BSOD caused by Ntfs.sys and ntoskrnl.exe (Windows 10, 2018)

Status
Not open for further replies.

JayTee3

Distinguished
May 9, 2017
163
2
18,695
In terms of stuff I've done:

I've done a full memtest86, removed conflicting programs (anti-virus) and updated drivers to deal with this problem, sfc scans and more.

Memtest86 turned out fine so I'm not really sure what the problem is. Help?

BSOD was bug check 0x00000139 in event viewer which is kernel_security_check_failure
 

JayTee3

Distinguished
May 9, 2017
163
2
18,695


It has had an xbox controller plugged into it previously yeah, but I haven't for a while and dont have it 24/7 connected. Just plug the USB in whenever i wanna play something

I thought it was my microphone (Blue Yeti Pro) and so did their support so I sent that back, the crashes have become a lot less frequent but still crashes.
 

JayTee3

Distinguished
May 9, 2017
163
2
18,695
I got this in bluescreenview on my minidump

ntoskrnl.exe+1a4b53

(PFN_LIST_CORRUPT)

Crashed when i was doing nothing, wasn't even on my pc, just turned on monitor to see a frozen BSOD at 100%.

Reason why I'm commenting this is that when u search that on google it finds no results, yet for other + whatever afterwards it does, but not for 1a4b53. Weird
 

JayTee3

Distinguished
May 9, 2017
163
2
18,695
MERGED QUESTION
Question from JayTee3 : "BSOD loop on startup (driver_verifier_detected_violation)"



Ran it on safe mode with CMD (in advanced settings and then more settings on windows repair, so kinda hidden, then pressing 6 when u start up). Then wrote verifier.exe /reset

Seemed to fix it.

How can I see what caused it tho?
 

Colif

Win 11 Master
Moderator
I asked you this already in that other thread

Can you follow option one on the following link - here
and then do this step below: Small memory dumps - Have Windows Create a Small Memory Dump (Minidump) on BSOD

that creates a file in c windows/minidump after the next BSOD
copy that file to documents
upload the copy from documents to a cloud server and share the link here and I will get someone to convert file into a format I can read

the guy I asked to look at threads said the file sizes are too big for his internet speed. Mini dumps are only 256kb, not multiple gb. Much easier for him to dl and convert.

what motherboard do you have? I would make sure you have latest LAN drivers as that might be reason Kapersky is bugging out
 

gardenman

Splendid
Moderator
Hi JayTee3. I'm sorry I can't download the full dumps. It would take me 3+ hours to download the smallest one. Usually Kernel dumps are the largest we see on here, which are up to 2GB each and less when compressed. I guess you had it to set to "Full Memory Dumps" or something like that. We usually only see Kernel or minidump. More info on dumps: https://support.microsoft.com/en-us/help/254649/overview-of-memory-dump-file-options-for-windows

The links are still good as there are others who may be able to use those dump files and gather more information from them than I could anyway.

I ran the 2 minidumps through the debugger and got these results: https://pste.eu/p/aYzy.html

File: 092318-6343-01.dmp (Sep 22 2018 - 22:02:10)
BugCheck: [IRQL_NOT_LESS_OR_EQUAL (A)]
*** WARNING: Unable to verify timestamp for klif.sys
Probably caused by: memory_corruption (Process: Steam.exe)
Uptime: 0 Day(s), 0 Hour(s), 47 Min(s), and 11 Sec(s)

File: 092218-6171-01.dmp (Sep 22 2018 - 06:39:25)
BugCheck: [DRIVER_IRQL_NOT_LESS_OR_EQUAL (D1)]
Probably caused by: NETIO.SYS (Process: System)
Uptime: 0 Day(s), 10 Hour(s), 24 Min(s), and 51 Sec(s)

2 new drivers that I haven't seen before: Blue Yeti Pro Microphone
This means nothing other than I haven't seen them before. They are rare as I've seen 100's (or 1000's) of dumps on here.

The overclocking driver "RTCore64.sys" was found on your system.
The overclocking driver "NTIOLib_X64.sys" was found on your system.

Motherboard: https://www.msi.com/Motherboard/Z270-SLI.html
You are using BIOS version: 1.90 There is a slightly newer one but I would wait for more advice from others before deciding to update or not. Always verify such information before attempting to update. Note: Updating your BIOS can be risky. Never try it when you might lose power (lightning storms, recent power outages, etc).

I can't help you with this. Wait for additional replies. Good luck.
 

Colif

Win 11 Master
Moderator
I would go to here - Link - look, on the Utility tab and download live update 6 and run it on your motherboard and let it update the drivers it finds

if you already have MSI live update 6 installed, perhaps make sure its the newest version, as its newest version is only 1 week old.

I can see newer versions of the Intel LAN drivers compared to ones you are using. Your installed drivers dated Aug 23 2016, whereas newest on MSI web site are dated June 27 2018 which might make the errors go away

other thought is remove malwarebytes as it might be conflicting with Kapersky
 

JayTee3

Distinguished
May 9, 2017
163
2
18,695


I've used both live update with the newest versions and also thats weird my LAN drivers are 2016 as doesn't live update update LAN drivers? Thanks.

[strike]Edit: Also whats weird is that I think live update doesn't work for me, even after just updating I think everytime I've downloaded on liveupdate the updates. They never actually install, it scans, downloads the ones I want, says they're done, quit the app and etc and they never update to the version it said it was downloading?[/strike]

Edit2: Seems by pressing total installer and restarting seemed to fix it, but just pressing download didn't work. Well then.
 

JayTee3

Distinguished
May 9, 2017
163
2
18,695


For the first part which I won't quote, yes I had it set to full memory dump on purpose due to kaspersky support wanting the full dumps.

For the rest,
1. When were the blue yeti microphone dump errors? What the date on the dump? Because of the issue I had with the blue yeti microphone I got it replaced under warranty so it could of been before I replaced it.

2. What are those overclocking drivers? do you know? I don't overclock any of my equipment (cpu/gpu or anything) as I haven't needed to so yeah.
 

gardenman

Splendid
Moderator
1. These two drivers I've never seen before after reading many dump files on here. I also said "This means nothing other than I haven't seen them before."

May 16 2014 - blueyetipro_x64.sys - Blue Yeti Pro Microphone https://www.bluedesigns.com/
May 16 2014 - blueyetiproks_x64.sys - Blue Yeti Pro Microphone https://www.bluedesigns.com/

There were not mentioned in any error. Dump files include a list of drivers loaded at the time of the crash which we use to help determine possible causes of a crash.

2. Overclocking a system and overclocking drivers can cause BSODs. The overclocking drivers may or may not be causing problems. Wait for further instructions from Colif or others on whether or not you should remove these.
 

JayTee3

Distinguished
May 9, 2017
163
2
18,695


1. Oh sorry, your English isn't the easiest to understand. Alright I think I get what you're saying.

2. Okay thanks?

Also some extra information:
https://www.reddit.com/r/techsupport/comments/9jk2hx/how_do_i_find_the_cause_of_driver_verifier/
(and then press continue thread or click this)
https://www.reddit.com/r/techsupport/comments/9jk2hx/how_do_i_find_the_cause_of_driver_verifier/e6sao0i/

This thread basically shows the solution I think

1) Taking out one of the rams randomly (in slot #3) seemed to of fixed the crashes, no crashes for 3+ days (normally daily)
2) Either that RAM piece is faulty, or that putting them next to each other in slot #2 and #3 corrupted it, I'll put them in slot #2 and #4 tommorow like he said and see if it crashes

Thanks guys.
 

JayTee3

Distinguished
May 9, 2017
163
2
18,695






since you guys wanted a small memory dump, here u go https://1drv.ms/u/s!AtKsB23i-mF6pmrqrFUW_cCry5RE

Just fixed it 90% due to swapping RAM around to slot 2 and 4 instead of 2 and 3. But still getting crashes every ~3 days instead of everyday. Heres one with an error code i havent seen before
 

gardenman

Splendid
Moderator

JayTee3

Distinguished
May 9, 2017
163
2
18,695


You said you could help if i gave u a small dump and complained u couldnt without one? Im confused.

Anyway heres another with a diff BSOD message: (first one was store_data_structure_corruption)
This one was kernel_security_check_failure which was common for me before. https://1drv.ms/u/s!AtKsB23i-mF6pmtnOgbFs0DnRjnQ
 

gardenman

Splendid
Moderator
Sorry for the misunderstanding, but I read the dump files and post the info about them which can give others the chance to help you. I just read the dump files and post the info for others. If I had to help, I would simply be random guessing. I would probably start by getting to you update most of your older drivers (if any), then do hardware tests. Just like the info listed on the "help" page that I post. That's why I tack that onto the end of my messages when I read a dump file. Wait for others to reply (they can use the info that I post about your dump files) and they can provide better information than I can.

Remember, those who help on here are also volunteers. I don't claim to be an expert. I'm just another user such as yourself and I decided to try to help out here one day. :)

I ran the dump file through the debugger and got the following information: https://pste.eu/p/rT59.html

File: 101518-6359-01.dmp (Oct 14 2018 - 20:42:40)
BugCheck: [KERNEL_SECURITY_CHECK_FAILURE (139)]
*** WARNING: Unable to verify timestamp for nvlddmkm.sys
Probably caused by: Pool_Corruption (Process: System)
Uptime: 0 Day(s), 1 Hour(s), 38 Min(s), and 46 Sec(s)

The nvlddmkm.sys file is a NVIDIA graphics card driver. There are a few things you can do to fix this problem. First off, try a full uninstall using DDU in Safe Mode then re-install the driver (more information). Or try getting the latest version of the driver. Or try one of the 3 most recent drivers released by NVIDIA. Drivers can be found here: http://www.nvidia.com/ or you can allow Windows Update to download the driver for you, which might be a older/better version.

I can't help you with this. Wait for additional replies. Good luck.
 

Colif

Win 11 Master
Moderator
Pretty sure I said I can't read the dump files and would get someone else to convert them for me... Gardenman is that person. I realize you just want to get a fix but he was just doing what I asked. Seems he can help after all as error is pointing at Nvidia

Do you use Display Port to connect monitor? Even if you don't, this might help as the Nvidia drivers you have installed were causing BSOD last month - https://www.nvidia.com/object/nv-uefi-update-x64.html

there is a new BIOS for your motherboard dated 17 July 2018 and a new version of Intel Management Engine Interface that matches the BIOS (released same day) - https://www.msi.com/Motherboard/support/Z270-SLI#down-driver&Win10%2064

See if any newer drivers for the Blue Yeti
 
I would think your old webcam driver is the cause of the problem. remove it and see if you still get problems
(usb driver share the pci/e bus and can mess up video cards if they are poorly written or in this case do not conform to the usb 2.x specs)

remove the driver if you can, or update it. if the device is built in, then disable it in the bios. if you can not find a way to uninstall it, then run https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns
and find the menu item to hide microsoft entries, then find the driver and uncheck it so it will not load. (or delete the entry) also use the tool to take a look at the tasks in the task scheduler, remove any hack tools.

you should also run cmd.exe as an admin and run
dism.exe /online /cleanup-image /restorehealth

remove the overclock software while trying to figure out the problem.
--------------
stack overflow into the graphics driver from what ever was running at location
0xffff8001`29050030

you would have to provide a kernel memory dump or a full memory dump to figure out this problem.
-virus scanner is really messed up
- overclock driver is still installed (2 of them)
NTIOLib_X64.sys Wed Mar 29 00:26:33 2017
RTKVHD64.sys Tue Sep 4 03:45:04 2018
old driver installed:
Logitech USB Video Class Driver (WebCam) ( i would uninstall and disable the hardware)
lvuvc64.sys Fri Aug 19 02:26:11 2011
.
machine info:
BIOS Version 1.90
BIOS Starting Address Segment f000
BIOS Release Date 01/30/2018
Manufacturer MSI
Product Name MS-7A59
Version 1.0
memory from different vendors:
bank 0: none
bank 1: 8 gb CT8G4DFS8213.C8FBR1
bank 2: none
bank 3: 8gb 9905625-030.A00G

cpu shipped Q1'17

Processor Version Intel(R) Core(TM) i7-7700K CPU @ 4.20GHz
Processor Voltage 8bh - 1.1V
External Clock 100MHz
Max Speed 8300MHz
Current Speed 4200MHz




 

JayTee3

Distinguished
May 9, 2017
163
2
18,695




Heres another small dump: https://1drv.ms/u/s!AtKsB23i-mF6pmzPdsMBzsc8cts8

I'll answer one at a time

Gardenman:
I mean I can try the nvidia thing thanks. I'm just curious why do u have to do it in safe mode? I will but just curious on why

Colif:
1. No
2. I guess I can update my BIOS... never helps but aight
3. Nope, and I've contacted them several times, but they haven't released one in a while

Johnbl:
1. I have several full memory dumps.. actually theres 3 full memory dumps in this thread if u want to go through them
2. Don the dism command several times :/
3. How do I remove the overclock software?
 

JayTee3

Distinguished
May 9, 2017
163
2
18,695


Also another thing, you say theres a new BIOS update for 17 july, which is correct. But the IMEI is 27th of the June... Thats not the same day. And I'm pretty sure I have that one already considering Live update is all up to date


Edit: Updated BIOS and done a uninstall of drivers in safemode and installed the newest drivers. See what happens I guess.
 

Colif

Win 11 Master
Moderator
You are correct with dates, I may have been tired.

as for why run DDU in safe mode. well, in that mode the only drivers being used are windows default ones. Its likely that if you try to uninstall display drivers while they are being used, the PC will freak out and leave you with no picture or turn monitor off (Like it does to me). At least in safe mode you will still have a picture afterwards and PC will boot up using the basic display drivers

as for overclock software, if you have MSI Live update 6 installed, the file john is referring to can also be part of it.
 
use this tool to remove overclock drivers. (select hide microsoft entries, then find the driver and uncheck or delete the entry)
https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns

you could also use the uninstall program for the overclock software.

if you have removed the old webcam driver, and the overclock software and still get the problem, provide a link to your kernel dump. turn on verifier and provide a link to the next kernel memory dump.






 
Status
Not open for further replies.