[SOLVED] Multiple BSODs over last few days

[amfte]

Hello amazing people of the forum,

So I have been having many BSODs over the last few days and honestly I am quite baffled to why that would be, I have reinstalled windows 11 yesterday night in hopes to fix it but it did not make any difference. I had similar issues when I first got the system and I did something and it was working fine for about 8 months now started again

The BSODs are random, two days ago it was every 15 to 30 mins, i left pc running all night two days, no BSOD, but since I started to use PC since yesterday morning, more BSODs, at random intervals, no BSOD for 3 hours and then started again every hour or so. None today (yet) as of 28.10. I do notice that BSOD are occurring more during evenings and night.

Common one's i see are as follow

• critical_process_died
• unexpected_store_exception
• system_service_exception

Below are my pc spec from Speccy. Its a Lenovo Legion Desktop, Its about 10 months old, Origianl OS was windows 10. I dont use VPNs (have before but not often, none atm)

• 11th Gen Intel(R) Core(TM) i9-11900KF @ 3.50GHz. I never tweaked CPU since I received the PC
• 1x 16 GB DDR4-3200
• 1x NVIDIA®GeForce RTX™3080Ti 12GB
• LENOVO 374F Motherboard
• Further details below

http://speccy.piriform.com/results/5OjBCtsmaYJyIOqXucHENrO

• I have done SFC Scan and it says no issues

• Same with Memory diagnostics report

• Here is the reliability and problem history since re-setting my PC

• And here is my Event viewer since re-setting my PC

• No malware issues as well, according to Norton Smart scan

Any insight into why this is happening would be really useful!

 

[ubuysa]

Hello and welcome to the forum!

I can see from the Speccy output that you have TWO real-time antivirus engines running. That's known to cause all sorts of problems...

Antivirus
    Windows Defender
        Antivirus:  Disabled        
        Virus Signature Database: Up to date
    Norton 360 Premier      
        Antivirus: Enabled
        Virus Signature Database: Up to date
   McAfee VirusScan      
       Antivirus: Enabled
       Virus Signature Database: Up to date

You need to pick one of either Norton or McAffe and uninstall the other - be SURE to use the specialised uninstall tool for whichever one you uninstall (Norton, McAfee). If you take my advice, you should uninstall both because you don't need either. Windows Firewall and Windows Defender are all you need.

There are no dumps in your upload, but if you've reinstalled since you were having these BSODs then they have been lost. There is no evidence of a BSOD in your System log - but it covers only 12 minutes of time. What there is in your system log is a VERY large number of warning messages for a recovered hardware failure...

Event[12214]
  Log Name: System
  Source: Microsoft-Windows-WHEA-Logger
  Date: 2023-10-27T22:17:58.8270000Z
  Event ID: 17
  Task: N/A
  Level: Warning
  Opcode: Info  g
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: DESKTOP-BFTMMK5
  Description:
A corrected hardware error has occurred.

Component: PCI Express Root Port
Error Source: Advanced Error Reporting (PCI Express)

Primary Bus:Device:Function: 0x0:0x6:0x0
Secondary Bus:Device:Function: 0x0:0x0:0x0
Primary Device Name:PCI\VEN_8086&DEV_4C09&SUBSYS_72708086&REV_01
Secondary Device Name:

The device in question is indicated by the VEN_8086&DEV_4C09 identifiers and that resolves to be an Intel chipset device.

When you installed/reinstalled Windows 11 from where did you source all the drivers? Did you for example, run Windows Update (across reboots) until no more updates were found? Have you since checked in the 'View optional updates' link for any driver updates? Did you download the drivers from the Lenovo download site for your model of PC? Or did you use a third-party driver installation tool?

These System log errors would suggest that you either do not have the correct chipset drivers installed or there may be a problem with your motherboard.

In addition, I note that there is a BIOS update available for your PC from the Lenovo download site, it's dated 5th July 2023 and it's marked as 'recommended'. You should probably update your aged BIOS to this version.

 

[amfte]

Wow thank you for quick response, You are AWESOME

• I basically reset pc in settings app, Kept my files, Chose cloud download. I always make sure im on the latest version on windows, even the optional updates. even before my system was up to date.
• My system is not able to create the Minidumps, Ive been trying to get them but there never is a dump file after BSOD
• I have actually deleted McAfee after I did the Speccy test. So currently I only have Norton running.

Just few hours I got Memory_Management BSOD.

I don't know how I completed missed to check BIOS update , but I just updated BIOS. Latest version is 16/6/2023 but mine was some version in 2021 I think. Since the update no BSOD as occurred so far. I will keep monitoring the situation

Like you mentioned there are about 12.5k WHEA-logger messages, seems like they all say the same (PCI\VEN_8086&DEV_4C09&SUBSYS_72708086&REV_01). My intel chipset drives seem to be up to date according to Intel driver and support assistant. and Intel Processor Diagnostic tool say everything is good. Even after BIOS update I still get those warnings




So i have not clue to what the message means. I Think I did find the driver in the Device manager. It is Intel(R) PEG60 -4C09. I tried to update the drivers but it says everything is good.



Does this give any insight into the issues??

 

[ubuysa]

Ah. A couple of observations then.

1. A Windows Rest is NOT a reinstall, whether you use local reset or cloud reset. All that does is refresh the Windows libraries, the third-party drivers (which is where 99% of the problems lie) are reused as is. A Windows Reset is ABSOLUTELY USELESS as a troubleshooting tool, simply because it doesn't touch the drivers. If you want to do a reinstall to get a completely clean OS so you can start again then you must do a clean install from bootable media and delete existing UEFI partitions during the install. You will of course then lose all existing user data on the system drive and all third-party apps.

2. In order to create BSOD dumps ALL of the following must be true...

• The page file must be on the same drive as your operating system
• Set page file to "system managed"
• Set system crash/recovery options to "Automatic memory dump"
• Windows Error Reporting (WER) system service should be set to MANUAL
• User account control must be running

In addition...

• Sometimes SSD drives with older firmware do not create dumps (update firmware)
• Cleaner applications like Ccleaner delete dump files, so don't run them until you are fixed
• Bad RAM may prevent the data from being saved and written to a file on reboot, so if all else fails test your RAM

Let's see how it goes with the updates BIOS though.

 

[amfte]

Hello Again,

I had three BSODs today. My Bios is at the latest version. so looks like BIOS update did nothing?? I ran Windows memory diagnostics test and it says everything is fine. I am also trying to do memtest with no success, still trying to figure out how to do it.

All my BSOD dumps are according to true to your list.

I started to use Fortect in hopes of resolving issues and that seems to be interfering with Minidump file creation, I dont know how. I just uninstalled Fortect

I received Driver_Power_State_failure BSOD while doing SSD Drive update and it now created a file. does this file provide any insight?? I will and more files to the thread if I keep getting BSOD and files are created. I attached a file using BlueScreenView

 

[ubuysa]

Please run the Sysnative file collection app again, we need to see all the troubleshooting data. Then please also upload the file C:\Windows\Memory.dmp, that's the full kernel dump and we'll need it to debug that particular BSOD.

 

[amfte]

I ran the app again and attached the file and also dumpfile, this dumpfile is actually few hours old, since then my pc had 3 more BSODs but Minidumps were not created, Im looking into it but I have no idea when it did not. create

 

[ubuysa]

You didn't upload the file C:\Windows\Memory.dmp, so please do so - but ONLY if you've had no further BSODs since the one on Sunday 29th Oct at 16:16 UTC. It will be large (around 1.5GB).

What 'SSD drive update' were you trying to do when that BSOD occurred? I note in the mindump that the Intel RST driver (iaStorAC.sys) is old, dating from Jan 2021. This can be a troublesome driver and may have had an impact on whatever it was you were trying to do with your SSD. In any case, this driver needs updating and the easiest way to do that is to download the Intel Driver &Support Assistant, run that and install any drivers that it finds. Do this first before you move on.

PLEASE do not ever use tune-up tools like Fortect, they are little more than snake oil and they can make things worse. In addition, when you asking for help on a forum like this PLEASE don't do anything that we don't ask you to do. If you're changing things that we don't know about it makes troubleshooting very difficult.

You didn't answer an earlier question about where you sourced the drivers? Have you used a third-party driver search and install tool?


I'm still seeing lots and lots of error messages for a recovered hardware problem relating to a chipset device, in this case the PCIe root port.

Event[0]
  Log Name: System
  Source: Microsoft-Windows-WHEA-Logger
  Date: 2023-10-29T19:59:47.5880000Z
  Event ID: 17
  Task: N/A
  Level: Warning
  Opcode: Info  g
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: DESKTOP-BFTMMK5
  Description:
A corrected hardware error has occurred.

Component: PCI Express Root Port
Error Source: Advanced Error Reporting (PCI Express)

Primary Bus:Device:Function: 0x0:0x6:0x0
Secondary Bus:Device:Function: 0x0:0x0:0x0
Primary Device Name:PCI\VEN_8086&DEV_4C09&SUBSYS_72708086&REV_01
Secondary Device Name:

It's clear that your system is far from being in an ideal state and would seem to be missing some key drivers - or has the wrong ones installed.

What I'd like you to do now, as a test, is to start Windows in Safe Mode. This is a stripped-down Windows system with (typically) no third-party drivers loaded. In this stripped-down state you WILL NOT be able to do any useful work. Many of your devices will not function properly (or at all), your display will be very low-res for example, because their third-party drivers are not loaded. The key point about running in Safe Mode is to see whether the system is stable. If it fails in Safe Mode you almost certainly have a hardware problem.

Try starting in Safe Mode without Networking at first, you will be very limited in what you can do with the PC but do try and use it as much as you can. Also let it sit idle for some time in this mode. The objective here is to see whether it will fail, so persevere and do try and use it for a couple of hours.

If it's ok in that mode then restart into Safe Mode with Networking. Here you will have Internet access so the range of things you can test the PC with will be much greater. Again persevere for a couple of hours at least and see whether you can make it fail.

Running in Safe Mode is no fun. It's very boring, but it is an essential test so please give it time and persevere.

 

[amfte]

Ok here the list of things I did and didn't do.

1. I used Fortect before I reached out to the forum. but haven't used it since
2. Regarding Dumpfiles settings, The Dump life was created in C:Windows(c:)>Windows. There was the MEMORY.DMP File, I couldn't upload it directly so I zipfile it to upload. Turns out its related to administrator rights, but yea I had more BSODs since then so I will not upload the old dump file
3. My File is on the same drive as my os I think %SystemRoot%\MEMORY.DMP. I assume this mean it is on the same drive. I never changed it
4. It is on Automatic memory dump, I never changed this. I only unticked automatically start since I was not able to get hold the error message quick enough on BSOD screen
5. IM not sure what it means by system managed but I did some digging and and found some settings, and I think it is set as you mentioned. I never changed it
   
   
   
   
6. In services application, windows error reporting service status is running and Startup type is Manual (trigger start). I right click and pressed start since the status was empty. I didnt change other settings
   
7. I'm not sure what you mean by this but in user account control settings, it was set to default, and I changed it to always notify me
   
8. I used the intel driver and support assistant and it says everything is up to date.
9. But then I was using Lenovo website to install any available drivers, since I have lenovo system For the "SSD Drive Update" I was doing. I found Intel RST Driver for windows and I thought I needed to update that as well so I tried to do it and thats when I got BSOD and a minidump file was created. I have not tried to do it again.
   
10. I never used any third party sites to download drivers, I always use Lenovo and Intel sites and tools to do so. I also use Nvidia Geforce experience to download game ready drivers since they help the games I play have better optimization.

Ok now I will run the PC in safe mode with and with out networking and update you.

Thank you!

 

[amfte]

So here is an update,

• Safe mode without networking moderate use about 3 hours, just opened documents, apps that I can open in safe mode - No BSOD
• Safe mode Idle for about 3 hours - No BSOD
• Safe mode with networking and using internet for about 3 hours of use - No BSOD
• Safe mode with networking and left pc running all night with chrome opened and some twitch stream open and couple of tabs - No BSOD
• Started normal boot this morning with all the applications I use daily - BSOD 1 hour into use

Did not change any settings during this process, So I guess we can eliminate hardware issue? still having issue with Minidumps, it was not created this morning either after BSOD. Below is the same message I get every time when there is a crash.

 

[ubuysa]

Excellent troubleshooting, thank you. Not everyone has the patience to run Safe Mode that long. This is good news though, it means that your BSODs are unlikely to be due to failing hardware.

Now what I'd like you to try is a clean boot of Windows. The difference with Safe Mode is that in a clean boot you'll be loading the full Windows system and all Windows drivers, but we'll deliberately not be loading any third-party drivers by manually deselecting them all in msconfig and by preventing third-party apps from auto-starting (but do make a note of which ones were enabled to start with!). What will boot will be your full Windows system and nothing else.

Now test the system again as you did earlier, again we're trying to make it BSOD, so please give it plenty of time, and a couple of hours at least. Be aware that some devices may not work properly (or at all) because their third-party drivers are not loaded, and some features may not work because the apps didn't auto-start. Do your best to test it in this state and do try and make it BSOD.

Once you're certain that it's not BSODing in this clean state we're going to clean boot again, but now gradually enable some of the third party drivers. Leave all of the auto-start apps disabled until we've tested with all the drivers. You can speed this testing up by using a 'boolean sort'; when you enable third-party drivers just enable (check) half of them and restart. If it BSODs then the problem driver is in the half you enabled, but if it doesn't BSOD (after a couple of hours of testing) then you know that all those drivers are good.

Now, if it didn't BSOD then enable half of the remaining third-party drivers and restart. But if it did BSOD then disable half of the drivers you enabled and restart.

I hope you can see that by halving the number of suspect drivers each time you can quickly home in on the flaky one. This 'boolean sort' is a handy technique that you can apply to many things, even outside of computing!

Finally, if it doesn't BSOD with all third-party drivers enabled (and a couple of hours of testing) then use a boolean sort on the auto-start apps to find the one that makes it BSOD.

Regarding the Intel Rapid Storage Technology driver, it is really only needed if you run your drives in a RAID configuration - and you don't. I would suggest you're best option is to uninstall it completely. This is not a difficult process, here are full directions from Microsoft on how to do that. Although these directions don't explicitly reference Windows 11 the process is the same.

 

[amfte]

Alright so here are the results, did the steps you told me to do, basically tested for the last two days, did the boolean sort method of testing

• There was no BSOD during clean boot third party apps enabled
• There was only 1 BSOD during clean boot with some of the third party apps enabled at launch, tho, I tried to replicate it and it did not BSOD since. It was more like screen blacked out and my PC restarted
• There seems to be BSOD only when all the third party apps are enabled and it's a normal boot with all services enabled, there were 2 BSODs today, few hours apart
• So basically I am not able to find a pattern here or what apps are causing the BSOD, because there were so few BSODs during testing I can't say for sure where the issue is.

with normal boot and all services enabled, there are few BSODs today, I didn't download any drivers or updates.

Here is the list of errors, not sure how much they help but maybe they give some insight. There is still large number or warnings for WHEA-logger

 

[ubuysa]

Does it BSOD if you do a normal boot (ie. with all drivers enabled) but keep all third-party apps that load at startup disabled?

Can you please export and upload your System and Application logs....

1. Enter the command eventvwr into the Run command box. The Event Viewer will open.
2. Locate the Windows Logs folder in the left hand pane and expand it by clicking on the arrow (>) to the left of it.
3. Right-click on the Application entry and select 'Save all events as...'. Choose a folder anywhere that suits you and a filename of 'Application' (an .evtx suffix will be added automatically).
4. Right-click on the System entry and select 'Save all events as...'. Choose a folder anywhere that suits you and a filename of 'System' (an .evtx suffix will be added automatically).
5. Upload the Application.evtx and System.evtx files to the cloud with a link to them here (be sure to make them public).

 

[amfte]

It has not BSOD so far in normal boot and all third party apps disabled a launch. I tested it about 3 hours.

Here are the files
BSOD Issue Event Logs

 

[ubuysa]

If you can bear it, please keep those auto-start apps disabled for now.

You're quite correct that we're still seeing corrected hardware errors for the PCIe root port in the logs...

Log Name:      System
Source:        Microsoft-Windows-WHEA-Logger
Date:          02/11/2023 23:29:43
Event ID:      17
Task Category: None
Level:         Warning
Keywords:      
User:          LOCAL SERVICE
Computer:      DESKTOP-BFTMMK5
Description:
A corrected hardware error has occurred.

Component: PCI Express Root Port
Error Source: Advanced Error Reporting (PCI Express)

Primary Bus:Device:Function: 0x0:0x6:0x0
Secondary Bus:Device:Function: 0x0:0x0:0x0
Primary Device Name:PCI\VEN_8086&DEV_4C09&SUBSYS_72708086&REV_01
Secondary Device Name:

This could be a motherboard problem but it's more likely to be a bad or missing driver.

First I'd like you to open Device Manager and post a screenshot of the Device Manager display. I want to check that all devices have drivers installed.

Next, please download the Intel Driver and Support Assistant and run that to find any Intel driver updates. Install any updates that it finds.

Thirdly, did you uninstall the Intel Rapid Storage Technology driver as I suggested in post #11? If not, please do so.

I note from the logs that you have Norton Security installed. Do you have any other security products installed as well?

 

[amfte]

All the start up apps are disabled now, there were not BSODs today

• Here is a short video link regarding all devices in device manger. It also shows hidden devices as well Drive Manager devices
• I have the Intel driver and support assistant, it says all my drivers are up to date.
• I did try to uninstall it, I followed the advice from the link and I think according to it I should good, but in Driverview I do see iaStorAVC driver. This driver was not mentioned in help link
• I don't have any other security systems installed, Only Norton, I uninstalled Mcafee at the start of our conversation.

 

[ubuysa]

Regarding isStorAVC.sys, in Device Manager right-click on Storage Controllers > Intel Chipset SATA RAID Controller and select Properties. Click on the Driver tab and then click the Driver Details button. Post a screenshot of that.

Can you also open Task Manager and click the Startup tab. Post a screenshot (or several) of ALL the entries in there (which should all be disabled of course).

It certainly seems that all your drivers are good, since you've not had a BSOD for some time now. That would suggest that the problem is one of the apps that auto-starts - and my money will be on Norton - but I'd like to see what they all are first.

 

[amfte]

So speak of the devil, my just had BSOD Critical_Process_Died

All my startup apps are disabled. I do have norton running.


I do notice a "program" app and when I followed the path, Its just an empty folder for microsoft office, I deleted MS Office apps before I came to this forum. Not sure if this would cause any BSOD issue.

 

[ubuysa]

Oh, that's unfortunate, and you'd done such splendid troubleshooting too!

Sadly, the CRITICAL_PROCESS_DIED (and the UNEXPECTED_STORE_EXCEPTION you mentioned in your OP) is highly indicative of a RAM issue. Given the rarity of these BSODs it would seem that it's probably a single bit error that you don't notice until something uses that page of RAM. If that's the case it's going to take some determined troubleshooting to find it.

I know you've run the Windows Memory Diagnostic but that's not very thorough, it detects only very obvious RAM issues. By far the best way to test RAM is to remove one stick, but since you only have one stick you can't do that.

I'm going to ask you to run the best RAM tester we know of, but you have to run it from a bootable USB drive so first get hold of a spare USB drive, it doesn't have to be large 1GB will be plenty. Then do the following...

1. Download Memtest86 (free). This only runs 4 iterations of the 13 different RAM tests so you will be restarting it a couple of times.
2. Use the imageUSB.exe tool extracted from the download to make a bootable USB drive containing Memtest86. Do this on a different PC if you can, because you can't fully trust yours at the moment.
3. Then, on your PC, boot that USB drive, Memtest86 will start running as soon as it boots.
4. If no errors have been found after the four iterations of the 13 different tests then immediately restart Memtest86, and do another four iterations.
5. If it's still not finding errors then restart Memtest86 a further two times, so that you have done a total of 16 iterations of the tests, one after the other (that's important, don't leave a gap between restarts of Memtest86).

As soon as Memtest86 reports even a single bit error you can stop, and your problem will be faulty RAM. Do note however that no memory tester can ever find 100% of RAM problems (which is why removing a stick is the best test) but the more iterations you do, one after the other so that the RAM is kept stressed, the more likely the test is to find an error.

BTW. The ONENOTEM.exe program is part of the Microsoft OneNote product and it's fine.

 

[amfte]

I am not able to get memtest86 working so far, My usb does not show up in First boot device list, and the usb mentioned in the pictures dont do any thing, would you happen to know whyy??