Question BSOD caused by hardware or software?

Nov 21, 2019
23
0
10
Hi, I have been having multiple BSOD with different errors on my pc: KMODE_EXCEPTION_NOT_HANDLED , CRITICAL_PROCESS_DIED and today I had a lot of BSOD one after the other with errors SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M, ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (module: dump_iastorac.sys), UNEXCPECTED_KERNEL_MODE_TRAP, CACHE_MANAGER, 0x000021a
I tried a lot of different things like sfc /scannow , chkdsk /f, memory diagnostic, DISM.exe /Online /Cleanup-Image /RestoreHealth , virus scan
I was wondering if by any chance there was anything more I could do to try to solve the BSOD from happening again and not send it to repair or is this caused by the hardware for sure?
 
Nov 21, 2019
23
0
10
Thanks for answering, ok I'll try that but the BSOD happens randomly, then my pc restart and I can use it so I would I know if the BSOD will appear in clean boot?
I noticed in the event viewer that I had an error when I shut down my pc normally: The previous system shutdown at 11:50:01 PM on ‎11/‎21/‎2019 was unexpected.
 
Last edited:

Colif

Win 11 Master
Moderator
1 Can you follow option one on the following link - here - and then do this step below: Small memory dumps - Have Windows Create a Small Memory Dump (Minidump) on BSOD - that creates a file in c windows/minidump after the next BSOD

copy that file to documents
upload the copy from documents to a file sharing web site, and share the link in your thread so we can help fix the problem

2 Try running memtest86 on each of your ram sticks, one stick at a time, up to 4 passes. Only error count you want is 0, any higher could be cause of the BSOD. Remove/replace ram sticks with errors.


iaStorA. sys is part of Intel RST (Rapid Storage Technology) - its used for making ssd faster and RAID... odd that its dump file crashed?


critical process died can relate to a number of processes that if they crash, windows has no choice but to follow. Knowing what file crashed is a start.

https://docs.microsoft.com/en-us/wi...-0xc000021a--status-system-process-terminated is similar.

many of them are data errors, whether its caused by ram or storage is difficult to say without looking at dump files.

running sfc/dism makes sense as its what i would try.

Clean boot only helps if its a program causing BSOD, these look like possible drivers. Suddenness off it could be hardware.

what are specs of the PC? What motherboard? what drives?

I would run a test using HD Sentinel or HD Tune on your storage drives. See what health score they report.
 
Last edited:
Nov 21, 2019
23
0
10
Hi, here are some dmp files that were generated after BSOD: https://1drv.ms/u/s!ArMdUZwT8T5KiheBhuXRhZNzYuI9?e=RD15u6
I have reports from whocrashed if this can help:
On Thu 21-Nov-19 7:43:29 PM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\Minidump\112119-6296-01.dmp
This was probably caused by the following module: dump_iastorac.sys (0xFFFFF80163C436F0)
Bugcheck code: 0xFC (0xFFFFF80163C436F0, 0x89000003CC825863, 0xFFFF92043575F2D0, 0x2)
Error: ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY
file path: C:\WINDOWS\System32\drivers\dump_iaStorAC.sys
Bug check description: This indicates that an attempt was made to execute non-executable memory.
This may be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules. Memory corruption can also occur because of overheating (thermal issue). There is a possibility this problem was caused by a virus or other malware.
The crash took place in a storage driver or controller driver. Since there is no other responsible driver detected, this could be pointing to a malfunctioning drive or corrupted disk. It's suggested that you run CHKDSK.



On Thu 21-Nov-19 7:43:29 PM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\MEMORY.DMP
This was probably caused by the following module: dump_iastorac.sys (0xFFFFF80163C436F0)
Bugcheck code: 0xFC (0xFFFFF80163C436F0, 0x89000003CC825863, 0xFFFF92043575F2D0, 0x2)
Error: ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY
file path: C:\WINDOWS\System32\drivers\dump_iaStorAC.sys
Bug check description: This indicates that an attempt was made to execute non-executable memory.
This may be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules. Memory corruption can also occur because of overheating (thermal issue). There is a possibility this problem was caused by a virus or other malware.
The crash took place in a storage driver or controller driver. Since there is no other responsible driver detected, this could be pointing to a malfunctioning drive or corrupted disk. It's suggested that you run CHKDSK.



On Thu 21-Nov-19 5:45:00 PM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\Minidump\112119-6031-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x5ECF5D)
Bugcheck code: 0x1000007E (0xFFFFFFFFC0000005, 0xFFFFF807351ECF5D, 0xFFFFD80436407408, 0xFFFFD80436406C50)
Error: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a system thread generated an exception which the error handler did not catch.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Tue 19-Nov-19 9:26:40 PM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\Minidump\111919-12671-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x1C14E0)
Bugcheck code: 0xEF (0xFFFFD70570A22080, 0x0, 0x0, 0x0)
Error: CRITICAL_PROCESS_DIED
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a critical system process died.
There is a possibility this problem was caused by a virus or other malware.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Thu 14-Nov-19 5:19:41 PM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\Minidump\111419-6218-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x1C1220)
Bugcheck code: 0x1E (0xFFFFFFFFC0000005, 0xFFFFF8045942FB4D, 0x0, 0xFFFFFFFFFFFFFFFF)
Error: KMODE_EXCEPTION_NOT_HANDLED
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a kernel-mode program generated an exception which the error handler did not catch.
This might be a case of memory corruption. This may be because of a hardware issue such as faulty RAM, overheating (thermal issue) or because of a buggy driver.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.
It is a laptop, here are the specs
Computer name: DESKTOP-MMNB5MN
Windows version: Windows 10 , 10.0, version 1903, build: 18362
Windows dir: C:\WINDOWS
Hardware: Predator PH315-51, Acer, CFL, Sienta_CFS
CPU: GenuineIntel Intel(R) Core(TM) i7-8750H CPU @ 2.20GHz Intel8664, level: 6
12 logical processors, active mask: 4095
RAM: 17012477952 bytes (15.8GB)
Thank you for these information, I hope it is drivers and not hardware...
I'll run all the test that you mentionned and I'll tell you the results.
You said it was odd that the dump file of iaStorA. sys crashed, do you know what it could mean?

For now I did sfc /scannow and Dism /Online /Cleanup-Image /ScanHealth and no problems were found. HD sentinel reports 100% and 99% on my hdd and ssd.
 
Last edited:

Colif

Win 11 Master
Moderator
okay, i have sent link to a friend who will convert dump files and we see what they show.

this model? https://www.acer.com/ac/en/AU/content/predator-model/NH.Q3FSA.005

Does it have an ssd and hdd?

driver download page - just for future reference - https://www.acer.com/ac/en/US/content/support-product/7603?b=1 - IRST (Intel® Rapid Storage Technology) Driver Hot Fix 16.7.8.1024 might be helpful, but need to see what is on PC before i get ahead of myself.

Not sure what other drivers would help in the list there.

It is likely software.
Attempted execute of non executable memory sounds like a driver trying to run in ram its not meant to run in. wrong instructions.
 
Nov 21, 2019
23
0
10
Yes that's this model. Yes I have an ssd with windows installed and other softwares and I have an hdd where I store documents.
So should I download and install IRST (Intel® Rapid Storage Technology) Driver Hot Fix 16.7.8.1024 or wait ?
It would be nice if it was software and not hardware. Thanks for helping by the way!
 

Colif

Win 11 Master
Moderator
just wait until my friend replies, i don't like suggesting anything without knowing what is there first. He should reply in the next few hours, I should have seen your reply before I did and had an answer for you by now.
 

gardenman

Splendid
Moderator
Hi, I ran the dump files through the debugger and got the following information: https://pste.eu/p/WENt.html
File information:112119-6296-01.dmp (Nov 21 2019 - 13:43:29)
Bugcheck:ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (FC)
Driver warnings:*** WARNING: Unable to verify timestamp for dump_iaStorAC.sys
Probably caused by:memory_corruption (Process: dwm.exe)
Uptime:0 Day(s), 1 Hour(s), 19 Min(s), and 15 Sec(s)

File information:112119-6031-01.dmp (Nov 21 2019 - 11:45:00)
Bugcheck:SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007E)
Probably caused by:memory_corruption (Process: System)
Uptime:0 Day(s), 0 Hour(s), 00 Min(s), and 02 Sec(s)

File information:111919-12671-01.dmp (Nov 19 2019 - 15:26:40)
Bugcheck:CRITICAL_PROCESS_DIED (EF)
Probably caused by:memory_corruption (Process: services.exe)
Uptime:5 Day(s), 3 Hour(s), 00 Min(s), and 38 Sec(s)

File information:111419-6218-01.dmp (Nov 14 2019 - 11:19:41)
Bugcheck:KMODE_EXCEPTION_NOT_HANDLED (1E)
Probably caused by:memory_corruption (Process: audiodg.exe)
Uptime:1 Day(s), 4 Hour(s), 45 Min(s), and 36 Sec(s)
Comment: The overclocking driver "IOCBios2.sys" was found on your system. (Intel Extreme Tuning Utility)

System: Acer Predator PH315-51

This information can be used by others to help you. I can't help you with this. Someone else will post with more information. Please wait for additional answers. Good luck.

Edit: Results for the below dump file: https://pste.eu/p/e4xh.html
File information:112319-6328-01.dmp (Nov 23 2019 - 13:10:22)
Bugcheck:DRIVER_IRQL_NOT_LESS_OR_EQUAL (D1)
Probably caused by:memory_corruption (Process: svchost.exe)
Uptime:0 Day(s), 3 Hour(s), 44 Min(s), and 36 Sec(s)
 
Last edited:
Nov 21, 2019
23
0
10
Ok thank you. I had another BSOD just now if this can help solve my problem here are the report and the dmp file:
On Sat 23-Nov-19 7:10:22 PM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\Minidump\112319-6328-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x1C14E0)
Bugcheck code: 0xD1 (0xFFFFF8022D08DF61, 0xFF, 0x0, 0xFFFFF8022D08DF61)
Error: DRIVER_IRQL_NOT_LESS_OR_EQUAL
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.
This bug check belongs to the crash dump test that you have performed with WhoCrashed or other software. It means that a crash dump file was properly written out.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Sat 23-Nov-19 7:10:22 PM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\MEMORY.DMP
This was probably caused by the following module: fltmgr.sys (FLTMGR!FltObjectReference+0x5C1)
Bugcheck code: 0xD1 (0xFFFFF8022D08DF61, 0xFF, 0x0, 0xFFFFF8022D08DF61)
Error: DRIVER_IRQL_NOT_LESS_OR_EQUAL
file path: C:\WINDOWS\system32\drivers\fltmgr.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Microsoft Filesystem Filter Manager
Bug check description: This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.
This bug check belongs to the crash dump test that you have performed with WhoCrashed or other software. It means that a crash dump file was properly written out.
The crash took place in a file system driver. Since there is no other responsible driver detected, this could be pointing to a malfunctioning drive or corrupted disk. It's suggested that you run CHKDSK.
https://1drv.ms/u/s!ArMdUZwT8T5KihoFFvggBpfffkQU?e=sABExr
 
Nov 21, 2019
23
0
10
I just had 2 BSOD:
On Sun 24-Nov-19 10:17:32 AM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\Minidump\112419-7562-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x1C14E0)
Bugcheck code: 0x50 (0xFFFFD40922DC52CE, 0x0, 0xFFFFD40922D64B24, 0x2)
Error: PAGE_FAULT_IN_NONPAGED_AREA
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that invalid system memory has been referenced.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Sun 24-Nov-19 10:17:32 AM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\MEMORY.DMP
This was probably caused by the following module: ntkrnlmp.exe (nt!memset+0xF056)
Bugcheck code: 0x50 (0xFFFFD40922DC52CE, 0x0, 0xFFFFD40922D64B24, 0x2)
Error: PAGE_FAULT_IN_NONPAGED_AREA
Bug check description: This indicates that invalid system memory has been referenced.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Sun 24-Nov-19 10:14:41 AM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\Minidump\112419-7343-01.dmp
This was probably caused by the following module: igdkmd64.sys (0xFFFFF8023309ED42)
Bugcheck code: 0x1E (0xFFFFFFFFC0000005, 0xFFFFF8023309ED42, 0x0, 0xFFFFFFFFFFFFFFFF)
Error: KMODE_EXCEPTION_NOT_HANDLED
file path: C:\WINDOWS\System32\DriverStore\FileRepository\igdlh64.inf_amd64_0b3e3ed3ace9602a\igdkmd64.sys
product: Intel HD Graphics Drivers for Windows(R)
company: Intel Corporation
description: Intel Graphics Kernel Mode Driver
Bug check description: This indicates that a kernel-mode program generated an exception which the error handler did not catch.
This might be a case of memory corruption. This may be because of a hardware issue such as faulty RAM, overheating (thermal issue) or because of a buggy driver.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: igdkmd64.sys (Intel Graphics Kernel Mode Driver, Intel Corporation).
Google query: igdkmd64.sys Intel Corporation KMODE_EXCEPTION_NOT_HANDLED
http://www.google.com/search?q=igdkmd64.sys+Intel Corporation+KMODE_EXCEPTION_NOT_HANDLED

It looks like it is a intel driver that is responsible for ths bsod
 

Colif

Win 11 Master
Moderator
the version of IRST installed on PC is newer than the one on Acer website so that answers 1 question. No, don't download it :)

The first error mentioned in listing by Gardenman that blames the dump_iaStorAC.sys also mentions DirectX - dxgkrnl!DxgkSignalSynchronizationObjectFromGpuInternal+0x3f4

I would suggest running DDU, and then run windows update - https://forums.tomshardware.com/faq...n-install-of-your-video-card-drivers.2402269/

I was about to blame Nvidia until I saw your last error :)

The CHipset driver on the Acer web site might help with some errors, its newer than the version you have installed - https://www.acer.com/ac/en/US/content/support-product/7603?b=1

most of your drivers installed are newer than those on Acer website
 
Nov 21, 2019
23
0
10
Ok thanks, I'll run DDU.
So I should install the Chipset driver from the acer website?
Is it good that the drivers installed are newer than those on acer website?
 

Colif

Win 11 Master
Moderator
should be newer versions of intel display drivers, from this year at least. I happen to be helping someone else with an acer and their drivers are from this year. Might not mean anything though.
Yes, get chipset driver from Acer

Its normal for there to be drivers newer than what is on laptop site, as they don't keep updating sites long after it is released. Maybe a year or so.
 
Nov 21, 2019
23
0
10
So I ran DDU, I uninstalled the NVIDIA and Intel drivers, I ran Windows Update and I now have the 25.20.100.6374 version for Intel UHD Graphics 630 and the 25.21.14.1972 version for NVIDIA GTX 1060.
I'll tell you if I got another BSOD after that.
 
Nov 21, 2019
23
0
10
Hi, I didn't have BSOD since my last message but I just had one, here is the dmp file: https://1drv.ms/u/s!ArMdUZwT8T5Kih4P2F-NAQKiluRd?e=wzkh5a and the report from whocrashed:
On Tue 26-Nov-19 9:23:54 PM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\Minidump\112619-8218-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x1C14E0)
Bugcheck code: 0xA (0x2, 0x2, 0x0, 0xFFFFF802044BDCB6)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above. This is a software bug.
This bug check belongs to the crash dump test that you have performed with WhoCrashed or other software. It means that a crash dump file was properly written out.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Tue 26-Nov-19 9:23:54 PM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\MEMORY.DMP
This was probably caused by the following module: fltmgr.sys (FLTMGR!FltDecodeParameters+0x11E8)
Bugcheck code: 0xA (0x2, 0x2, 0x0, 0xFFFFF802044BDCB6)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\WINDOWS\system32\drivers\fltmgr.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Microsoft Filesystem Filter Manager
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above. This is a software bug.
This bug check belongs to the crash dump test that you have performed with WhoCrashed or other software. It means that a crash dump file was properly written out.
The crash took place in a file system driver. Since there is no other responsible driver detected, this could be pointing to a malfunctioning drive or corrupted disk. It's suggested that you run CHKDSK.
Could you help me out? Thanks
 

gardenman

Splendid
Moderator
I ran the dump file through the debugger and got the following information: https://pste.eu/p/wHMQ.html

File information:112619-8218-01.dmp (Nov 26 2019 - 15:23:54)
Bugcheck:IRQL_NOT_LESS_OR_EQUAL (A)
Probably caused by:memory_corruption (Process: chrome.exe)
Uptime:0 Day(s), 5 Hour(s), 12 Min(s), and 05 Sec(s)

Comment: The overclocking driver "IOCBios2.sys" was found on your system. (Intel Extreme Tuning Utility)

This information can be used by others to help you. I can't help you with this. Someone else will post with more information. Please wait for additional answers. Good luck.
 

Colif

Win 11 Master
Moderator
the 2 drivers it blames are both parts of windows, so unlikely.
fltmgr.sys = Microsoft Filesystem Filter Manager. appears to tie into storage (again) - https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/

stack mentions npfs (named pipe file system) which only serves the purpose of confusing me as to what they are - https://docs.microsoft.com/en-us/windows/win32/ipc/named-pipes

I think you should look at running driver verifer as spoken about in the 2nd post in this thread - https://forums.tomshardware.com/thr...nclude-in-blue-screen-of-death-posts.3468965/ - just take the precautions i mention. It will force the driver to show its face.
 
Nov 21, 2019
23
0
10
Ok I'll run driver verifier and hope we can identify the faulty driver.
By the way yesterday I had a crash, it was not a BSOD but I had a message saying "Your PC ran into a problem and needs to restart", it was like a pop up and then the pc restarted. I took a look in the event viewer and saw 2 application errors:
Faulting application name: svchost.exe_WlanSvc, version: 10.0.18362.1, time stamp: 0x32d6c210
Faulting module name: RPCRT4.dll, version: 10.0.18362.476, time stamp: 0xf30e1c6d
Exception code: 0xc0000005
Fault offset: 0x00000000000d9ccb
Faulting process id: 0xb28
Faulting application start time: 0x01d5a5538e0760cd
Faulting application path: C:\WINDOWS\system32\svchost.exe
Faulting module path: C:\WINDOWS\System32\RPCRT4.dll
Report Id: ff7654c8-f71d-4241-9eb5-9e98af4f55d4
Faulting package full name:
Faulting package-relative application ID:

Faulting application name: lsass.exe, version: 10.0.18362.1, time stamp: 0xd5aefa73
Faulting module name: RPCRT4.dll, version: 10.0.18362.476, time stamp: 0xf30e1c6d
Exception code: 0xc0000005
Fault offset: 0x00000000000d9ccb
Faulting process id: 0x36c
Faulting application start time: 0x01d5a5538d82d1a7
Faulting application path: C:\WINDOWS\system32\lsass.exe
Faulting module path: C:\WINDOWS\System32\RPCRT4.dll
Report Id: 68b8c347-21ea-49d9-8f50-c691af669d96
Faulting package full name:
Faulting package-relative application ID:
I searched on the internet for svchost.exe_WlanSvc and saw that it might be related to the wireless adapter driver so I uninstalled it and installed one from acer website. But I don't know about lsass.exe. Maybe it is the reason of the bsod.