down a mis-behaving driver. - Microsoft Community


The analysis of the bsod may vary. Each software may offer additional information.
These are the 2 software to download and install so that you can immediately process the bsod:


Resplendence Software - WhoCrashed, automatic crash dump analyzer
Blue screen of death (STOP error) information in dump files.




After the bsod please upgrade the zip file or post a new one so that we can debug the bsod minidump files.


Commands to turn on and off windows driver verifier:
To turn on windows driver verifier: In the left lower corner search type: verifier
To turn off windows driver verifier: you must be able to move from a bsod to the windows advanced troubleshooting menu and then navigate to startup options then safe mode with command prompt and type or copy and paste: verifier /reset
At times the startup options safe mode command verifier /reset will not turn off windows driver verifier. There are two additional options. Option one is to navigate the windows advance troubleshooting menu to command prompt instead of startup options. This is command prompt that opens Administrator: X:\windows\system32\cmd.exe
You will type or copy and paste this command: verifier /bootmode resetonbootfail
If this second method does not turn off windows driver verifier you will need to use the windows advanced recovery menu to restore with the restore point that you created before using windows driver verifier.



We will wait for the results of the administrative command prompt commands and 8 runs of memory testing.

Again you must back up files, create a restore point, and be comfortable with the windows advanced recovery menu in order to use the windows driver verifier tool to find misbehaving drivers.

 

After scannow, by post in thread, do you mean post here before running the memory thing? Do you also mean by the following explanation that what is replaced is optional? And what about 36 hours? Do I need to be in bios for 36 hours?

 

Please run through the steps in the order above so that you can display results 1 to 4.
Then overnight you will run memtest86+ for at least 8 runs. This will take a very long time to run.
The windows driver verifier is planned pending the results of the above.
There are no bios steps for windows driver verifier. It should be all windows based with repetitive bsod and windows advanced troubleshooting.

 

winversion: 1607 OS Build 14393.1358 btw when i get to memtest, where am i supposed to install it?

 

aswSP.SYS avast! Self Protection Driver http://support.avast.com/

Please uninstall Avast using Avast Uninstall Utility | Download aswClear for Avast Removal
Turn on windows defender

You will need a flash drive that you can format to perform the Memtest86+ version 5.01 testing. If you have an optical drive and a blank cd you can use it: Using MemTest86+ To Diagnose RAM Problems | RyanTAdams.com
It is important that there are 8 or more runs.
Please post the results from the earlier post.

 

sfc scannow found nothing wrong. do i need to do: dism /online /cleanup-image /restorehealth? according to some info on google, it seems like it will try to restore the image from a default source? what exactly is that? and what if this isn't the problem?

 

There are no problems running the DISM commands. They are backup in case scannow is unable to perform repairs. Sometimes the dism commands fail too. So we run both to make sure we have a working back up.

There are three commands that can be used in sequence:
Dism /online /cleanup-image /checkhealth
dism /online /cleanup-image /scanhealth
dism /online /cleanup-image /restorehealth

On my computers I run the restorehealth command weekly

It is good habbit to do regular preventative maintenance on computers:
Run malware scans in manual mode on a regular basis.
Run the 3 commands in administrative command prompt weekly :scannow, restorehealth, scan
It will keep your operating system healthy and drive healthy.

Everytime you run a sfc or dism command on your computer there is a file that displays the integrity or lack or integrity of the operating system. The files need to be compared to see if they are corrupt or not. The files are cbs and dism logs.
C:\Windows\Logs\CBS\CBS.log
C:\Windows\Logs\Dism\Dism.log

 

if it said there were no integrity violations, do i still run restore health? if so, why? what is it restoring it from? btw, i noticed lately that sometimes when it returns from sleep mode, my system turns off some applications (such as open explorer windows). so probably right now there are not certain disk errors, but it needs to check for other errors? do i need to go to restore health, or should i do check health first?

Then later, is the memory test thing going to cause any conflict with windows? will it delete any applications? i didn't see any mention about Windows 10 on that page.

 

Joshua,
These are some links for reading about these tools.
They are some of the best tools to use to maintain the operating system and fix it when it is fixable.
How to use DISM command-line utility to repair a Windows 10 image | Windows Central
https://support.microsoft.com/en-us/...date-readiness
Use DISM to Repair Windows 10 Image Windows 10 Performance Maintenance Tutorials
Repair a Windows Image
https://support.microsoft.com/en-us/...rrupted-system
There should be no problems running Memtest86+. It is time consuming and is best to run it overnight. It needs to be ran for at least 8 runs for it to not have false negatives.
Memory problems. - Microsoft Community

 

in check health and scan health it did not find anything. will it be possible to still find errors in restore health, since it takes longer? i noticed that it may need to reference windows update. also, i currently only have the USB with the ISO probably from pre-anniversary edition and pre-updates. I do not really want to go buy another USB drive just to test this.. i am currently not finding any ESD file on my system.

 

The 3 dism commands can be run at any time without attached devices. At times there can be error codes if the dource files cannot be found. Again there should be no harm in running the 3 dism commands. They will indicate whether the os is repairable and whether any repairs were done or not done. If the information is not displayed on the administrative command prompt windows it will be displayed in the dism log.

Please update on what you have done with each of these and their respective results:
1) Avast
2) Windows defender
3) Memtest86+ for 8 or more runs with completion image
4) Dism commands with completion results
5) Created a new restore point
6) Used Macrium to create an image of your drive

 

so far, i only ran sfc scannow, and dism check health, dism scan health. i have not uninstalled avast yet. will i need the internet connection to do restore health? do i need to do macrium image prior? didn't macrium image require taking up a lot of space? when do i need to make the image? what do i need to do with windows defender?