[SOLVED] Blue screen - before and after hard drive change

[brad8598]

We began getting this bluescreen with a Crucial SSD installed and completely full and were failing backups, so we mirrored it to a larger M.2 SSD. After going through all driver and Windows updates, I still cannot point the the cause. Memory and hard drive tests passed. I am willing to do and redo anything requested to the machine but it may take me a couple of days as it is still in use daily. Thanks in advance for the help.

 

[x BlueRobot]

Please follow these posting instructions - Blue Screen of Death (BSOD) Posting Instructions - Windows 10, 8.1, 8, 7 + Vista

 

[brad8598]

We began getting this bluescreen with a Crucial SSD installed and completely full and were failing backups, so we mirrored it to a larger M.2 SSD. This solved our backup issue but still getting the BSOD. After going through all driver and Windows updates, I still cannot point the the cause. Memory and hard drive tests passed. I am willing to do and redo anything requested to the machine but it may take me a couple of days as it is still in use daily. Thanks in advance for the help.

• A brief description of your problem (but you can also include the steps you tried)
  • see above
• System Manufacturer?
  • Dell
• Laptop or Desktop?
  • Desktop
• Exact model number (if laptop, check label on bottom)
  • Optiplex 7050
• OS ? (Windows 10, 8.1, 8, 7, Vista)
  • Windows 10 Pro 20H2 Build 19042.844
• x86 (32bit) or x64 (64bit)?
  • 64bit
• (Only for xp, vista, 7) Service pack?
  • N/A
• What was original installed OS on system?
  • W10 Pro
• Is the OS an OEM version (came pre-installed on system) or full retail version (YOU purchased it from retailer)?
  • OEM
• Age of system? (hardware)
  • 4 years, April 2017
• Age of OS installation?
  • 2 months
• Have you re-installed the OS?
  • yes, but restored from backup afterwards
• CPU
  • Intel(R) Core(TM) i7-7700 CPU @ 3.60GHz
• RAM (brand, EXACT model, what slots are you using?)
  • 4096 MB, Type 26, Synchronous, Unbuffered (Unregistered), 2400 MHz (in DIMM 1-4, 16GB total)
  • this was pre-installed from Dell, I cannot physically access to check brand
• Video Card
  • Intel HD Graphics 630
• MotherBoard - (if NOT a laptop)
  • Dell Inc. 0NW6H5 A00
• Power Supply - brand & wattage (if laptop, skip this one)
  • not sure, OEM
• Is driver verifier enabled or disabled?
  • not currently enabled
• What security software are you using? (Firewall, antivirus, antimalware, antispyware, and so forth)
  • Kaspersky
• Are you using proxy, vpn, ipfilters or similar software?
  • no
• Are you using Disk Image tools? (like daemon tools, alcohol 52% or 120%, virtual CloneDrive, roxio software)
  • Acronis
• Are you currently under/overclocking? Are there overclocking software installed on your system?
  • no

 

[brad8598]

http://speccy.piriform.com/results/QVQmC35qOKzvO652PT24ZBx

 

[jcgriff2]

Hi. . .

You are possibly dealing with unknown hardware failure here, but maybe not. From two of the dumps, the probable cause -

MODULE_NAME: hardware

The bugchecks - 5 dumps -

Bugcheck code 0000001A
Arguments 00000000`00041792 ffff9e3f`ff72f180 00000000`00000010 0000000`00000000
Probable cause = Hardware

(3) 0x1a = severe memory management error has occurred
P1 = 0x41792 = A corrupt PTE has been detected. PTE = Page Table Entry (from the hard drive page file)

(1) 0x50 = invalid memory referenced
IMAGE_NAME/ Probable cause: DeviceLockDllDrv0.SYS
FAILURE_BUCKET_ID: AV_INVALID_DeviceLockDllDrv0!unknown_function

DeviceLockDllDrv0.SYS - very little information found on this driver, but I believe it belongs to Acronis. Do you have Acronis installed? If so, how old is your version?

DeviceLockDllDrv0.SYS Mon Nov  9 07:49:26 2020 (5FA93AD6)

(1) 0x3b (0xc0000005,,,) = system service threw an exception; excp = memory access violation

I know that the bugchecks all appear to be memory related, but remember that you have an SSD, which acts just like RAM and therefore can give off "RAM-like" bugchecks.

Just a guess, but I would think that Acronis has a system service; hence the 0x3b bugcheck.

How many SSDs do you have? i.e., do you have 1 for Windows and another for backups?

we mirrored it to a larger M.2 SSD. This solved our backup issue but still getting the BSOD. After going through all driver and Windows updates,...

It is possible that the drive you mirrored contained corrupted data. If so, that has now been transferred to the new drive.

How many drivers did you update and how many outstanding Windows Updates did you install?

Run Driver Verifier - (21) Driver Verifier - BSOD related - Windows 10, 8.1, 8, 7 + Vista | Sysnative Forums

It must run for a minimum of 24 hours. It checks drivers and if it finds a violation, it will BSOD your system instantly - so save your work often.

If you get a BSOD, re-run the sysnative app and post it. I need to see that dump.

After Driver Verifier, I want you to UNINSTALL Acronis and run for a day or two and see if system BSODs. Turning it off is not good enough because the drivers still load into RAM and could continue to cause BSODs, assuming it is our culprit here.

The "Probable cause - Hardware" is obviously unsettling to me at this time.

Regards. . .

jcgriff2

 

[zbook]

Approximately when were each of these RAM modules installed?

Hyundai: HMA851U6AFR6N-UH (Week/year: 07 / 17)
Crucial: CT4G4DFS824A.C8FADP

Were there prior RAM module replacements?

It appears that one or more RAM modules were / are malfunctioning.


1) Open administrative command prompt (ACP) and type or copy and paste:
2) dism /online /cleanup-image /restorehealth
3) sfc /scannow
4) chkdsk /scan
5) wmic recoveros set autoreboot = false
6) wmic recoveros get autoreboot
7) wmic Computersystem where name="%computername%" set AutomaticManagedPagefile=True
8) wmic Computersystem where name="%computername%" get AutomaticManagedPagefile
9) bcdedit /enum {badmemory}

10) When these have completed > right click on the top bar or title bar of the administrative command prompt box > left click on edit then select all > right click on the top bar again > left click on edit then copy > paste into the thread

11) Run Memtest86 version 9.0 (or newer version if available) for four passes.
Repeat the test so that eight passes are performed.

MemTest86 - Official Site of the x86 Memory Testing Tool

Use a camera or smart phone camera to take pictures and post images into the thread.
In case there are any problems uploading images use share links (one drive, drop box, or google drive)

Memtest86 has a feature to produce a text report.
Please post this in addition to the images.

12) Run: Crucial System Scanner

 

[brad8598]

Thanks for the help. I am actually out of the office the next couple of days but will try some of this over the weekend and report back.

 

[brad8598]

I apologize for the delay as I got tied up with some other work. I went ahead and removed Acronis first to test as it started causing problems on another machine- newest version. I will perform Driver Verifier next week if the BSOD continues. Thanks for the help.

 

[zbook]

When available please update the progress with the steps in post #6.

Memtest86 version 9 can run overnight.

 

[brad8598]

I am unable to run Memtest at the moment because I am remote from the machine. Unless there is a way for me to run it and get a log. Here are the results from the command prompt actions-


Microsoft Windows [Version 10.0.19042.928]
(c) Microsoft Corporation. All rights reserved.

C:\WINDOWS\system32>dism /online /cleanup-image /restorehealth

Deployment Image Servicing and Management tool
Version: 10.0.19041.844

Image Version: 10.0.19042.928

[==========================100.0%==========================]
Error: 0x800f081f

The source files could not be found.
Use the "Source" option to specify the location of the files that are required to restore the feature. For more information on specifying a source location, see Configure a Windows Repair Source.

The DISM log file can be found at C:\WINDOWS\Logs\DISM\dism.log

C:\WINDOWS\system32>sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection found corrupt files but was unable to fix some of them.
For online repairs, details are included in the CBS log file located at
windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log. For offline
repairs, details are included in the log file provided by the /OFFLOGFILE flag.

C:\WINDOWS\system32>chkdsk /scan
The type of the file system is NTFS.

Stage 1: Examining basic file system structure ...
653568 file records processed.
File verification completed.
Phase duration (File record verification): 5.62 seconds.
11603 large file records processed.
Phase duration (Orphan file record recovery): 0.00 milliseconds.
0 bad file records processed.
Phase duration (Bad file record checking): 0.18 milliseconds.

Stage 2: Examining file name linkage ...
22359 reparse records processed.
Found a bad index "$I30" in directory "\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~19041.870.1.2 <0x1a,0x3a75>"
was not able to send command for self-healing due to lack of memory.

C:\WINDOWS\system32>wmic recoveros set autoreboot = false
Updating property(s) of '\\CAROL-PC\ROOT\CIMV2:Win32_OSRecoveryConfiguration.Name="Microsoft Windows 10 Pro|C:\\WINDOWS|\\Device\\Harddisk0\\Partition4"'
Property(s) update successful.

C:\WINDOWS\system32>wmic recoveros get autoreboot
AutoReboot
FALSE


C:\WINDOWS\system32>wmic Computersystem where name="%computername%" set AutomaticManagedPagefile=True
Updating property(s) of '\\CAROL-PC\ROOT\CIMV2:Win32_ComputerSystem.Name="CAROL-PC"'
Property(s) update successful.

C:\WINDOWS\system32>wmic Computersystem where name="%computername%" get AutomaticManagedPagefile
AutomaticManagedPagefile
TRUE


C:\WINDOWS\system32>bcdedit /enum {badmemory}

RAM Defects
-----------
identifier {badmemory}
badmemorylist 0x97e70
0x97e71
0x97e72
0x97e73
0x97e74
0x97e75
0x97e76
0x97e77

C:\WINDOWS\system32>

 

[zbook]

It's highly recommended that you troubleshoot the malfunctioning RAM.

Once there are no longer unexpected shutdowns and restarts it will be easier to troubleshoot:
a) problems with the component store
b) problems with the operating system
c) problems with the drive file system


Windows Update Forum Posting Instructions
(perform steps 4 and 5)

Open administrative command prompt (ACP) and type or copy and paste:
findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log >"%userprofile%\Desktop\sfcdetails.txt"

Find the new text file on the desktop > post a share link

 

[x BlueRobot]

It's highly recommended that you troubleshoot the malfunctioning RAM.

@brad8598 please only focus on this part. I would ignore the rest. And it's only possibly bad RAM, from my understanding, the bad memory enumeration contains PFNs which are likely to be defective as indicated by the ECC.

 

[brad8598]

I am going to try and follow up on these as soon as possible.

Question- the new hard drive is an M.2, so doesn't the system read that as RAM? ... This all began because there was a SATA SSD giving a bad block error. I had an onsite tech replace with a larger M.2 and imaged the data. If I did in fact copy the bad info, am I able to start over with a fresh install and then replace user profile? ... sorry for the rabbit trail, just trying to think through it myself.

I will get the information requested in post #11 in the next couple of days, probably Wednesday night.

 

[x BlueRobot]

Question- the new hard drive is an M.2, so doesn't the system read that as RAM? ... This all began because there was a SATA SSD giving a bad block error.

No, only because it's "memory", it doesn't mean that the operating system will consider it the same as RAM. They're still fundamentally different in terms of technology.

If I did in fact copy the bad info, am I able to start over with a fresh install and then replace user profile? ... sorry for the rabbit trail, just trying to think through it myself.

I wouldn't consider a clean install at this point, especially if it's due to hardware.

 

[brad8598]

I am following up on an old post. The computer in question ended up being replaced as it was not fruitful for the client to keep troubleshooting it. Thanks for your help and this can be considered "closed"

 

[x BlueRobot]

That's unfortunate, but thanks for letting me know.