Multiple BSOD Windows 10

j0ker · Jul 23, 2016

When I run perfmon I get a message saying (collecting data for 60 seconds) and it just stays like that

System Specs

CPU:Intel Core i7-4790K @ 4.7GHz 1.250V
Motherboard: Asus Sabertooth z97 Mark 2
Cooler: Corsair h110iGT
RAM: 2x8gb DDR3 G.SKILL TridentX @ 2400MHz 1.65V
GPU: EVGA GeForce GTX 980 Ti Hybrid
PSU: EVGA SuperNOVA 1300 G2
Storage: Samsung 850 EVO 250gb | WD Black 1tb
Sound Card: Sound Blaster Z
Case: Corsair 760t
Display: Asus ROG SWIFT PG278Q | HP Pavilion 22cw
OS: Windows 10 PRO

All hardware is around 6 months old

Any help is greatly appreciated!

satrow · Jul 23, 2016

For reference/completeness, the originating/referring topic is ongoing here: experiencing random crashes | Overclockers Forums

It's out of my league/experience but I'm subbed to both if I can help in any way.

j0ker · Jul 24, 2016

The sfc scan log is showing that opencl.dll is corrupt

satrow · Jul 24, 2016

Aura has a recently updated topic and likely fix for that here: GUIDE: opencl.dll corruption in SFC/DISM, Windows 10 Update 1511 (TH2)

Study it carefully, ensure that any actions suggested/required are actually applicable to your problem before following the fix section.

xilolee · Jul 24, 2016

Hi j0ker. :welcome:

Did you install some software or upgraded your machine hardware recently, in this last month?
Are you using windows firewall?
Did you try to remove avast and use windows defender for few days?

If you have got F3-1866C8D-16GTX (2 banks of 8GB: raminfo.html shows F3-1866C8-8GTX), they are not listed in your motherboard qualified vendors list (I checked only that, I didn't check the compatibility with the specifications)... Hence they weren't tested officially by ASUS, for your motherboard (right?).
Specifications:

Read More:

You could also try to run driver verifier to get more precise informations; please read CAREFULLY the following instructions:

Change the bcdedit bootmenupolicy setting from standard to legacy:
Read More:
From an elevated command prompt, launch:
Code:

bcdedit
Then:
Code:

bcdedit /set bootmenupolicy legacy
Then:
Code:

bcdedit
You should get something like (see bold strings):

c:\>bcdedit
Windows Boot Manager
--------------------
identifier {bootmgr}
device partition=\Device\HarddiskVolume2
path \EFI\Microsoft\Boot\bootmgfw.efi
description Windows Boot Manager
locale it-IT
inherit {globalsettings}
default {current}
resumeobject {5d5a2019-d643-11e4-a71c-9001aae18364}
displayorder {current}
toolsdisplayorder {memdiag}
timeout 30
Windows Boot Loader
-------------------
identifier {current}
device partition=C:
path \WINDOWS\system32\winload.efi
description Windows 10
locale it-IT
inherit {bootloadersettings}
recoverysequence {5d5a201b-d643-11e4-a71c-9001aae18364}
recoveryenabled Yes
isolatedcontext Yes
allowedinmemorysettings 0x15000075
osdevice partition=C:
systemroot \WINDOWS
resumeobject {5d5a2019-d643-11e4-a71c-9001aae18364}
nx OptIn
bootmenupolicy Standard

C:\>bcdedit /set bootmenupolicy legacy
The operation completed successfully.

c:\>bcdedit
Windows Boot Manager
--------------------
identifier {bootmgr}
device partition=\Device\HarddiskVolume2
path \EFI\Microsoft\Boot\bootmgfw.efi
description Windows Boot Manager
locale it-IT
inherit {globalsettings}
default {current}
resumeobject {5d5a2019-d643-11e4-a71c-9001aae18364}
displayorder {current}
toolsdisplayorder {memdiag}
timeout 30
Windows Boot Loader
-------------------
identifier {current}
device partition=C:
path \WINDOWS\system32\winload.efi
description Windows 10
locale it-IT
inherit {bootloadersettings}
recoverysequence {5d5a201b-d643-11e4-a71c-9001aae18364}
recoveryenabled Yes
isolatedcontext Yes
allowedinmemorysettings 0x15000075
osdevice partition=C:
systemroot \WINDOWS
resumeobject {5d5a2019-d643-11e4-a71c-9001aae18364}
nx OptIn
bootmenupolicy Legacy

Click to expand...
Restart your PC and see if you are able to make appear windows advanced boot options (SAFE MODE included!) with the good old F8 key.
Create a restore point
Create a system image
Read the guide about Driver Verifier - BSOD related - Windows 10, 8.1, 8, 7 & Vista (click).
Read some other tutorials/guides and WARNINGS on internet.
Enable verifier
If you'll get a very fast BSOD after you logged into windows, you'll need to go to safe mode to reset verifier settings.
From an elevated command prompt:
Code:
```
verifier /reset
```
Post here the new verifier dump

j0ker · Jul 24, 2016

C:\Windows\system32>verifier /query

Time Stamp: 07/24/2016 16:41:41.502

Verifier Flags: 0x0002892b

Standard Flags:

[X] 0x00000001 Special pool.
[X] 0x00000002 Force IRQL checking.
[X] 0x00000008 Pool tracking.
[ ] 0x00000010 I/O verification.
[X] 0x00000020 Deadlock detection.
[ ] 0x00000080 DMA checking.
[X] 0x00000100 Security checks.
[X] 0x00000800 Miscellaneous checks.
[X] 0x00020000 DDI compliance checking.

Additional Flags:

[ ] 0x00000004 Randomized low resources simulation.
[ ] 0x00000200 Force pending I/O requests.
[ ] 0x00000400 IRP logging.
[ ] 0x00002000 Invariant MDL checking for stack.
[ ] 0x00004000 Invariant MDL checking for driver.
[X] 0x00008000 Power framework delay fuzzing.
[ ] 0x00010000 Port/miniport interface checking.
[ ] 0x00040000 Systematic low resources simulation.
[ ] 0x00080000 DDI compliance checking (additional).
[ ] 0x00200000 NDIS/WIFI verification.
[ ] 0x00800000 Kernel synchronization delay fuzzing.
[ ] 0x01000000 VM switch verification.
[ ] 0x02000000 Code integrity checks.

[X] Indicates flag is enabled.

Verifier Statistics Summary

Raise IRQLs: 308266
Acquire Spin Locks: 391562
Synchronize Executions: 1
Trims: 104258

Pool Allocations Attempted: 285331
Pool Allocations Succeeded: 285331
Pool Allocations Succeeded SpecialPool: 285331
Pool Allocations With No Tag: 0
Pool Allocations Not Tracked: 1
Pool Allocations Failed: 0
Pool Allocations Failed Deliberately: 0

Driver Verification List

MODULE: aswvmm.sys (load: 0 / unload: 0)

MODULE: aswrvrt.sys (load: 0 / unload: 0)

MODULE: aswsp.sys (load: 0 / unload: 0)

MODULE: aswsnx.sys (load: 0 / unload: 0)

MODULE: aswkbd.sys (load: 0 / unload: 0)

MODULE: aswrdr2.sys (load: 0 / unload: 0)

MODULE: ndis.sys (load: 1 / unload: 0)

Pool Allocation Statistics: ( NonPaged / Paged )

Current Pool Allocations: ( 932 / 73 )
Current Pool Bytes: ( 432907 / 13866 )
Peak Pool Allocations: ( 966 / 75 )
Peak Pool Bytes: ( 462107 / 14364 )
Contiguous Memory Bytes: 0
Peak Contiguous Memory Bytes: 0

MODULE: asio.sys (load: 1 / unload: 0)

Pool Allocation Statistics: ( NonPaged / Paged )

Current Pool Allocations: ( 0 / 0 )
Current Pool Bytes: ( 0 / 0 )
Peak Pool Allocations: ( 0 / 0 )
Peak Pool Bytes: ( 0 / 0 )
Contiguous Memory Bytes: 0
Peak Contiguous Memory Bytes: 0

MODULE: teedriverw8x64.sys (load: 1 / unload: 0)

Pool Allocation Statistics: ( NonPaged / Paged )

Current Pool Allocations: ( 2 / 0 )
Current Pool Bytes: ( 7852 / 0 )
Peak Pool Allocations: ( 4 / 0 )
Peak Pool Bytes: ( 8361 / 0 )
Contiguous Memory Bytes: 0
Peak Contiguous Memory Bytes: 0

MODULE: e1i63x64.sys (load: 1 / unload: 0)

Pool Allocation Statistics: ( NonPaged / Paged )

Current Pool Allocations: ( 551 / 0 )
Current Pool Bytes: ( 304506 / 0 )
Peak Pool Allocations: ( 551 / 0 )
Peak Pool Bytes: ( 304506 / 0 )
Contiguous Memory Bytes: 0
Peak Contiguous Memory Bytes: 0

MODULE: cthdb.sys (load: 1 / unload: 0)

Pool Allocation Statistics: ( NonPaged / Paged )

Current Pool Allocations: ( 5 / 0 )
Current Pool Bytes: ( 528 / 0 )
Peak Pool Allocations: ( 5 / 1 )
Peak Pool Bytes: ( 528 / 292 )
Contiguous Memory Bytes: 0
Peak Contiguous Memory Bytes: 0

MODULE: corsairvbusdriver.sys (load: 1 / unload: 0)

Pool Allocation Statistics: ( NonPaged / Paged )

Current Pool Allocations: ( 7 / 3 )
Current Pool Bytes: ( 232 / 443 )
Peak Pool Allocations: ( 7 / 5 )
Peak Pool Bytes: ( 232 / 459 )
Contiguous Memory Bytes: 0
Peak Contiguous Memory Bytes: 0

MODULE: cthda.sys (load: 1 / unload: 0)

Pool Allocation Statistics: ( NonPaged / Paged )

Current Pool Allocations: ( 110 / 0 )
Current Pool Bytes: ( 29664 / 0 )
Peak Pool Allocations: ( 110 / 3 )
Peak Pool Bytes: ( 29664 / 8272 )
Contiguous Memory Bytes: 0
Peak Contiguous Memory Bytes: 0

MODULE: dump_diskdump.sys (load: 0 / unload: 0)

MODULE: dump_storahci.sys (load: 2 / unload: 1)

Pool Allocation Statistics: ( NonPaged / Paged )

Current Pool Allocations: ( 0 / 0 )
Current Pool Bytes: ( 0 / 0 )
Peak Pool Allocations: ( 0 / 0 )
Peak Pool Bytes: ( 0 / 0 )
Contiguous Memory Bytes: 0
Peak Contiguous Memory Bytes: 0

MODULE: dump_dumpfve.sys (load: 2 / unload: 1)

Pool Allocation Statistics: ( NonPaged / Paged )

Current Pool Allocations: ( 1 / 0 )
Current Pool Bytes: ( 16400 / 0 )
Peak Pool Allocations: ( 1 / 0 )
Peak Pool Bytes: ( 16400 / 0 )
Contiguous Memory Bytes: 65536
Peak Contiguous Memory Bytes: 65536

MODULE: ksusbaud.sys (load: 1 / unload: 0)

Pool Allocation Statistics: ( NonPaged / Paged )

Current Pool Allocations: ( 273 / 8 )
Current Pool Bytes: ( 496168 / 3952 )
Peak Pool Allocations: ( 299 / 8 )
Peak Pool Bytes: ( 863894 / 3952 )
Contiguous Memory Bytes: 0
Peak Contiguous Memory Bytes: 0

MODULE: aswmonflt.sys (load: 0 / unload: 0)

MODULE: aswhwid.sys (load: 0 / unload: 0)

MODULE: cpuz139_x64.sys (load: 1 / unload: 0)

Pool Allocation Statistics: ( NonPaged / Paged )

Current Pool Allocations: ( 0 / 0 )
Current Pool Bytes: ( 0 / 0 )
Peak Pool Allocations: ( 0 / 1 )
Peak Pool Bytes: ( 0 / 34 )
Contiguous Memory Bytes: 0
Peak Contiguous Memory Bytes: 0

MODULE: corsairvhiddriver.sys (load: 1 / unload: 1)

j0ker · Jul 24, 2016

No hardware has been changed recently, I am using a firewall, and I deleted avast yesterday. I haven't had a BSOD since I started this thread

xilolee · Jul 24, 2016

Hence are you using WinDefender now?
I'm not sure of why you posted verifier /query...
Did you enable it?

j0ker · Jul 24, 2016

xilolee said:
Hence are you using WinDefender now?
I'm not sure of why you posted verifier /query...
Did you enable it?

Yes, windows defender is on now.
I don't know, I thought I was supposed to post it here

But yes it is enabled

xilolee · Jul 25, 2016

Ok, let's wait the new dump (if it will come).

j0ker · Jul 25, 2016

xilolee said:
Ok, let's wait the new dump (if it will come).

axe0 · Jul 25, 2016

Please check Windows Update, in the settings, for updates and let all available updates install. Suggesting this because the file that shows how many updates (hotfixes) are installed is missing.

Unfortunately no new crash has been caused by driver verifier where it seems driver verifier has been resetted?

Code:

Verify Flags Level 0x00000000

  STANDARD FLAGS:
    [X] (0x00000000) Automatic Checks
    [ ] (0x00000001) Special pool
    [ ] (0x00000002) Force IRQL checking
    [ ] (0x00000008) Pool tracking
    [ ] (0x00000010) I/O verification
    [ ] (0x00000020) Deadlock detection
    [ ] (0x00000080) DMA checking
    [ ] (0x00000100) Security checks
    [ ] (0x00000800) Miscellaneous checks
    [ ] (0x00020000) DDI compliance checking


  ADDITIONAL FLAGS:
    [ ] (0x00000004) Randomized low resources simulation
    [ ] (0x00000200) Force pending I/O requests
    [ ] (0x00000400) IRP logging
    [ ] (0x00002000) Invariant MDL checking for stack
    [ ] (0x00004000) Invariant MDL checking for driver
    [ ] (0x00008000) Power framework delay fuzzing
    [ ] (0x00010000) Port/miniport interface checking
    [ ] (0x00040000) Systematic low resources simulation
    [ ] (0x00080000) DDI compliance checking (additional)
    [ ] (0x00200000) NDIS/WIFI verification
    [ ] (0x00800000) Kernel synchronization delay fuzzing
    [ ] (0x01000000) VM switch verification
    [ ] (0x02000000) Code integrity checks


    [X] Indicates flag is enabled

j0ker · Jul 25, 2016

That's annoying, I'll re-enable it. So I've noticed it'll crash as soon as I log in, and if it doesn't crash at log in then it doesn't again until I shutdown

axe0 · Jul 25, 2016

IME multiple different BSODs have usually multiple causes where I find some causes sometimes difficult to find.

Do you have USB devices attached besides mouse & keyboard?

j0ker · Jul 25, 2016

Xbox one controller and a headset

axe0 · Jul 25, 2016

Are they attached when you boot and/or shutdown? If so, please remove them.

j0ker · Jul 25, 2016

axe0 said:
Are they attached when you boot and/or shutdown? If so, please remove them.

done

xilolee · Jul 26, 2016

Try to run this coìmmand from an elevated command prompt:

verifier /all /flags 0x2892B /bootmode resetonbootfail

Reboot and wait the new bsod (it will check all drivers, instead of non-MS only).

axe0 · Jul 26, 2016

xilolee said:
Try to run this coìmmand from an elevated command prompt:

verifier /all /flags 0x2892B /bootmode resetonbootfail

Click to expand...

Reboot and wait the new bsod (it will check all drivers, instead of non-MS only).

That may cause problems, and false positives.

xilolee · Jul 26, 2016

I don't know if this can speedup or complicate things, but let's see (if this experiment will be good :smile9: ).

Danger

This was tested only on Windows 10 home x64

To enable verifier settings like written in Jcgriff's thread, using only third party drivers (hence excluding microsoft drivers):

download nirsoft driverview and decompress its folder (leaving its default name) on your desktop, i.e. on the desktop there should be the driverview folder (with its files in it):
- http://www.nirsoft.net/utils/driverview-x64.zip (for 64bit versions)
- http://www.nirsoft.net/utils/driverview.zip (for 32bit versions)
open notepad, copy the following text and save the file on your desktop as EnableVerifier.ps1:

Note:

Code for 64bit windows versions

Read More:

$extdrivers="c:\users\$env:username\desktop\extdrivers.txt"
$extdrivers2="c:\users\$env:username\desktop\extdrivers2.txt"
$tempfile="c:\users\$env:username\desktop\temp.txt"
$output="c:\users\$env:username\desktop\Non-ms-drivers.txt"
$command = {c:\windows\system32\cmd.exe /c C:\Users\%username%\Desktop\driverview-x64\driverview.exe /sort 1 /stext c:\users\%username%\desktop\extdrivers.txt}
Invoke-Command -scriptblock $command
type $extdrivers | find /i "driver name" | out-file $extdrivers2
$drivers = Get-Content $extdrivers2
FOR ($i=1; $i -lt $drivers.Length; $i++) {
NV -Name "linea$i"
SV -name "linea$i" -value ($drivers.GetValue($i))
$tmp = GV -name linea$i -valueonly
$tmp = ( $tmp.TrimStart("Driver Name : ") + " , " )
$tmp | out-file $tempfile -append
RV -Name "linea$i"
}
$tmp = get-content $tempfile | sort
$tmp = $tmp -join ""
$tmp = $tmp.TrimEnd(" , ")
$tmp | out-file $output
verifier /flags 0x2892B /bootmode resetonbootfail /driver $tmpdel $tmp
del $output, $extdrivers, $tempfile
rv tmp, tempfile, output, i, extdrivers2, drivers

Note:

Code for 32bit windows versions

Read More:

$extdrivers="c:\users\$env:username\desktop\extdrivers.txt"
$extdrivers2="c:\users\$env:username\desktop\extdrivers2.txt"
$tempfile="c:\users\$env:username\desktop\temp.txt"
$output="c:\users\$env:username\desktop\Non-ms-drivers.txt"
$command = {c:\windows\system32\cmd.exe /c C:\Users\%username%\Desktop\driverview\driverview.exe /sort 1 /stext c:\users\%username%\desktop\extdrivers.txt}
Invoke-Command -scriptblock $command
type $extdrivers | find /i "driver name" | out-file $extdrivers2
$drivers = Get-Content $extdrivers2
FOR ($i=1; $i -lt $drivers.Length; $i++) {
NV -Name "linea$i"
SV -name "linea$i" -value ($drivers.GetValue($i))
$tmp = GV -name linea$i -valueonly
$tmp = ( $tmp.TrimStart("Driver Name : ") + " , " )
$tmp | out-file $tempfile -append
RV -Name "linea$i"
}
$tmp = get-content $tempfile | sort
$tmp = $tmp -join ""
$tmp = $tmp.TrimEnd(" , ")
$tmp | out-file $output
verifier /flags 0x2892B /bootmode resetonbootfail /driver $tmpdel $tmp
del $output, $extdrivers, $tempfile
rv tmp, tempfile, output, i, extdrivers2, drivers
From an elevated command prompt, run:

powershell -executionpolicy unrestricted "c:\users\%username%\desktop\EnableVerifier.ps1"

Click to expand...
It should appear something like:

Read More:

C:\>powershell -executionpolicy unrestricted "c:\users\%username%\desktop\EnableVerifier.ps1"

Verifier Flags: 0x0002892b

Standard Flags:

[X] 0x00000001 Special pool.
[X] 0x00000002 Force IRQL checking.
[X] 0x00000008 Pool tracking.
[ ] 0x00000010 I/O verification.
[X] 0x00000020 Deadlock detection.
[ ] 0x00000080 DMA checking.
[X] 0x00000100 Security checks.
[X] 0x00000800 Miscellaneous checks.
[X] 0x00020000 DDI compliance checking.

Additional Flags:

[ ] 0x00000004 Randomized low resources simulation.
[ ] 0x00000200 Force pending I/O requests.
[ ] 0x00000400 IRP logging.
[ ] 0x00002000 Invariant MDL checking for stack.
[ ] 0x00004000 Invariant MDL checking for driver.
[X] 0x00008000 Power framework delay fuzzing.
[ ] 0x00010000 Port/miniport interface checking.
[ ] 0x00040000 Systematic low resources simulation.
[ ] 0x00080000 DDI compliance checking (additional).
[ ] 0x00200000 NDIS/WIFI verification.
[ ] 0x00800000 Kernel synchronization delay fuzzing.
[ ] 0x01000000 VM switch verification.
[ ] 0x02000000 Code integrity checks.

[X] Indicates flag is enabled.

Boot Mode:

Resetonbootfail

Rules:

All rules are using default settings

Extensions:

wdm: rules.default

Verified Drivers:

More data is available.

The system reboot is required for the changes to take effect.

Multiple BSOD Windows 10

Member

Attachments

Moderator

Member

Moderator

Moderator

Member

Member

Moderator

Member

Moderator

Member

Attachments

Administrator, BSOD Academy Instructor, Security Analyst

Member

Administrator, BSOD Academy Instructor, Security Analyst

Member

Administrator, BSOD Academy Instructor, Security Analyst

Member

Attachments

Moderator

Administrator, BSOD Academy Instructor, Security Analyst

Moderator

Administrator,
BSOD Academy Instructor,
Security Analyst

Administrator,
BSOD Academy Instructor,
Security Analyst

Administrator,
BSOD Academy Instructor,
Security Analyst

Administrator,
BSOD Academy Instructor,
Security Analyst