Intermittent BSOD

K

kulich

Member
I have about half a year old PC from PCSPECIALIST and it is ntermittently getting BSODs. It started some time after I got it but was quite infrequent so I did not take too much notice, but it got quite worse lately and I got a serie of them yesterday and today.
Would anyone be able to look at the dumps that I am getting if you can find what the issue might be?

I have tried switching RAMs around as it looked like it was helping, but then I got the BSOD again so not sure if that was just random, or it helped at all.

Memory dump

MEMORY_kulich.DMP

drive.google.com drive.google.com

Mini dumps

minidumps_kulich.zip

drive.google.com drive.google.com
 
ubuysa

ubuysa

The BSOD Doctor
These are unusual dumps, I've not seen this sort of situation before. Two of your mindumpos are unreadable for some reason but I'll start with the key data from the other three...

[070721-13156-01.dmp is a SYSTEM_SERVICE_EXCEPTION stop code, which means that there was an unhandled exception is a system service. The exception code is 0xc0000005, which is an access violation meaning that a resource was accessed in an invalid way.

The process in control was nvcontainer.exe, which is a component of the Nvidia graphics system. As its name suggest it doesn't do much, it's just a container for other threads (probably dlls).

The failing driver is clipsp.sys, which is a component of the Windows Client License Service and is related to product licensing.

The failure bucket id is 0x3B_c0000005_clipsp!ExpLicensingDescriptorCompare, where the 0x3B is the stop code, the 0xC000005 is the exception code and the clipsp!ExpLicensingDescriptorCompare is the clipsp.sys function that failed.


070721-14078-01.dmp is a KMODE_EXCEPTION_NOT_HANDLED stop code, which means that an unhandled exception occurred in the kernel. The exception code is 0xc0000005, which is an access violation meaning that a resource was accessed in an invalid way. This is really just a slightly different form of the previous dump.

The process in control was sppsvc.exe, which is part of Microsoft's Software Protection Service and is designed to detect pirate copies and prevent tampering.

The failing driver is clipsp.sys again, a component of the Windows Client License Service.

The failure bucket id is
0x1E_c0000005_clipsp!WarbirdRuntime::CEncryption_1,WarbirdCrypto::CCipherFeistel64_15,2,55,32,24,212,145,149,17,36,232,27,27,251,62,68,12,121,37,186,30,208,67,59,26,196,84,19,6,178,168,42,19,198,59,5,10,5,250,245_,WarbirdCrypto::CHashFunctionSCP_0,3,0,-587666, where the 0x1E is the stop code, the 0xC0000005 is the exception code and the clipsp!WarbirdRuntime::CEncryption_1,WarbirdCrypto::CCipherFeistel64_15,2,55 etc. is the clipsp function that failed. Note that Warbird is also part of the Microsoft license validation systems.


070721-14093-01.dmp is another SYSTEM_SERVICE_EXCEPTION stop code, again with an 0xC0000005 exception code.

The process in control was ArmouryCrate.Service.exe, and that has an obvious function.

The failing driver is cng.sys, this is the Windows Next Generation Cryptography service and is used in license validation.

The failure bucket id is
0x3B_c0000005_cng!WideString_Compare, where the 0x3B is the stop code, the 0xC000005 is the exception code and the clipsp!ExpLicensingDescriptorCompare is the clipsp.sys function that failed.

There is also another driver failure in the list of call made by the active thread...
Code: 
fffff48d`fe0be118  fffff801`3a752700Unable to load image \SystemRoot\system32\drivers\wd\WdFilter.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for WdFilter.sys
 WdFilter+0x42700
The wdfilter.sys driver is a filter driver for Windows Defender, suggesting some sort of security issue.


The kernel dump (MEMORY_kulich.DMP) is identical to the previous minidump (070721-14093-01.dmp) and that's quite common. In this case there is nothing new in the kernel dump.

The common denominator here is licensing. One possibility is that the WIndows license you're using is not kosher in some way, or at least Microsoft think it's not. Possibly some other software has licensing issues? Do you have any cracked software running? This may also be malware of course so a couple of scans from different engines would be advisable.

The other common denominator is the exception code of 0xC0000005, the most common resource that is accessed incorrectly is RAM and these BSODs might indicate flaky RAM. I would get hold of Memtest and let that run to completion.
 
K

kulich

Member
Thanks for the detailed info. There should not be any cracked software running on the system and Windows are bought with the PC.

I have tried running memtest for quite some time on the sticks with no errors.

I will try to do some more scans if there is a possible malware, but I did not find anything. (I also bought another pair of RAMs which did not solve it)

The weird and hard part for diagnostics is that it seems to be quite random. Sometimes the PC runs for days allright, today I got BSOD after BSOD in the morning and now again whole day ok.
Some days it BSODs on first run and then runs ok... I was wondering if there might be some cold connection that fixes itself once it warms up, but that is just a wild guess.
 
ubuysa

ubuysa

The BSOD Doctor
kulich said:
Thanks for the detailed info. There should not be any cracked software running on the system and Windows are bought with the PC.

I have tried running memtest for quite some time on the sticks with no errors.

I will try to do some more scans if there is a possible malware, but I did not find anything. (I also bought another pair of RAMs which did not solve it)

The weird and hard part for diagnostics is that it seems to be quite random. Sometimes the PC runs for days allright, today I got BSOD after BSOD in the morning and now again whole day ok.
Some days it BSODs on first run and then runs ok... I was wondering if there might be some cold connection that fixes itself once it warms up, but that is just a wild guess.
Click to expand...
Which kind of points to flaky RAM as being a possible cause. I would allow Memtest to complete all four iterations of the 13 tests - yes it will take hours - and if you can, when it finishes start it up again immediately. Some RAM issues need hammering to find them.

Can you also post your full spec from the order please, so we can see exactly what build you have?

I'll get on the new dump when it's downloaded....
 
ubuysa

ubuysa

The BSOD Doctor
This dump is completely different to the previous ones.

The stop code is a SYSTEM_THREAD_EXCEPTION_NOT_HANDLED which means just about what it says on the tin. The exception code is (again) 0xC0000005, a memory access violation.

However, the failing process here is FileCoAuth.exe, which appears to be a component of OneDrive.

The failing driver is fileinfo.sys, this is an NTFS component used to access information about disk files.

The stack trace also clearly shows that an NTFS (disk) operation was in progress at the time of the bug check. The last call is to an NTFS function called memcmp (Ntfs!memcmp+0x93). This would appear on the face of it to be a function that compares two data areas in memory (RAM) but it's clearly file related because it's an NTFS function.

The failure bucket id is AV_fileinfo!FIPfInterfaceOpen which I'm not familiar with. I think that the AV may reference your anti-virus - which is Windows Defender (since I don't see loaded modules for any other AV engines) but the fileinfo!FIPfInterfaceOpen would seem to be file related, which we already suspect.

This dump is pointing strongly at a disk (SSD or HDD) error, although the 0xC0000005 exception code and the Ntfs!memcmp function call point at RAM.

To complicate things a bit more, in the list of calls made by the active thread, the Nvidia graphics driver (nvlddmkm.sys) features heavily. There was a lot of GPU work going on at this time, even though there's no indication of GPU or graphics driver errors. It's something to bear in mind I think.

Now we really do need to see the full details of your build please.

If you have an M.2 SSD then remove it and replace it, we've had instances of people having strange issues caused by a badly seated M.2 drive.

I also note that in one of your Minidumps earlier the failing driver was a Windows Defender filter driver (WDFilter.sys) and that's another pointer towards the AV engine perhaps.

So....what to suggest? RAM is a very common cause of strange issues like this so I think we need to be as confident as possible that your RAM is good. Hammering it with at least two consecutive full runs (of all four iterations) of Memtest is the minimum needed to have confidence in your RAM, and even then we can never be 100% sure. Depending on how much RAM you have and in what configuration, removing some of the RAM sticks for a few days to see whether the BSODs stop is the only guaranteed way to test RAM.

I would suggest that you run a chkdsk /f /x on each of your SSDs and a chkdsk /r /x on each of your HDDs. You will have to reboot after each run. This will check the filesytem on the SSDs and the disk surface and filesystem on the HDDs.

I see from your installed drivers that there is some sort of Samsung performance tool installed? I see two drivers, SamsungRapidDiskFltr.sys and SamsungRapidFSFltr.sys which are not common and seem to be related with some sort of 'Samsung Rapid Mode'? Given your symptoms I would turn that off for a while.

It would be extremely useful if you could document what else is running on your system at the time of a BSOD, what hardware devices were plugged in, and what exactly you were doing at the time. Although the issue seems random it almost certainly isn't and finding the combination that triggers the BSOD would be a big step in the right direction.
 
K

kulich

Member
The spec is this:

Case
NZXT H511 MID-TOWER GAMING CASE (BLACK)
Processor (CPU)
AMD Ryzen 5 5600X Six Core CPU (3.7GHz-4.6GHz/35MB CACHE/AM4)
Motherboard
ASUS® STRIX B550-F GAMING (DDR4, USB 3.2, 6Gb/s) - ARGB Ready!
Memory (RAM)
16GB Corsair VENGEANCE DDR4 3000MHz (2 x 8GB)
Graphics Card
NONE, I ALREADY HAVE A GRAPHICS CARD
1st M.2 SSD Drive
1TB SAMSUNG 980 PRO M.2, PCIe NVMe (up to 7000MB/R, 5000MB/W)
Power Supply
CORSAIR 750W RMx SERIES™ MODULAR 80 PLUS® GOLD, ULTRA QUIET
Power Cable
1 x 1 Metre UK Power Cable (Kettle Lead)
Processor Cooling
STANDARD AMD CPU COOLER
Thermal Paste
ARCTIC MX-4 EXTREME THERMAL CONDUCTIVITY COMPOUND
Extra Case Fans
1x 120mm Black Case Fan (configured to extract from rear/roof)
Sound Card
ONBOARD 6 CHANNEL (5.1) HIGH DEF AUDIO (AS STANDARD)
Network Card
10/100/1000 GIGABIT LAN PORT
Wireless Network Card
WIRELESS INTEL® Wi-Fi 6 AX200 2,400Mbps/5GHz, 300Mbps/2.4GHz PCI-E CARD + BT 5.0
USB/Thunderbolt Options
2 PORT (2 x TYPE A) USB 3.1 PCI-E CARD + STANDARD USB PORTS
Operating System
Windows 10 Home 64 Bit - inc. Single Licence

+ RTX2080 Super
+ second ssd samsung 850 pro
+ HDD Seagate

I had a swarm of crashes yesterday evening so I just reinstalled windows to get the PC as clean as possible. I got another crash this morning - that is most common crash for me - on logging in to Windows it crashes. I have turned off all startup apps to see if that changes anything.

What I currently have installed (as it is a new windows install the list is quite short):
Epic games launcher
Steam
One drive, but that should not start now on startup
Geforce experience
Kaspersky Anti-virus
Discord

Connected hardware - again I have disconnected as much as possible to pinpoint the problem
Logitech wireless donge + connected to headphones
Logitech wireless mouse
Wireless Xbox dongle + connected to controller
Soundblaster Katana


I have also only left one memory stick in to check them one by one. I am going to run the mem-test today and report the results.

I have an m2 disk so I will try to reconnect it.
 
ubuysa

ubuysa

The BSOD Doctor
I didn't notice Kaspersky in the last dump but I STRONGLY advise you to dump it. Third party antivirus tools are the fastest way to a BSOD that I know of, from experience. And your last dump appeared to have an AV component. If Windows Defender is still active then you will have problems - two antivirus engines is a known problem.
 
ubuysa

ubuysa

The BSOD Doctor
kulich said:
I did not have it before, I installed it now to do a check and planning to get rid of it.
Click to expand...
With problems like this you want the cleanest and simplest system you can get. The more complexity you add the more likely you're reinstalling the problem.

Ideally you want Windows and drivers and nothing else. That's the cleanest and simplest system you can get. If it will BSOD in that state then it's hardware related.

It's a mistake to rush ahead installing a bunch of stuff, especially new stuff...
 
N

Nasko

Member
I got the exact same issues as you had, and I had litteraly no idea where it came from, as Windows cannot exactly give the issue.
After checking the soft, the SSD, and the RAMs, I managed to found that the issue was the RAM slot (I mean, running with one RAM slot empty works really fine, but the other doesn't, and both doesn't, no matter the RAM module used).
I have no idea how this is possible, as nothing happened to my motherboard or my RAM before the incident (maybe overheat?).
Anyway, I'm now not using that RAM slot, waiting for my new computer to come !
Check your RAMs AND motherboard if that persists after a clean windows reinstall ;)


Me-Who-is-responsible-for-this-blue-screen-Meanwhile-me-meme-4261.jpg
 
K

kulich

Member
Nasko said:
I got the exact same issues as you had, and I had litteraly no idea where it came from, as Windows cannot exactly give the issue.
After checking the soft, the SSD, and the RAMs, I managed to found that the issue was the RAM slot (I mean, running with one RAM slot empty works really fine, but the other doesn't, and both doesn't, no matter the RAM module used).
I have no idea how this is possible, as nothing happened to my motherboard or my RAM before the incident (maybe overheat?).
Anyway, I'm now not using that RAM slot, waiting for my new computer to come !
Check your RAMs AND motherboard if that persists after a clean windows reinstall ;)
Click to expand...
Yes I got the BSOD immediately after clean install. I am running the long memory tests and see if they are ok. I am thinking it might be the ram slot as well as when I tried filling all four slots I got a BSOD immediately.
I am really thinking about some sort of cold connection - the BSOD most often happens on first start of the PC and then while it is running the crashes are very rare.
I am now running with one RAM stick in one slot and it seems to be allright, I will see if something happens.
 
ubuysa

ubuysa

The BSOD Doctor
kulich said:
Yes I got the BSOD immediately after clean install. I am running the long memory tests and see if they are ok. I am thinking it might be the ram slot as well as when I tried filling all four slots I got a BSOD immediately.
I am really thinking about some sort of cold connection - the BSOD most often happens on first start of the PC and then while it is running the crashes are very rare.
I am now running with one RAM stick in one slot and it seems to be allright, I will see if something happens.
Click to expand...
All it takes is the smallest spec of grit or dust on a RAM connector to cause one of the pins to not connect and you're in trouble. Use a can of low pressure compressed air, or an electric blower, to ensure that each slot is free of dust. I would wipe the RAM card connectors with a linit free cloth too.
 
You must log in or register to reply here.
Top