Various frequent BSODs persisting after fresh windows install

U

UnknownKaos

Member
Joined
Jan 24, 2024
Posts
7
Hello,

Recently my PC started getting BSODs of varying types, which was preceeded by apps (browser, games) crashing to desktop for a few days before the actual PC crashes.

Steps I have tried so far:

Reformatting SSDs and doing a clean install of windows. Attempting to do a Windows update afterwards resulted in numerous failures and BSODs before all updates downloaded and installed.
Updating chipset drivers and Nvidia drivers.
sfc /scannow found corrupt files and fixed them, no changes.
Memtest86x and windows memory diagnostic both came up with no errors.
Driver verifier repeatedly crashed on startup, with the minidump pointing at amdgpio3.sys as the culprit. Uninstalled and deleted the driver, then reinstalled it. Same results with driver verifier.
When I run driver verifier without amdgpio3 it will boot up normally, but lead to other BSODs without driver verifier related codes.

Speccy link: http://speccy.piriform.com/results/M3UwJPaIq4CXwybiKphE6ns

It's a desktop running Windows 10 x64. Built from parts, put together at PC supply and repair store. Hardware is all roughly 5-6 years old. Other than Windows Defender only MalwareBytes is installed.
System Manufacturer: Micro-Star International
CPU: AMD Ryzen 5 3600 6-Core Processor 3.60 GHz
Motherboard: B540 Tomahawk Max
Video Card: 4095MB NVIDIA GeForce GTX 1650
RAM: 2x Corsair DDR4 8GB 2666MHz in the DIMMA2 slots
Power Supply: Thermaltake Smart Pro RGB850W
No proxy or vpn software, no Disk Image tools.
I believe there are options to overclock but I have never used them.

Had around 5 BSODs trying to get the necessary information and actually make this post.

I appreciate any help.

Thanks
 
When you perform a clean reinstall of Windows and then get BSODs almost immediately afterwards you can be pretty sure that you're looking at a hardware problem. In addition, looking at the five dumps you uploaded the common denominator would seem to be bad RAM. Most of the BSODs happened whilst different operations were in progress and most fail with a 0xC0000005 exception code, which is an invalid memory access.

I suggest that as a first step you test your RAM...
  1. Download Memtest86 (free), use the imageUSB.exe tool extracted from the download to make a bootable USB drive containing Memtest86 (1GB is plenty big enough). Do this on a different PC if you can, because you can't fully trust yours at the moment.
  2. Then boot that USB drive on your PC, Memtest86 will start running as soon as it boots.
  3. If no errors have been found after the four iterations of the 13 different tests that the free version does, then restart Memtest86, and do another four iterations.
  4. Even a single bit error is a failure.
Note that Memtest86 is very good but no RAM tester can prove that your RAM is OK, all they can do is to stress it enough to try and make it fail.
 
I ran Memtest86 a total of 6 times, two with both sticks and two each with one stick; no errors were found. I picked up some new ram anyways as I was due for an upgrade. PC booted to setup as it detected new ram, everything looked fine, and then I immediately had back to back BSODs. Booted into safe mode and updated the chipset drivers again in case that was the issue. Apps were still randomly crashing so I ran driver verifier again to try and get more BSODs to happen. The PC has abruptly restarted twice with no BSODs after opening a game from Steam. I have attached the new zip file with updated information.
 

Attachments

The first thing to note is that your new RAM is not on the QVL for your motherboard. That doesn't mean it won't work but it does mean that it's not been tested and verified as compatible. That leaves a bit of a question mark on it unfortunately. When buying new RAM it's always wise to stick to RAM that's on the QVL.

It also appears that there may be two drives with a Windows system installed in your system? Your C: and D: drives both have the UEFI partition structure one expects with an OS install. If this is the case then you need to take the D: drive offline, having two Windows installations available in the same system is known to be a potential cause of problems.

The dumps still look as though this is very much like a RAM issue.

Only one dump references a third-party driver; farflt.sys. This is a Malwarebytes driver and although that rarely causes problems it does need to be kept up to date. It would help if you uninstalled it for now so that we can definitely discount it from the troubleshooting. One dump had a memory access violation (a 0xC0000005 exception) whilst processing a page fault...
Code: 
CONTEXT:  fffffd819c9fddd0 -- (.cxr 0xfffffd819c9fddd0)
rax=0000000000000000 rbx=fffffd819c9f81a8 rcx=fffffd819c9fe85f
rdx=fffff8037ea60f80 rsi=fffffd819c9fea98 rdi=0000000000000000
rip=fffff8037e21f585 rsp=fffffd819c9fe7d0 rbp=fffffd819c9fe850
 r8=cfffffffffffffff  r9=ffff91c8fe00df90 r10=fffff8037ea60f80
r11=ffff91c8e4723fff r12=0000000000000000 r13=00007ffc991b7120
r14=ffffcb052c2851a0 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00050246
nt!KiPageFault+0x485:
fffff803`7e21f585 ff8b4da00bc9    dec     dword ptr [rbx-36F45FB3h] ds:002b:fffffd81`65ab21f5=????????
This might indicate the the problem is not with your RAM but with the System drive (or is due to having two Windows system drives). It might be worth downloading Samsung Magician and run a diagnostic test on your 860 EVO.

The lack of any obvious failures in your System log is another indication that this is a hardware problem - Windows never gets the chance to catch the error, the hardware just fails underneath it.

If you can, it would be worth running Prime95 to stress your CPU and see whether that is the cause. This WILL make your CPU run hot, so you also need a temperature monitor running (like CoreTemp) to keep an eye on CPU temps. Run all three tests (Small FFts, large FFTs, and Blend) one after the other for at least an hour each test. If Prime95 generates errors, if the PC BSODs or crashes, or if the CPU gets too hot (Tmax for your 3600 is 95° C), then stop Prime95 and let us know what happened.
 
I will perform all those tests and get back to you. Regarding the RAM I tried looking into what was compatible and I thought I found the right one. This is what I purchased, which matches to the compatibility page. Is it possible they gave me the wrong one? I see in the log files the RAM model shows KF3200C16D4 instead of KF432C16BBK.

2024-01-27.png
2024-01-27 (1).png
 
I ran Prime95 for all three tests. The PC never crashed or BSOD. Temperature sat at 95° for the Small FFTs, about 80° for the Large FFTs, and cycled between 75°-95° on Blend, not once did it exceed 95°. All SSDs have been disconnected except the main one, Samsung Magician found no errors on a full scan. I did have one or two BSODs while checking what I ordered for RAM and getting the Prime95 and CoreTemp files, but since running all the tests I have not had any BSODs. Been about 5 hours of continuous running, which is the longest without a BSOD since it started happening. Most recent logs attached.
 

Attachments

That's very good news. I see from the logs that drive D: is not online - did that have a second Windows system installed? If so, I suspect that this may have been your problem all along. If that drive does have a second Windows system I would delete it before bringing that drive online again.

Let us know how it goes for now.
 
I had formatted all my drives before reinstalling Windows, so there should not have been a second install; I installed it on the same drive it originally was on as well. Contrary to yesterday, I have had multiple back to back BSODs this morning, one even in safe mode. New logs attached.
 

Attachments

If your getting BSODs in Safe Mode then you definitely have a hardware problem.

Of the three dumps today (28th) one is corrupted, it has a length of 0 bytes. That could be cause by bad RAM or by a bad system drive.

The other two are both 0x3B bugchecks but with different exception codes....

One is a 0xC0000005, a memory access violation caused by a misaligned instruction pointer in the Windows ntfs.sys driver. It appears that you were using the Windows 'where' command in a PowerShell script to locate filenames on a storage drive?

The other is a 0xC000001D, an illegal instruction during a registry operation. However, closer examination of the dump shows that the instruction is perfectly legal, so that means the context in which it was being executed was illegal. It appears here that you were using the Windows 'wevtutil' command (in a PowerShell script?) to access event data or other configuration data?

The common denominator here is the system drive. It could be bad RAM, but we can probably discount that now, and it could be a CPU problem, but that doesn't seem likely here. The earlier dumps I looked at could have been system drive related, as I mentioned.

Despite Magician finding no issues I would suggest you try it without that 860 EVO installed and see whether it's stable.
 
Fair enough, but it was an important test to do. The two recent dumps (29th Jan) are both pointing strongly at RAM again.

One is a 0x50 PAGE_FAULT_IN_NONPAGED_AREA, which as the name suggests indicates that a page fault occurred in a non-pageable memory pool. This means that either the memory was never allocated or the RAM holding that memory is bad. This can be caused by a flaky third-party driver, but since you have had a BSOD in Safe Mode that is not likely to be the cause here (third-party drivers aren't loaded in Safe Mode). The only other likely cause of this bugcheck is bad RAM, a bad RAM slot on the motherboard, or possibly a flaky device that causing a Windows driver to foul-up.

The other dump is a 0x3B SYSTEM_SERVICE_EXCEPTION, which means that an unhandled exception occurred in the kernel. The exception code here is 0xC0000005, which indicates that an invalid memory location was accessed. The dump triage analysis indicates that this was due to bad RAM, but there is a chkimg extension output in the dump too, this indicates that 670 executable file images are corrupted...
Code: 
CHKIMG_EXTENSION: !chkimg -lo 50 -d !win32kbase
    ffff863a51ca08e0-ffff863a51ca08f2  19 bytes - win32kbase!DirectComposition::CNineGridBrushMarshaler::SetFloatProperty+80
    [ 60 00 00 00 eb bb b8 00:48 8b 02 49 3b 00 77 09 ]
    ffff863a51ca08f4 - win32kbase!DirectComposition::CNineGridBrushMarshaler::SetFloatProperty+94 (+0x14)
    [ 20:00 ]
    ffff863a51ca08f6-ffff863a51ca0945  80 bytes - win32kbase!DirectComposition::CNineGridBrushMarshaler::SetFloatProperty+96 (+0x02)
    [ 00 b9 6c 00 00 00 eb a3:c3 cc cc cc cc cc cc cc ]
    ffff863a51ca0952-ffff863a51ca095e  13 bytes - win32kbase!NtMITSetInputDelegationMode+42 (+0x5c)
    [ 45 33 f6 48 8b d8 48 85:41 c6 01 01 41 8b c0 c3 ]
    ffff863a51ca096b-ffff863a51ca0974  10 bytes - win32kbase!NtMITSetInputDelegationMode+5b (+0x19)
    [ 48 89 43 08 44 38 35 6a:5b eb d3 b8 00 10 00 00 ]
    ffff863a51ca0976-ffff863a51ca0980  11 bytes - win32kbase!NtMITSetInputDelegationMode+66 (+0x0b)
    [ 48 8d 3d 03 11 1a 00 bb:00 00 eb c7 b8 00 01 00 ]
    ffff863a51ca0982-ffff863a51ca09a0  31 bytes - win32kbase!NtMITSetInputDelegationMode+72 (+0x0c)
    [ 0f 57 c0 0f 11 45 83 8d:00 00 eb bb b8 00 04 00 ]
    ffff863a51ca09ad-ffff863a51ca09b3  7 bytes - win32kbase!NtMITSetInputDelegationMode+9d (+0x2b)
    [ 48 85 c0 74 03 48 8b:cc cc cc 48 89 5c 24 ]
    ffff863a51ca09c1-ffff863a51ca09cb  11 bytes - win32kbase!NtMITSetInputDelegationMode+b1 (+0x14)
    [ 48 85 c0 74 09 48 3b 05:57 48 8d 6c 24 c9 48 81 ]
    ffff863a51ca09cd-ffff863a51ca09ce  2 bytes - win32kbase!NtMITSetInputDelegationMode+bd (+0x0c)
    [ 74 26:00 48 ]
    ffff863a51ca09db-ffff863a51ca09df  5 bytes - win32kbase!NtMITSetInputDelegationMode+cb (+0x0e)
    [ 48 3b 05 26 53:27 44 8b fa 89 ]
    ffff863a51caa2e0-ffff863a51caa340  97 bytes - win32kbase!DirectComposition::CInteractionMarshaler::SetIntegerProperty+80 (+0x9905)
    [ 3a c2 74 1d c0 e2 03 80:48 83 ec 28 48 8b ca e8 ]
    ffff863a51caa342-ffff863a51caa348  7 bytes - win32kbase!xxxNumpadCursor+12 (+0x62)
    [ ec 50 8a 05 da 1a 1a:e8 01 0f 84 91 0c 06 ]
    ffff863a51caa34a-ffff863a51caa352  9 bytes - win32kbase!xxxNumpadCursor+1a (+0x08)
    [ 33 f6 48 8b d9 bd 00 02:41 83 f8 02 0f 85 7c 0c ]
    ffff863a51caa354-ffff863a51caa366  19 bytes - win32kbase!xxxNumpadCursor+24 (+0x0a)
    [ 84 c0 0f 85 d8 0a 06 00:44 39 89 48 01 00 00 74 ]
    ffff863a51caa369-ffff863a51caa376  14 bytes - win32kbase!xxxNumpadCursor+39 (+0x15)
    [ 66 85 c1 75 1b 48 8b 5c:c6 00 01 0f ba 69 10 09 ]
    ffff863a51caa378-ffff863a51caa3b8  65 bytes - win32kbase!xxxNumpadCursor+48 (+0x0f)
    [ 48 8b 6c 24 70 48 8b 74:00 8a c1 c0 e8 03 24 01 ]
    ffff863a51caa3ba-ffff863a51caa3c6  13 bytes - win32kbase!xxxNumpadCursor+8a (+0x42)
    [ 00 00 0f ba e0 17 73 ac:80 e1 ef eb cb cc cc cc ]
    ffff863a51caa3d0-ffff863a51caa3df  16 bytes - win32kbase!CMouseProcessor::AnalyzeNewMousePosition (+0x16)
    [ 4c 8b 42 08 4c 8b c9 41:48 89 5c 24 08 48 89 6c ]
    ffff863a51caceb1-ffff863a51cacedf  47 bytes - win32kbase!NtDCompositionTelemetryAnimationScenarioReference+81 (+0x2ae1)
    [ 8b 05 89 04 1c 00 48 8b:83 ec 28 8b ca 45 33 c0 ]
    ffff863a51cacee2-ffff863a51cacefd  28 bytes - win32kbase!NtDCompositionTelemetryAnimationScenarioReference+b2 (+0x31)
    [ e8 91 95 fc ff 8b d8 48:33 db 48 21 58 20 0f 57 ]
    ffff863a51caceff-ffff863a51cacf05  7 bytes - win32kbase!NtDCompositionTelemetryAnimationScenarioReference+cf (+0x1d)
    [ 8d 54 24 20 e8 44 20:85 d2 0f 84 e1 ef 05 ]
    ffff863a51cacf07-ffff863a51cacf12  12 bytes - win32kbase!NtDCompositionTelemetryAnimationScenarioReference+d7 (+0x08)
    [ 00 8b d8 48 8b 07 48 8b:85 db 0f 88 aa 00 00 00 ]
    ffff863a51cacf1a-ffff863a51cacf1e  5 bytes - win32kbase!NtDCompositionTelemetryAnimationScenarioReference+ea (+0x13)
    [ c3 48 8b 5c 24:05 21 04 1c 00 ]
    ffff863a51cacf20-ffff863a51cacf2f  16 bytes - win32kbase!NtDCompositionTelemetryAnimationScenarioReference+f0 (+0x06)
    [ 48 83 c4 30 5f c3 cc cc:3b 08 77 2c 49 8b 00 48 ]
    ffff863a51cacf31-ffff863a51cacf70  64 bytes - win32kbase!NtDCompositionTelemetryAnimationScenarioUnreference+1 (+0x11)
    [ 8b c4 48 89 58 10 89 48:3b ca 72 0c 48 8b 05 04 ]
    ffff863a51cacf72-ffff863a51cacfa6  53 bytes - win32kbase!NtDCompositionTelemetryAnimationScenarioUnreference+42 (+0x41)
    [ 08 49 3b c8 72 38 48 8b:8b 7c 24 50 85 db 78 3f ]
    ffff863a51cacfa8-ffff863a51cacfaf  8 bytes - win32kbase!NtDCompositionTelemetryAnimationScenarioUnreference+78 (+0x36)
    [ 48 8b 08 c6 01 00 eb 0f:8b d8 48 8b 07 48 8b 00 ]
670 errors : !win32kbase (ffff863a51ca08e0-ffff863a51cacfaf)
This could be due to bad RAM, as the dump triage analysis assumes, but it could also be due to a corrupt WIndows installation, a bad system drive, or (since this is an M.2 drive) it could just be a badly seated drive. M.2 ports do seem to suffer with bad seating issues, so try removing and reseating that 870 EVO and test again.

Can you just confirm that you have had at least one BSOD running in Safe Mode without networking? If you're not sure then please restart in Safe Mode without networking and run like that for several hours, or until you get a BSOD. Safe Mode is a stripped-down system with only critical Windows service and drivers loaded and (typically) no third-party drivers loaded. If it BSODs with this most stable of Windows systems running then it's a hardware error and we don't need to look any further at software causes.

The main reason why we need to be certain it fails in Safe Mode is because both these recent dumps failed during a storage drive access operation. We see the Windows ntfs.sys driver called, this is the root filesystem driver. Both dumps also show the Windows fltmgr.sys driver called, this manages any filter drivers. These may be filters like antivirus, or other disk management tools. Do you have any disk-specific third-party tools like these installed? When you run in Safe Mode these third-party filter drivers should not be loaded and so we can discount this line of enquiry.

I see that you've reinstalled Windows at least twice, but do you also reinstall all your third-party apps and devices as well? It's possible that you may be reinstalling the problem.
 
Last edited:
ubuysa said:
The other dump is a 0x3B SYSTEM_SERVICE_EXCEPTION, which means that an unhandled exception occurred in the kernel. The exception code here is 0xC0000005, which indicates that an invalid memory location was accessed. The dump triage analysis indicates that this was due to bad RAM, but there is a chkimg extension output in the dump too, this indicates that 670 executable file images are corrupted...
Click to expand...
Which version of WinDbg are you using? I'm not getting any errors reported for win32kbase.sys, !chkimg just compares the module in the dump file to the representation in the symbol store, so if your symbol store is incorrect then it may believe that there is problems when there possibly isn't.

For some reason, the symbols aren't being loaded for me:

Rich (BB code): 
************* Symbol Loading Error Summary **************
Module name            Error
mcupdate_AuthenticAMD  The system cannot find the file specified
clipsp                 The system cannot find the file specified
amdpsp                 The system cannot find the file specified
Null                   The system cannot find the file specified
Msfs                   The system cannot find the file specified
nvlddmkm               The system cannot find the file specified
drmk                   The system cannot find the file specified
AMDPCIDev              The system cannot find the file specified
amdgpio2               The system cannot find the file specified
amdgpio3               The system cannot find the file specified
nvhda64v               The system cannot find the file specified
win32k                 The system cannot find the file specified
win32kbase             The system cannot find the file specified
win32kfull             The system cannot find the file specified
cdd                    The system cannot find the file specified
peauth                 The system cannot find the file specified

I've tried it with two different machines with two different versions of WinDbg.

Have you tried reloading the symbols with:

Code: 
.reload /n /o /f

You can always do the following as well:

Code: 
!chkimg win32kbase -f

ubuysa said:
Do you have any disk-specific third-party tools like these installed?
Click to expand...
@UnknownKaos You can just run the following from an elevated command prompt if you aren't sure:

Code: 
fltmc filters
reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318} /v UpperFilters
reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F} /v UpperFilters
 
WinDbg 10.0.20348.1

Sc22YNS.jpg



The .reload /n /o /f makes no difference, an !analyze -v afterwards produces the same CHKIMG_EXTENSION: !chkimg -lo 50 -d !win32kbase output with 670 errors.

The !chkimg win32kbase -f produces...
Code: 
11: kd> !chkimg win32kbase -f
Warning: Any detected errors will be fixed to what we expect!
670 errors (fixed): win32kbase (ffff863a51ca08e0-ffff863a51cacfaf)
 
Last edited:
x BlueRobot said:
Have you tried the latest WinDbg SDK version which is 10.0.22621.2428?
Click to expand...
Just installed it and I see the same output....

m5qv9QT.jpg


The .reload /n /o /f and the !chkimg win32kbase -f produce the same results too.
 
Last edited:
Back
Top