BSOD in my Laptop

[Santoreeves788]

My laptop type asus ROG G751JY Windows 10 64it this morning experienced a bluescreen, can anyone help me?

there are two files that I include here the first file Sysnative BSOD Dump + System File Collection App, the second file from my laptop minidump

 

[Santoreeves788]

anyone can help ?

 

[axe0]

Hi Santoreeves788,

Is this crash from yesterday morning the only one you've had recently?

This looks like a one-off crash, one that happens due to temporary corruption in the memory and is resolved as soon as the computer restarts.

 

[Santoreeves788]

Hi Santoreeves788,

Is this crash from yesterday morning the only one you've had recently?

This looks like a one-off crash, one that happens due to temporary corruption in the memory and is resolved as soon as the computer restarts.

is there a solution to prevent it from crashing again

 

[axe0]

Unless your pc crashes again anytime soon, say in this month, I do not see a reason to pursue this any further.

 

[zbook]

Hi Santoreeves788 ,


The logs displayed 5 BSOD.
There were 3 collected mini dump files with bugchecks:
50
7E

There RAM is mismatched.



Please perform the following steps:



1) Open administrative command prompt (ACP) and type or copy and paste:

2) sfc /scannow

3) dism /online /cleanup-image /scanhealth

4) dism /online /cleanup-image /restorehealth

5) sfc /scannow

6) chkdsk /scan

7) wmic recoveros set autoreboot = false

8) wmic recoveros set DebugInfoType = 7

9) wmic recoveros get autoreboot

10) wmic recoveros get DebugInfoType

11) bcdedit /enum {badmemory}



12) When these have completed > right click on the top bar or title bar of the administrative command prompt box > left click on edit then select all > right click on the top bar again > left click on edit then copy > paste into the thread



13) Run Memtest86 version 8.4 (or newer version if available) for four passes.

Repeat the test so that eight passes are performed.



MemTest86 - Official Site of the x86 Memory Testing Tool



Use a camera or smart phone camera to take pictures and post images into the thread.

In case there are any problems uploading images use share links (one drive, drop box, or google drive)



Memtest86 has a feature to produce a text report.

Please post this in addition to the images.



14) Run HD Tune (free version) (all drives)

HD Tune website

Post images into the thread for results on these tabs:

a) Health

b) Benchmark

c) Full error scan



15) Run Sea Tools for Windows

long generic test

Post an image of the test result into the thread

SeaTools for Windows | Seagate

How to use SeaTools for Windows | Seagate Support US

     M471B1G73DB0-YK0

     GKH800SO51208-1600

 

[axe0]

The wmic data you request, zbook, is available in the logs. Not sure why you request it again.

Aren't those steps a bit of overkill, how relevant are the drive events from about a month or more ago in your opinion?

 

[xilolee]

I suspect nlwt.sys, installed by nordvpn (Tefincom S.A.).
Path: C:\WINDOWS\SYSTEM32\DRIVERS\NLWT.SYS
Version: 0.8.0.0
Size: 38.44 KB (39,360 bytes)
Date: Jun 10 2020 7:40 PM
Company: WireGuard LLC
Other info: hxxps://www.wintun.net/ - NordLynx Tunnel Driver
Other nordvpn drivers: tapnordvpn.sys, nordlwf.sys


Try verifier... Please read CAREFULLY the following instructions:

• Create a restore point
• Create a system image.
  You can follow this tutorial, if you shouldn't know how to do: Using Macrium Free to Backup or Image your drives
• Backup your important files (the files you don't want to lose)
• Read the guide about Driver Verifier - BSOD related - Windows 10, 8.1, 8, 7 & Vista (click).
• Read some other tutorials/guides and WARNINGS on internet.
• Open an elevated command prompt (right-click on windows start button, click command prompt (admin)
  1. Type (copy/paste) in it:

     verifier /flags 0x0002892b /bootmode oneboot /driver nlwt.sys

     And press enter.
     This will set verifier settings.
     You will see something like:
     Read More:

     Verifier Flags: 0x0002892b
     
       Standard Flags:
     
         [X] 0x00000001 Special pool.
         [X] 0x00000002 Force IRQL checking.
         [X] 0x00000008 Pool tracking.
         [ ] 0x00000010 I/O verification.
         [X] 0x00000020 Deadlock detection.
         [ ] 0x00000080 DMA checking.
         [X] 0x00000100 Security checks.
         [X] 0x00000800 Miscellaneous checks.
         [X] 0x00020000 DDI compliance checking.
     
       Additional Flags:
     
         [ ] 0x00000004 Randomized low resources simulation.
         [ ] 0x00000200 Force pending I/O requests.
         [ ] 0x00000400 IRP logging.
         [ ] 0x00002000 Invariant MDL checking for stack.
         [ ] 0x00004000 Invariant MDL checking for driver.
         [X] 0x00008000 Power framework delay fuzzing.
         [ ] 0x00010000 Port/miniport interface checking.
         [ ] 0x00040000 Systematic low resources simulation.
         [ ] 0x00080000 DDI compliance checking (additional).
         [ ] 0x00200000 NDIS/WIFI verification.
         [ ] 0x00800000 Kernel synchronization delay fuzzing.
         [ ] 0x01000000 VM switch verification.
         [ ] 0x02000000 Code integrity checks.
     
         [X] Indicates flag is enabled.
     
       Boot Mode:
     
         Oneboot
     
       Rules:
     
         All rules are using default settings
     
       Extensions:
     
         wdm: rules.default
     
       Verified Drivers:
     
         nlwt.sys
     
     The system reboot is required for the changes to take effect.

  2. Type (copy/paste) in it:

     shutdown -r -t 300

     And press enter.
     This will restart your PC after five minutes.
     You can abort the previous command with "shutdown -a" in an elevated command prompt.
     Obviously, you can reboot your pc on your own, before the 5 minutes set by the command.
  3. After the reboot, open a command prompt and check if verifier settings are enabled with this command

     verifier /querysettings

     And press enter.
     If they are enabled, let verifier run from 24 to 72 hours.
     If they are not enabled, inform me.
     If you'll get a very fast BSOD after you logged into windows, or after some dozens (tenths?) of minutes, the option oneboot should reset driver verifier settings (and should allow you to boot your machine in a normal state)... But if this won't happen, you'll need to go to safe mode to reset verifier settings. Once safe mode is available, from an elevated command prompt you'll type:

     verifier /reset

     And press enter.
     Sometimes it is necessary to use a system restore point (or a system image).
  4. Post here the new verifier dump; from an elevated command prompt, launch this command:

     md "%userprofile%\desktop\minidump" && copy c:\windows\minidump "%userprofile%\desktop\minidump"

 

[Santoreeves788]

thanks all i will try

 

[Santoreeves788]

Hi Santoreeves788 ,


The logs displayed 5 BSOD.
There were 3 collected mini dump files with bugchecks:
50
7E

There RAM is mismatched.



Please perform the following steps:



1) Open administrative command prompt (ACP) and type or copy and paste:

2) sfc /scannow

3) dism /online /cleanup-image /scanhealth

4) dism /online /cleanup-image /restorehealth

5) sfc /scannow

6) chkdsk /scan

7) wmic recoveros set autoreboot = false

8) wmic recoveros set DebugInfoType = 7

9) wmic recoveros get autoreboot

10) wmic recoveros get DebugInfoType

11) bcdedit /enum {badmemory}



12) When these have completed > right click on the top bar or title bar of the administrative command prompt box > left click on edit then select all > right click on the top bar again > left click on edit then copy > paste into the thread



13) Run Memtest86 version 8.4 (or newer version if available) for four passes.

Repeat the test so that eight passes are performed.



MemTest86 - Official Site of the x86 Memory Testing Tool



Use a camera or smart phone camera to take pictures and post images into the thread.

In case there are any problems uploading images use share links (one drive, drop box, or google drive)



Memtest86 has a feature to produce a text report.

Please post this in addition to the images.



14) Run HD Tune (free version) (all drives)

HD Tune website

Post images into the thread for results on these tabs:

a) Health

b) Benchmark

c) Full error scan



15) Run Sea Tools for Windows

long generic test

Post an image of the test result into the thread

SeaTools for Windows | Seagate

How to use SeaTools for Windows | Seagate Support US

     M471B1G73DB0-YK0

     GKH800SO51208-1600

Microsoft Windows [Version 10.0.19041.546]
(c) 2020 Microsoft Corporation. All rights reserved.

C:\Windows\system32>dism /online /cleanup-image /scanhealth

Deployment Image Servicing and Management tool
Version: 10.0.19041.329

Image Version: 10.0.19041.546

[==========================100.0%==========================] No component store corruption detected.
The operation completed successfully.

C:\Windows\system32>dism /online /cleanup-image /restorehealth

Deployment Image Servicing and Management tool
Version: 10.0.19041.329

Image Version: 10.0.19041.546

[==========================100.0%==========================] The restore operation completed successfully.
The operation completed successfully.

C:\Windows\system32>sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.

C:\Windows\system32> chkdsk /scan
The type of the file system is NTFS.

Stage 1: Examining basic file system structure ...
208384 file records processed.
File verification completed.
Phase duration (File record verification): 2.87 seconds.
6651 large file records processed.
Phase duration (Orphan file record recovery): 0.00 milliseconds.
0 bad file records processed.
Phase duration (Bad file record checking): 0.62 milliseconds.

Stage 2: Examining file name linkage ...
5475 reparse records processed.
305134 index entries processed.
Index verification completed.
Phase duration (Index verification): 7.59 seconds.
0 unindexed files scanned.
Phase duration (Orphan reconnection): 278.21 milliseconds.
0 unindexed files recovered to lost and found.
Phase duration (Orphan recovery to lost and found): 0.55 milliseconds.
5475 reparse records processed.
Phase duration (Reparse point and Object ID verification): 15.20 milliseconds.

Stage 3: Examining security descriptors ...
Security descriptor verification completed.
Phase duration (Security descriptor verification): 33.02 milliseconds.
48376 data files processed.
Phase duration (Data attribute verification): 0.39 milliseconds.
CHKDSK is verifying Usn Journal...
34651008 USN bytes processed.
Usn Journal verification completed.
Phase duration (USN journal verification): 404.68 milliseconds.

Windows has scanned the file system and found no problems.
No further action is required.

116581702 KB total disk space.
40820972 KB in 151672 files.
108144 KB in 48377 indexes.
0 KB in bad sectors.
315310 KB in use by the system.
65536 KB occupied by the log file.
75337276 KB available on disk.

4096 bytes in each allocation unit.
29145425 total allocation units on disk.
18834319 allocation units available on disk.
Total duration: 11.20 seconds (11203 ms).

C:\Windows\system32>wmic recoveros set autoreboot = false
Updating property(s) of '\\DESKTOP-FUTT929\ROOT\CIMV2:Win32_OSRecoveryConfiguration.Name="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition3"'
Property(s) update successful.

C:\Windows\system32>wmic recoveros set DebugInfoType = 7
Updating property(s) of '\\DESKTOP-FUTT929\ROOT\CIMV2:Win32_OSRecoveryConfiguration.Name="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition3"'
Property(s) update successful.

C:\Windows\system32>wmic recoveros get autoreboot
AutoReboot
FALSE


C:\Windows\system32>wmic recoveros get DebugInfoType
DebugInfoType
7


C:\Windows\system32>bcdedit /enum {badmemory}

RAM Defects
-----------
identifier {badmemory}
badmemorylist 0x1c0079
0x1c043d
0x1c052d
0x1c0879
0x1c0969
0x1c0cf1
0x1c0e1d
0x1c0e95
0x1c0fc1
0x1c14b5
0x1c1785
0x1c183d
0x1c1879
0x1c192d
0x1c19e1
0x1c1a1d
0x1c1b85
0x1c1d2d
0x1c1da5
0x1c20f1
0x1c22d1
0x1c230d
0x1c2349
0x1c252c
0x1c25a5
0x1c2a95
0x1c2ad1
0x1c2d2d
0x1c361d
0x1c3a1d
0x1c3c3d
0x1c3cf1
0x1c3ed1
0x1f65e0
0x1f7986

 

[zbook]

Please maintain the order of these steps:

1) Upload new Sysnative log collector results

2) Run the Crucial scanner > find replacement options for RAM modules
Crucial System Scanner

3) Run Memtest86 version 8.4 (or newer version if available) for four passes.
Repeat the test so that eight passes are performed.

MemTest86 - Official Site of the x86 Memory Testing Tool

Use a camera or smart phone camera to take pictures and post images into the thread.
In case there are any problems uploading images use share links (one drive, drop box, or google drive)

Memtest86 has a feature to produce a text report.
Please post this in addition to the images.

4) Open administrative command prompt (ACP) and type or copy and paste:

5) bcdedit /enum {badmemory}
6) bcdedit /deletevalue {badmemory} badmemorylist
7) bcdedit /enum {badmemory}
8) When these have completed > right click on the top bar or title bar of the administrative command prompt box > left click on edit then select all > right click on the top bar again > left click on edit then copy > paste into the thread

9) Repeat step #3:
Run Memtest86 version 8.4 (or newer version if available) for four passes.
Repeat the test so that eight passes are performed > post images and text reports

10) If there are any errors you can abort Memtest86 testing > post images and text reports
Then remove both RAM modules > test one RAM module at a time in the same DIMM for four passes > repeat the test so that eight passes are performed.

11) Memtest86 can be ran overnight