BSOD ntoskrnl.exe since Windows update 2004

[murphy41209]

I have been getting BSODs at random times and I have been trying for months to figure out the cause of the restarts. I was hoping updating to Windows 20H2 would fix it but it is still happening.

All of my diagnostic tests for RAM and HDD have come back negative.

I have tried everything besides a clean install and that is probably next if this doesn't work.

Thank you in advance for you time.

 

[x BlueRobot]

Which memory and hard-drive diagnostics did you perform? Were they with the Windows command-line or a third-party application?

 

[murphy41209]

I have used the Windows built in diagnostics, SFC, WMD, CHKDSK /F /R and I am sure there are other things I have tried testing for but it has been going on for a while.

Is there something else you can think of I need to check? I do realize the most common issue with this type of BSOD is either RAM or a faulty driver/file sys.

 

[zbook]

The logs displayed:

a) mismatched RAM

c) possible drive problems

d) bugchecks:
7E
109
12
1A
3B
50
7A
BE
D1
F7

e) corrected hardware errors



Please perform the following steps: (in order)

1) Indicate which RAM module(s) came with the computer and which were purchased at a later time (include approximate dates)

2) Open administrative command prompt (ACP) and type or copy and paste:
3) sfc /scannow
4) dism /online /cleanup-image /scanhealth
5) dism /online /cleanup-image /restorehealth
6) sfc /scannow
7) chkdsk /scan
8) wmic recoveros set autoreboot = false
9) wmic recoveros set DebugInfoType = 7
10) wmic recoveros get autoreboot
11) wmic recoveros get DebugInfoType
12) bcdedit /enum {badmemory}

13) When these have completed > right click on the top bar or title bar of the administrative command prompt box > left click on edit then select all > right click on the top bar again > left click on edit then copy > paste into the thread

14) In the left lower corner search type: system or system control > open system control panel > on the left pane click advanced system settings

a) > on the advanced tab under startup and recovery > click settings > post an image of the startup and recovery window into the thread

b) > on the advanced tab under performance > click on settings > on the performance options window > click on the advanced tab > under virtual memory > click on change > post an image of the virtual memory window into the thread

15) Run HD Tune (free version) (all drives)
HD Tune website
Post images into the thread for results on these tabs:
a) Health
b) Benchmark
c) Full error scan

16) Run Sea Tools for Windows
long generic test
Post an image of the test result into the thread
SeaTools for Windows | Seagate
How to use SeaTools for Windows | Seagate Support US

17) Download and install: HP Diagnostics UEFI version 7.8.0
HP PC Hardware Diagnostics | HP® Official Site

18) Power on the computer and repetitively click F2 > overnight run the HP UEFI hardware diagnostics in extensive > loop until error > in the AM if there have been at least 2 loops > click esc > run any component tests as needed > take pictures with a camera or smartphone camera displaying the tests performed with results

19) These steps / tests can be performed overnight:
a) HD Tune full error scan
b) Sea Tools for Windows long generic test
c) HP UEFI hardware diagnostics

 

[x BlueRobot]

3) sfc /scannow
4) dism /online /cleanup-image /scanhealth
5) dism /online /cleanup-image /restorehealth
6) sfc /scannow
7) chkdsk /scan

They've already ran sfc and chkdsk, why are you asking for them again? Wouldn't it be better to request the existing logs first?

 

[zbook]

Windows had reported drive file system problems that were not able to be fixed.

 

[murphy41209]

I can't remember which stick was OEM. I have not seen any issues with the RAM being mismatched. The newer stick has been in the machine for over 2 years without problem.

Microsoft Windows [Version 10.0.19042.608]
(c) 2020 Microsoft Corporation. All rights reserved.

C:\WINDOWS\system32>sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.

C:\WINDOWS\system32>dism /online /cleanup-image /scanhealth

Deployment Image Servicing and Management tool
Version: 10.0.19041.572

Image Version: 10.0.19042.608

[==========================100.0%==========================] No component store corruption detected.
The operation completed successfully.

C:\WINDOWS\system32>dism /online /cleanup-image /restorehealth

Deployment Image Servicing and Management tool
Version: 10.0.19041.572

Image Version: 10.0.19042.608

[==========================100.0%==========================] The restore operation completed successfully.
The operation completed successfully.

C:\WINDOWS\system32>sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.

C:\WINDOWS\system32>chkdsk /scan
The type of the file system is NTFS.
Volume label is Windows.

Stage 1: Examining basic file system structure ...
671488 file records processed.
File verification completed.
Phase duration (File record verification): 9.41 seconds.
20367 large file records processed.
Phase duration (Orphan file record recovery): 0.00 milliseconds.
0 bad file records processed.
Phase duration (Bad file record checking): 1.04 milliseconds.

Stage 2: Examining file name linkage ...
55531 reparse records processed.
891758 index entries processed.
Index verification completed.
Phase duration (Index verification): 19.80 seconds.
0 unindexed files scanned.
Phase duration (Orphan reconnection): 2.31 seconds.
0 unindexed files recovered to lost and found.
Phase duration (Orphan recovery to lost and found): 1.18 milliseconds.
55531 reparse records processed.
Phase duration (Reparse point and Object ID verification): 154.52 milliseconds.

Stage 3: Examining security descriptors ...
Security descriptor verification completed.
Phase duration (Security descriptor verification): 55.33 milliseconds.
110136 data files processed.
Phase duration (Data attribute verification): 2.20 milliseconds.
CHKDSK is verifying Usn Journal...
35408936 USN bytes processed.
Usn Journal verification completed.
Phase duration (USN journal verification): 260.52 milliseconds.

Windows has scanned the file system and found no problems.
No further action is required.

123742207 KB total disk space.
119664872 KB in 360555 files.
286392 KB in 110137 indexes.
0 KB in bad sectors.
785067 KB in use by the system.
65536 KB occupied by the log file.
3005876 KB available on disk.

4096 bytes in each allocation unit.
30935551 total allocation units on disk.
751469 allocation units available on disk.
Total duration: 32.03 seconds (32034 ms).

C:\WINDOWS\system32>wmic recoveros set autoreboot = false
Updating property(s) of '\\LAPTOP-VOS95PCS\ROOT\CIMV2:Win32_OSRecoveryConfiguration.Name="Microsoft Windows 10 Home|C:\\WINDOWS|\\Device\\Harddisk0\\Partition3"'
Property(s) update successful.

C:\WINDOWS\system32>wmic recoveros set DebugInfoType = 7
Updating property(s) of '\\LAPTOP-VOS95PCS\ROOT\CIMV2:Win32_OSRecoveryConfiguration.Name="Microsoft Windows 10 Home|C:\\WINDOWS|\\Device\\Harddisk0\\Partition3"'
Property(s) update successful.

C:\WINDOWS\system32>wmic recoveros get autoreboot
AutoReboot
FALSE


C:\WINDOWS\system32>wmic recoveros get DebugInfoType
DebugInfoType
7


C:\WINDOWS\system32>bcdedit /enum {badmemory}

RAM Defects
-----------
identifier {badmemory}

C:\WINDOWS\system32>

 

[murphy41209]

I am running the HP UEFI System test over night tonight and I will post the results along with the rest of the items requested in the morning. Thanks for all your help so far.

 

[philc43]

If you can try and create some more free space on your C: drive (ideally you need >25GB free space) Windows will perform much better and will create the kernel memory dumps. At the moment these fail to be created.

Your corrected hardware errors all relate to the Intel PCI BUS and so it would be worth updating your chipset drivers if possible - I think you may have to try going via the Intel download page and seeing if they can detect any driver updates suitable for your system.

For your most recent crash it is not possible to run the WinDBG debugging tool because the system was updated and the symbol files have not yet been loaded for public analysis of the dump file. This should be updated in a few days but for the time being it is hindering the analysis of any new crashes.

The earlier crashes do look typical of memory module failures. It may be that testing is going to require removal of one module and using your laptop with the other module for a period of a day or two to test for stability. In this way you can identify if crashes occurs only with one module or the other.

 

[murphy41209]

If you can try and create some more free space on your C: drive (ideally you need >25GB free space) Windows will perform much better and will create the kernel memory dumps. At the moment these fail to be created.

Your corrected hardware errors all relate to the Intel PCI BUS and so it would be worth updating your chipset drivers if possible - I think you may have to try going via the Intel download page and seeing if they can detect any driver updates suitable for your system.

For your most recent crash it is not possible to run the WinDBG debugging tool because the system was updated and the symbol files have not yet been loaded for public analysis of the dump file. This should be updated in a few days but for the time being it is hindering the analysis of any new crashes.

The earlier crashes do look typical of memory module failures. It may be that testing is going to require removal of one module and using your laptop with the other module for a period of a day or two to test for stability. In this way you can identify if crashes occurs only with one module or the other.

The only reason the drive is so full at the moment is from a backup that was performed on another drive. It is normally around 80 to 90GB. The BSOD was occurring when the drive was not as full and has been doing this before the last Windows update.

 

[murphy41209]

The logs displayed:

a) mismatched RAM

c) possible drive problems

d) bugchecks:
7E
109
12
1A
3B
50
7A
BE
D1
F7

e) corrected hardware errors



Please perform the following steps: (in order)

1) Indicate which RAM module(s) came with the computer and which were purchased at a later time (include approximate dates)

2) Open administrative command prompt (ACP) and type or copy and paste:
3) sfc /scannow
4) dism /online /cleanup-image /scanhealth
5) dism /online /cleanup-image /restorehealth
6) sfc /scannow
7) chkdsk /scan
8) wmic recoveros set autoreboot = false
9) wmic recoveros set DebugInfoType = 7
10) wmic recoveros get autoreboot
11) wmic recoveros get DebugInfoType
12) bcdedit /enum {badmemory}

13) When these have completed > right click on the top bar or title bar of the administrative command prompt box > left click on edit then select all > right click on the top bar again > left click on edit then copy > paste into the thread

14) In the left lower corner search type: system or system control > open system control panel > on the left pane click advanced system settings

a) > on the advanced tab under startup and recovery > click settings > post an image of the startup and recovery window into the thread

b) > on the advanced tab under performance > click on settings > on the performance options window > click on the advanced tab > under virtual memory > click on change > post an image of the virtual memory window into the thread

15) Run HD Tune (free version) (all drives)
HD Tune website
Post images into the thread for results on these tabs:
a) Health
b) Benchmark
c) Full error scan

16) Run Sea Tools for Windows
long generic test
Post an image of the test result into the thread
SeaTools for Windows | Seagate
How to use SeaTools for Windows | Seagate Support US

17) Download and install: HP Diagnostics UEFI version 7.8.0
HP PC Hardware Diagnostics | HP® Official Site

18) Power on the computer and repetitively click F2 > overnight run the HP UEFI hardware diagnostics in extensive > loop until error > in the AM if there have been at least 2 loops > click esc > run any component tests as needed > take pictures with a camera or smartphone camera displaying the tests performed with results

19) These steps / tests can be performed overnight:
a) HD Tune full error scan
b) Sea Tools for Windows long generic test
c) HP UEFI hardware diagnostics

Here are the results for items 15 through 18. Not a single error over 10 Iterations of the Extensive test. I would like to know where you saw the PC has mismatched memory.

 

[zbook]

The test results look good.

The memory modules have different part numbers:

Node

BankLabel

Capacity

DataWidth

Description

DeviceLocator

FormFactor

HotSwappable

InstallDate

InterleaveDataDepth

InterleavePosition

Manufacturer

MemoryType

Model

Name

OtherIdentifyingInfo

PartNumber

PositionInRow

PoweredOn

Removable

Replaceable

SerialNumber

SKU

Speed

Status

Tag

TotalWidth

TypeDetail

Version

LAPTOP-VOS95PCS​

BANK 0.

8589934592​ .

64​ .

Physical Memory.

Bottom-Slot 1(left) .

12​ .

.

.

1​ .

1​ .

1315.

0​ .

.

Physical Memory.

.

CT8G4SFS8213.C8FDR1 .

1​ .

.

.

.

16176415.

.

2133​ .

.

Physical Memory 0.

64​ .

128​ .

.

LAPTOP-VOS95PCS​

BANK 2.

8589934592​ .

64​ .

Physical Memory.

Bottom-Slot 2(right).

12​ .

.

.

1​ .

2​ .

Micron.

0​ .

.

Physical Memory.

.

8ATF1G64HZ-2G3B1 .

1​ .

.

.

.

20811314.

.

2133​ .

.

Physical Memory 1.

64​ .

128​ .

.

Post new Sysnative log collector results.


Increase the free space on C: so that it is > 30 GB:
Free Up Drive Space in Windows 10


For any BSOD:

a) run the Sysnative log collector to collect new log files

b) open file explorer> this PC > C: > in the right upper corner search for: C:\Windows\memory.dmp
> if the file size is < 1.5 GB then zip > post a separate share link into the thread using one drive, drop box, or google drive

 

[murphy41209]

I know the modules have different part numbers since one stick was an upgrade. All of the specs match each other and they have been running just fine together for over 2 years so I am certain it is not a compatibility issue.

I can not find a memory.dmp only minidump files.

 

[zbook]

When available post images of HD Tune results for: HGST HTS721010A9E630

See if you can find a digitally signed driver for: ksaud.sys




Open administrative command prompt and type or copy and paste:
chkdsk /r /v
This may take hours to run so plan to run overnight.
Run on all drives using the syntax: chkdsk /r /v C: or chkdsk /r /v D: changing the drive letter to the applicable drive.

C:\Windows\system32>chkdsk /r /v
The type of the file system is NTFS.
Cannot lock current drive.

Chkdsk cannot run because the volume is in use by another
process. Would you like to schedule this volume to be
checked the next time the system restarts? (Y/N)

Type: Y
reboot


Use the information in this link to find the chkdsk report in the event viewer.
Copy and paste into notepad > save to desktop > post into the thread using a one drive, drop box, or google drive share link:
Read Chkdsk Log in Event Viewer in Windows 10 Windows 10 Performance Maintenance Tutorials
Read Chkdsk Log in Event Viewer in Windows 10

Name    Sound Blaster X-Fi Surround 5.1 Pro

Manufacturer    Creative Technology Ltd.

Status    OK

PNP Device ID    USB\VID_041E&PID_3237&MI_00\8&268365CD&0&0000

Driver    C:\WINDOWS\SYSTEM32\DRIVERS\KSAUD.SYS (6.1.3.2620, 2.01 MB (2,107,392 bytes), 21-Mar-18 19:44)

ksaud    Creative USB Audio Driver    c:\windows\system32\drivers\ksaud.sys    Kernel Driver    Yes    Manual    Running    OK    Normal    No    Yes

Sound Tab 2: The file ksaud.sys is not digitally signed, which means that it has not been tested by Microsoft's Windows Hardware Quality Labs (WHQL).  You may be able to get a WHQL logo'd driver from the hardware manufacturer.
Sound Tab 3: The file ksaud.sys is not digitally signed, which means that it has not been tested by Microsoft's Windows Hardware Quality Labs (WHQL).  You may be able to get a WHQL logo'd driver from the hardware manufacturer.

ksaud.sys

Creative Technology Sound Blaster USB Audio

Creative Worldwide Support

Event[312]:
  Log Name: System
  Source: Ntfs
  Date: 2020-10-27T18:45:12.3690000Z
  Event ID: 137
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: LAPTOP-VOS95PCS
  Description:
The default transaction resource manager on volume D: encountered a non-retryable error and could not start.  The data contains the error code.

Event[9]:
  Log Name: System
  Source: Microsoft-Windows-WER-SystemErrorReporting
  Date: 2020-10-28T20:10:53.4690000Z
  Event ID: 1018
  Task: N/A
  Level: Information
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: LAPTOP-VOS95PCS
  Description:
The dump file at location: C:\WINDOWS\MEMORY.DMP was deleted because the disk volume had less than 25 GB free space.

 

[x BlueRobot]

The only reason the drive is so full at the moment is from a backup that was performed on another drive. It is normally around 80 to 90GB. The BSOD was occurring when the drive was not as full and has been doing this before the last Windows update.

Could you please move the backup to a different drive? As @philc43 mentioned, new dump files aren't being written properly due to the lack of free space. We're not suggesting that the lack of free space is the reason for the crashes.

 

[philc43]

I know the modules have different part numbers since one stick was an upgrade. All of the specs match each other and they have been running just fine together for over 2 years so I am certain it is not a compatibility issue.

I can not find a memory.dmp only minidump files.

I do not believe you need to worry about the different part numbers. Laptops are designed to cope with memory modules that are not matched pairs. zbook is referring to the need for matched pairs when using dual channel memory on desktop motherboards.

My recommendation was to operate your laptop with one module at a time, swapping them after about 2 days (or by when you think a BSOD would normally have occurred) to see if you can identify if one of them is triggering the crashes. Sometimes the memory test diagnostics are just not able to simulate real world testing.

 

[murphy41209]

1. The HD Tune for the D: drive (HGST) was running over night and the system restarted, so I lost the report unless anyone knows of a way to retrieve it.

2. I was able to get the C: drive free space to 25.5GB and I still can not find the MEMORY.DMP in the WINDOWS directory. I searched the entire C: and nothing. I did find another location of a .dmp. This is located at C:\Users\murph\AppData\Local\CrashDumps. It is named RtkNGUI64.exe.13272.

3. The Creative SB driver I originally had was from the Creative website. I downloaded the newest one from them and installed the new driver.

I will try to run the HD Tune again on the D: (HGST).

 

[zbook]

Please run the Sysnative log collector to upload new log files:
Blue Screen of Death (BSOD) Posting Instructions - Windows 10, 8.1, 8, 7 + Vista

Before running HD Tune please place the computer in safe mode ( shift + restart):
Boot into Safe Mode on Windows 10

 

[murphy41209]

Please run the Sysnative log collector to upload new log files:
Blue Screen of Death (BSOD) Posting Instructions - Windows 10, 8.1, 8, 7 + Vista

Before running HD Tune please place the computer in safe mode ( shift + restart):
Boot into Safe Mode on Windows 10

Here are the new log files.

I will run HD Tune in Safe Mode tonight on the D:

Thank you for being patient with me, life gets in the way of fun!

 

[zbook]

Please free up > or = 30 GB free space.

Free up drive space in Windows 10
Free Up Drive Space in Windows 10

After posting the HD Tune results:

Create a new restore point:
Create System Restore Point in Windows 10


Read this link on Windows Driver Verifier (WDV):
Driver Verifier - BSOD related - Windows 10, 8.1, 8, 7 + Vista


If there are no misbehaving drivers identified then test the computer with only one RAM module at a time for several days.

Event[30]:
  Log Name: System
  Source: Microsoft-Windows-WER-SystemErrorReporting
  Date: 2020-11-05T19:57:42.0900000Z
  Event ID: 1018
  Task: N/A
  Level: Information
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: LAPTOP-VOS95PCS
  Description:
The dump file at location: C:\WINDOWS\MEMORY.DMP was deleted because the disk volume had less than 25 GB free space.

Event[218]:
  Log Name: System
  Source: Microsoft-Windows-WER-SystemErrorReporting
  Date: 2020-11-04T14:21:28.8810000Z
  Event ID: 1018
  Task: N/A
  Level: Information
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: LAPTOP-VOS95PCS
  Description:
The dump file at location: C:\WINDOWS\MEMORY.DMP was deleted because the disk volume had less than 25 GB free space.

Event[353]:
  Log Name: System
  Source: Microsoft-Windows-WER-SystemErrorReporting
  Date: 2020-11-03T20:19:45.2400000Z
  Event ID: 1018
  Task: N/A
  Level: Information
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: LAPTOP-VOS95PCS
  Description:
The dump file at location: C:\WINDOWS\MEMORY.DMP was deleted because the disk volume had less than 25 GB free space.

Event[486]:
  Log Name: System
  Source: Microsoft-Windows-WER-SystemErrorReporting
  Date: 2020-11-02T18:26:20.5640000Z
  Event ID: 1018
  Task: N/A
  Level: Information
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: LAPTOP-VOS95PCS
  Description:
The dump file at location: C:\WINDOWS\MEMORY.DMP was deleted because the disk volume had less than 25 GB free space.

Event[629]:
  Log Name: System
  Source: Microsoft-Windows-WER-SystemErrorReporting
  Date: 2020-11-01T21:14:44.8300000Z
  Event ID: 1018
  Task: N/A
  Level: Information
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: LAPTOP-VOS95PCS
  Description:
The dump file at location: C:\WINDOWS\MEMORY.DMP was deleted because the disk volume had less than 25 GB free space.

Event[774]:
  Log Name: System
  Source: Microsoft-Windows-WER-SystemErrorReporting
  Date: 2020-10-31T10:29:17.1710000Z
  Event ID: 1018
  Task: N/A
  Level: Information
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: LAPTOP-VOS95PCS
  Description:
The dump file at location: C:\WINDOWS\MEMORY.DMP was deleted because the disk volume had less than 25 GB free space.

Event[940]:
  Log Name: System
  Source: Microsoft-Windows-WER-SystemErrorReporting
  Date: 2020-10-30T15:17:26.0910000Z
  Event ID: 1018
  Task: N/A
  Level: Information
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: LAPTOP-VOS95PCS
  Description:
The dump file at location: C:\WINDOWS\MEMORY.DMP was deleted because the disk volume had less than 25 GB free space.

Event[1068]:
  Log Name: System
  Source: Microsoft-Windows-WER-SystemErrorReporting
  Date: 2020-10-29T20:57:25.1030000Z
  Event ID: 1018
  Task: N/A
  Level: Information
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: LAPTOP-VOS95PCS
  Description:
The dump file at location: C:\WINDOWS\MEMORY.DMP was deleted because the disk volume had less than 25 GB free space.

Event[1654]:
  Log Name: System
  Source: Microsoft-Windows-WER-SystemErrorReporting
  Date: 2020-10-28T20:10:53.4690000Z
  Event ID: 1018
  Task: N/A
  Level: Information
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: LAPTOP-VOS95PCS
  Description:
The dump file at location: C:\WINDOWS\MEMORY.DMP was deleted because the disk volume had less than 25 GB free space.

  Log Name: System
  Source: Microsoft-Windows-WER-SystemErrorReporting
  Date: 2020-10-27T18:00:21.3620000Z
  Event ID: 1018
  Task: N/A
  Level: Information
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: LAPTOP-VOS95PCS
  Description:
The dump file at location: C:\WINDOWS\MEMORY.DMP was deleted because the disk volume had less than 25 GB free space.