Windows 10: Windows 10 Crashes Overnight

For the past couple days I have noticed my PC has been rebooted when I begin my workday. Looking through the Event Viewer, and filtering for Event ID 6008 I can see 2 unexpected shutdowns. I also verified this within reliability monitor. There were 3 automatic updates on 2020/09/08 and no unexpected shutdowns prior to those updates.


I have run windbg on the minidumps created on 2020/09/10 and 2020/09/11 and both times it reports a KERNEL_SECURITY_CHECK_FAILURE 139 with the process name Microsoft.Phot which I am assuming is Microsoft Photos.


I have not had Microsoft Photos running and I do not know why it would have randomly started overnight. Could this be a malware based issue or is there a known issue with Photos?


Analysis below:


*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************



KERNEL_SECURITY_CHECK_FAILURE 139

A kernel component has corrupted a critical data structure. The corruption

could potentially allow a malicious user to gain control of this machine.

Arguments:

Arg1: 000000000000001d, Type of memory safety violation

Arg2: ffffcf07098679a0, Address of the trap frame for the exception that caused the bugcheck

Arg3: ffffcf07098678f8, Address of the exception record for the exception that caused the bugcheck

Arg4: 0000000000000000, Reserved



Debugging Details:

------------------

KEY_VALUES_STRING: 1

PROCESSES_ANALYSIS: 1

SERVICE_ANALYSIS: 1

STACKHASH_ANALYSIS: 1

TIMELINE_ANALYSIS: 1

DUMP_CLASS: 1

DUMP_QUALIFIER: 400

BUILD_VERSION_STRING: 10.0.19041.508 WinBuild.160101.0800

DUMP_FILE_ATTRIBUTES: 0x8

Kernel Generated Triage Dump

DUMP_TYPE: 2

BUGCHECK_P1: 1d

BUGCHECK_P2: ffffcf07098679a0

BUGCHECK_P3: ffffcf07098678f8

BUGCHECK_P4: 0

TRAP_FRAME: ffffcf07098679a0 -- .trap 0xffffcf07098679a0

NOTE: The trap frame does not contain all registers.

Some register values may be zeroed or incorrect.

rax=fffff80482a12400 rbx=0000000000000000 rcx=000000000000001d

rdx=fffff80482a12498 rsi=0000000000000000 rdi=0000000000000000

rip=fffff804822666c7 rsp=ffffcf0709867b38 rbp=000000000000000f

r8=fffff80482a12498 r9=0000000000000000 r10=fffff80482a12400

r11=fffff80482a31740 r12=0000000000000000 r13=0000000000000000

r14=0000000000000000 r15=0000000000000000

iopl=0 nv up ei ng nz ac pe cy

nt!RtlRbRemoveNode+0x198c17:

fffff804`822666c7 cd29 int 29h

Resetting default scope



EXCEPTION_RECORD: ffffcf07098678f8 -- .exr 0xffffcf07098678f8

ExceptionAddress: fffff804822666c7 nt!RtlRbRemoveNode+0x0000000000198c17

ExceptionCode: c0000409 Security check failure or stack buffer overrun

ExceptionFlags: 00000001

NumberParameters: 1

Parameter[0]: 000000000000001d

Subcode: 0x1d FAST_FAIL_INVALID_BALANCED_TREE


CPU_COUNT: 8

CPU_MHZ: b58

CPU_VENDOR: GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 9e

CPU_STEPPING: 9

CUSTOMER_CRASH_COUNT: 1

BUGCHECK_STR: 0x139

PROCESS_NAME: Microsoft.Phot

CURRENT_IRQL: f

DEFAULT_BUCKET_ID: FAIL_FAST_INVALID_BALANCED_TREE

ERROR_CODE: NTSTATUS 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE: NTSTATUS 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE_STR: c0000409

EXCEPTION_PARAMETER1: 000000000000001d

ANALYSIS_SESSION_HOST: XXXXXXX

ANALYSIS_SESSION_TIME: 09-11-2020 09:41:27.0704
ANALYSIS_VERSION: 10.0.18362.1 amd64fre
DPC_STACK_BASE: FFFFCF0709867FB0
LAST_CONTROL_TRANSFER: from fffff80482205e69 to fffff804821f3ea0
STACK_TEXT:
ffffcf07`09867678 fffff804`82205e69 : 00000000`00000139 00000000`0000001d ffffcf07`098679a0 ffffcf07`098678f8 : nt!KeBugCheckEx

ffffcf07`09867680 fffff804`82206290 : 00000000`000000ff 00000000`000000ff 00000000`000000ff ffff8001`e3100180 : nt!KiBugCheckDispatch+0x69

ffffcf07`098677c0 fffff804`82204623 : ffffffff`ffffffff fffff804`960011bf 00000000`0000000f 00000000`00000000 : nt!KiFastFailDispatch+0xd0

ffffcf07`098679a0 fffff804`822666c7 : fffff804`82a31ee0 00000000`00000002 fffff804`8231ac33 00000000`0000000f : nt!KiRaiseSecurityCheckFailure+0x323

ffffcf07`09867b38 fffff804`8231ac33 : 00000000`0000000f ffffcf07`09867e70 ffffffff`ffffffff 00000000`00000001 : nt!RtlRbRemoveNode+0x198c17

ffffcf07`09867b50 fffff804`8231ad04 : ffff8001`e3339240 ffffcf07`09867cb0 ffff8001`e3336180 00000000`00000000 : nt!KiSetVirtualHeteroClockIntervalRequest+0x83

ffffcf07`09867b80 fffff804`820e9a3e : ffff8001`e3339240 ffffba8d`3ac30000 00000000`00000000 ffffba8d`00000002 : nt!KiSetVirtualHeteroClockIntervalRequestDpcRoutine+0x14

ffffcf07`09867bb0 fffff804`820e8d24 : ffff8001`e3336180 00000000`00000000 00000000`00000008 00000000`004b14fc : nt!KiExecuteAllDpcs+0x30e

ffffcf07`09867d20 fffff804`821faee5 : 00000000`00000000 ffff8001`e3336180 00000000`00000000 00000000`00000070 : nt!KiRetireDpcList+0x1f4

ffffcf07`09867fb0 fffff804`821facd0 : 0000025a`c35ed610 00000000`00000000 00000000`00000000 0000025a`9b818900 : nt!KxRetireDpcList+0x5

ffffcf07`125b59d0 fffff804`821fa39e : 00000000`80004002 ffffba8d`00000000 ffffba8d`61d2cd20 ffffcf07`125b5a80 : nt!KiDispatchInterruptContinue

ffffcf07`125b5a00 00007ffd`439bc8e0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDpcInterrupt+0x2ee

000000bd`4cbfedf8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffd`439bc8e0


THREAD_SHA1_HASH_MOD_FUNC: 4141678573589d53feba69cd5cffe7cf2260366a

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 34049fa76ea3c58b8e7bfd3ac45abb27eafe490f
THREAD_SHA1_HASH_MOD: dc844b1b94baa204d070855e43bbbd27eee98b94
FOLLOWUP_IP:
nt!KiFastFailDispatch+d0
fffff804`82206290 c644242000 mov byte ptr [rsp+20h],0
FAULT_INSTR_CODE: 202444c6
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt!KiFastFailDispatch+d0
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 0
IMAGE_VERSION: 10.0.19041.508
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: d0
FAILURE_BUCKET_ID: 0x139_1d_INVALID_BALANCED_TREE_nt!KiFastFailDispatch
BUCKET_ID: 0x139_1d_INVALID_BALANCED_TREE_nt!KiFastFailDispatch
PRIMARY_PROBLEM_CLASS: 0x139_1d_INVALID_BALANCED_TREE_nt!KiFastFailDispatch
TARGET_TIME: 2020-09-10T12:14:41.000Z
OSBUILD: 19041
OSSERVICEPACK: 508
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: unknown_date
BUILDDATESTAMP_STR: 160101.0800
BUILDLAB_STR: WinBuild
BUILDOSVER_STR: 10.0.19041.508
ANALYSIS_SESSION_ELAPSED_TIME: f9d
ANALYSIS_SOURCE: XX
FAILURE_ID_HASH_STRING: km:0x139_1d_invalid_balanced_tree_nt!kifastfaildispatch
FAILURE_ID_HASH: {67ec97ad-ad0b-071e-ab87-6dc661e22d1b}
Followup: MachineOwner

---------

:)

 

all games crash!

I suggest you run rthdribl > http://www.daionet.gr.jp/~masa/archives/rthdribl_1_2.zip
Increase the window size step by step and watch your vga temps permanently.
What happens?
If it crashes, run at stock speeds as suggested before and retry.

P.S.: When your system locks, does the display signal turn off after a time?
Stuttering sound or no sound at all when freezing?
What X1800XT model do you own exactly?

 

Windows 10 Tweaks

Pressing “Windows+Pause Break” (it’s up there next to scroll lock) opens the “System” Window.

Windows 10: In the new version of Windows, Explorer has a section called Quick Access. This includes your frequent folders and recent files. Explorer defaults to opening this page when you open a new window. If you’d rather open the usual This PC, with links to your drives and library folders, follow these steps:

• Open a new Explorer window.
• Click View in the ribbon.
• Click Options.
• Under General, next to “Open File Explorer to:” choose “This PC.”
• Click OK

credit to Lifehacker.

 

all games crash!

ive watch my temps and both the cpu and gpu are within normal ranges. when it freezes it simply freezes the image and stops the sound. i must reboot to get back to windows.