BSOD caused by Ntfs.sys and ntoskrnl.exe (Windows 10, 2018)

Page 3 - Seeking answers? Join the Tom's Hardware community: where nearly two million members share solutions and discuss the latest tech.
Status
Not open for further replies.

JayTee3

Distinguished
May 9, 2017
163
2
18,695


I just did this, removed the RTCore64.sys and there were 3 mentions of the NTIOlib so its odd that it needs to be deleted but deleted all 3, also contacted nvidia and did a fresh reinstall using Revo pro instead of DDU this time and removed all signs and registery and etc of NVIDIA. So hopefully im okay, will update you.
 

JayTee3

Distinguished
May 9, 2017
163
2
18,695


No crash for 14 days (well maybe 1? but eh)... until now
https://1drv.ms/u/s!AtKsB23i-mF6pzKYzT1G2Y6Tyzww

can u take a look at this?
 
looks like a service called plays.exe created a file, then tried to resize it but the pool was corrupted. Pool is just data stored in memory by a device driver. the error indicated that the memory block was modified when it was free (meaining no device driver owned the memory) Most likely some other driver had data in memory and wrote beyond its owned memory block. To find this you would have to have a kernel or full memory dump and you would need to run verifier.exe functions to cause the system to bugcheck when a driver attempts to access memory that is not assigned to it.






 

JayTee3

Distinguished
May 9, 2017
163
2
18,695


So what should I do? Full memory dump is impossible now, I could do kernel I guess.

Do u want me to run verifier.exe? And if so can u run me through it?
 
first set your memory dump type to kernel, so proper debug info is saved when the system bugchecks.
then start cmd.exe as an admin then run
verifier.exe /standard /all
and reboot your system.

NOTE: be sure you know how to get into windows safe mode, in case the system bugchecks on the reboot process.
if it does you would run this command to turn off verifier after the bugcheck.
verifier.exe /reset

you want to run until you get the next bugcheck, then turn off verifier or you machine will run slowly until you do.

with verifier running, is some driver attempts to modify memory that it no longer owns the system will call a bugcheck and it should name the driver that attempted to make the change. Without verifier checking, the system does not check and just uses the modified data and later crashes. verifier should catch the case where one driver frees up a memory block to the system, the system gives the memory block to a second driver, then the first driver modifies the memory block (it does not own) it should bugcheck here rather than when the second driver tries to use the modified data which may or may not cause a bugcheck.







 

JayTee3

Distinguished
May 9, 2017
163
2
18,695


Alright, will do then update you
Also heres one from today https://1drv.ms/u/s!AtKsB23i-mF6pzN8VJO0ZT9Qy9bH
It's probably the same thing but if its something else let me know

Thanks and merry christmas!
 

JayTee3

Distinguished
May 9, 2017
163
2
18,695


I did this and it just crashes and restarts repeatedly (3 times till it has the repair windows screen, then had to launch into safe mode with cmd to reset verifier). What do I do?
 

JayTee3

Distinguished
May 9, 2017
163
2
18,695
Also heres the kernel memory dump from the crash just today https://1drv.ms/u/s!AtKsB23i-mF6pzQQ5XiKmnlXT5D4



 
this is a minidump file, showing a memory management bugcheck with a undocumented error code
while doing some calls to virtual memory. (pagefile.sys)

verifier flags not turnned on.

kernel dump files are stored in a different file name and location by default.
look for the file c:\windows\memory.dmp




 

JayTee3

Distinguished
May 9, 2017
163
2
18,695








As i told you, I can't turn the verifier flags on as it puts my pc in a restart loop
 
you turn them on, reboot, the system bugchecks and makes a memory dump, then you boot into safe mode run
verifer.exe /reset and reboot back in to normal mode. then copy the memory dump to a cloud server and post a link.
the verifier only needs to be running until the memory dump is made.
best if you change the memory dump type to kernel so that the proper debug info will be saved.
even if you can not get verifier running the kernel memory dump will have much more debug info and internal error logs.



 

JayTee3

Distinguished
May 9, 2017
163
2
18,695


"You turn them on, reboot"

No, what happens when i turn on verifier my computer WONT EVEN START UP PROPERLY. Verifier.exe puts it in an endless loop of it, and no it doesn't make a memory dump or mini dump or anything.
 
get the system to produce a kernel memory dump, it will be a much larger file but it will contain a lot more debug info.
you can google "how to force a memory dump using a keyboard" then make the registry settings and force a memory dump while the system is working. let the system run for some time (say 10 minutes) before you force the memory dump. I can take a look at the internal error logs and see if something strange is going on.



 

JayTee3

Distinguished
May 9, 2017
163
2
18,695


LUFLoiV.png


Like this then restart?

( following instructions from https://www.dell.com/support/article/au/en/audhs1/sln283146/windows-server-how-to-force-windows-to-generate-a-memory-dump-using-the-keyboard?lang=en )
 
yep reboot and try the keyboard input to force a memory dump



 

JayTee3

Distinguished
May 9, 2017
163
2
18,695



I waited till it crashed properly instead of a force crash to be more realistic, gosh my internet sucks so this took overnight to upload the kernel memory dump but here

https://drive.google.com/file/d/1Em9xAUTk_EmJRRiiNyJcA1EyCrG4FY_6/view?usp=sharing
 
guessing that your usb 3 port 4 has a logictech webcam on it
since you have a old driver for it installed:
Logitech USB Video Class Driver (WebCam)
\SystemRoot\system32\DRIVERS\lvuvc64.sys Mon Oct 22 19:12:08 2012
https://carrona.org/drivers/driver.php?id=lvuvc64.sys

and the bugcheck was in video code and the usb driver was some kind of video driver.

you should see if you can get a update for the driver and I would put it on a usb2 port.
------------------------
download and run usb port viewer from https://www.uwe-sieber.de/usbtreeview_e.html
find out what is on usb 3 port 4 and either fix the device or remove it and the driver.
some devices might not work on usb 3, some devices might require a custom updated driver, some devices might also require a firmware update from the vendor of the device. since the device has failed or was removed I can not read what the device was.

you might find that putting it on a usb 2 port may work for you. depending on what the device is.
it looks like the device stopped working and the system tried to reset the device to get it working again.


--------------
looks like the system thinks you have a video device on usb 3 port 4 that was removed.
the system tried to clean up the memory it used but there was something still trying to access the memory. (looks like your virus scanner)


4) !device_info 0xffffa58865bbb570, !devstack ffffa58864f8b060
Current Device State: EnumeratedAsFailedUnknown.WaitingForDevicePortEventsForFailedDevice
Desc: <none>
USB\VID_0000&PID_0000&REV_0000 Vendor ID not listed with USB.org
!wdfhandle 0x5a779b074fd8 (UCXUSBDEVICE)Error: Unable to get controller specific info for device with wdfhandle 0x00005a779b074fd8


here is the error log for the device:
[63] <UCXIoctlSuccess> CheckingIfFirstEnumTryAfterReset1
[62] <OperationSuccess> EnablingDeviceInUCX
[61] <OperationSuccess> CreatingUCXDefaultEndpoint
[60] <OperationSuccess> CreatingUCXDevice
[59] <PortResetComplete> SettingSpeedFlagFor20Devices
[58] <Push> Resetting1
[57] <TimerFired> EnumeratingAtAddressZeroInEnum
[56] <No> StartingTimerForEnumRetryInEnumWithAddr0Ownership
[55] <OperationFailure> CheckingIfEnumRetryReachedMaximumInEnumWithAddr0Ownership
[54] <Pop> EnumeratingAtAddressZeroInEnum
[53] <OperationSuccess> ReturningDeviceOperationFailureInEnumAtZero
[52] <OperationSuccess> DeletingUCXDeviceOnOperationFailure
[51] <UCXIoctlSuccess> DeletingUCXDefaultEndpointOnOperationFailure
[50] <OperationFailure> DisablingDeviceInUCXOnOperationFailure
[49] <TransferFailure> ValidatingDeviceDescriptorInEnumAtZero
[48] <TimerFired> GettingDeviceDescriptorInEnumAtZero
[47] <No> WaitingForPostReset1ExtendedTimer
[46] <UCXIoctlSuccess> CheckingIfFirstEnumTryAfterReset1
[45] <OperationSuccess> EnablingDeviceInUCX
[44] <OperationSuccess> CreatingUCXDefaultEndpoint
[43] <OperationSuccess> CreatingUCXDevice
[42] <PortResetComplete> SettingSpeedFlagFor20Devices
[41] <Push> Resetting1
[40] <TimerFired> EnumeratingAtAddressZeroInEnum
[39] <No> StartingTimerForEnumRetryInEnumWithAddr0Ownership
[38] <OperationFailure> CheckingIfEnumRetryReachedMaximumInEnumWithAddr0Ownership
[37] <Pop> EnumeratingAtAddressZeroInEnum
[36] <OperationSuccess> ReturningDeviceOperationFailureInEnumAtZero
[35] <OperationSuccess> DeletingUCXDeviceOnOperationFailure
[34] <UCXIoctlSuccess> DeletingUCXDefaultEndpointOnOperationFailure
[33] <OperationFailure> DisablingDeviceInUCXOnOperationFailure
[32] <TransferFailure> ValidatingDeviceDescriptorInEnumAtZero
[31] <Push> GettingDeviceDescriptorInEnumAtZero
[30] <OperationSuccess> WaitingForDevicePortEventsForFailedDevice
[29] <PDOD0ExitFinal> FlushingPnpEventsForFailedDevice
[28] <Push> WaitingForDevicePortEventsForFailedDevice
[27] <OperationSuccess> EnumeratedAsFailedUnknown
[26] <PDOD0Entry> D0EntryForUnknownDevice
[25] <Pop> WaitingForD0EntryForFailedDevice
[24] <OperationSuccess> WaitingForDevicePortEventsForFailedDevice
[23] <PDOInstallMSOSExt> FlushingPnpEventsForFailedDevice
[22] <OperationSuccess> WaitingForDevicePortEventsForFailedDevice
[21] <PDOInstallMSOSExt> FlushingPnpEventsForFailedDevice
[20] <Push> WaitingForDevicePortEventsForFailedDevice
[19] <OperationSuccess> WaitingForD0EntryForFailedDevice
[18] <Pop> ReportingFailedUnknownDeviceToPnp
[17] <OperationSuccess> ReturningOperationSuccessInReportingUnknownDevice
[16] <OperationSuccess> MarkingUnknownDeviceAsFailed
[15] <Push> CreatingUnknownChildPDOAndReportingToPnp
[14] <OperationSuccess> ReportingFailedUnknownDeviceToPnp
[13] <OperationFailure> ReleasingPowerReferenceOnHubOnEnumerationFailure
[12] <Pop> Enumerating
[11] <OperationSuccess> ReturningOperationFailureInEnum
[10] <PortDisabled> ReleasingAddressZeroOwnershipOnEnumFailure
[ 9] <Yes> DisablingOnEnumAfterFailureInEnumWithAddress0Ownership
[ 8] <OperationFailure> CheckingIfEnumRetryReachedMaximumInEnumWithAddr0Ownership
[ 7] <Pop> EnumeratingAtAddressZeroInEnum
[ 6] <OperationSuccess> ReturningDeviceOperationFailureInEnumAtZero
[ 5] <OperationSuccess> DeletingUCXDeviceOnOperationFailure
[ 4] <UCXIoctlSuccess> DeletingUCXDefaultEndpointOnOperationFailure
[ 3] <OperationFailure> DisablingDeviceInUCXOnOperationFailure
[ 2] <TransferFailure> ValidatingDeviceDescriptorInEnumAtZero
[ 1] <TimerFired> GettingDeviceDescriptorInEnumAtZero
[ 0] <No> WaitingForPostReset1ExtendedTimer
 

JayTee3

Distinguished
May 9, 2017
163
2
18,695



1) I'm confused as I updated the most recent logitech webcam driver for my webcam? Theres these recent downloads for the camera but they all seem like programs and nothing to do with real drivers for the camera: https://support.logitech.com/en_us/product/hd-pro-webcam-c920/downloads

So you're saying to see if i can update it and put it in a usb 2 port? I didn't even realize it was in a usb 3, thanks for the heads up I guess.

2) There is nothing running at port 4. Also from the viewer I don't think I have any usb 2 slots. https://i.imgur.com/d03wzpC.png

But in the same image looks like port 6 is corrupting?

3) Would the video device be the webcam? I assume so right? But in the USB viewer it shows port 6 is the issue but port 14 (the webcam) is fine
 
google "how show hidden or removed devices in device manager"
then see if the system has a removed device that still has a driver associated with the port

usb device are kind of strange, the drivers get associated with the actual port and they get hidden when the device is removed.





 

JayTee3

Distinguished
May 9, 2017
163
2
18,695


Also I checked the back of my computer and they're all listed there everything that is plugged in seems to be fine so yeah it might be that

This is what it shows in device manager after the instructions from google https://i.imgur.com/1yU7xPn.png

Should I just remove/uninstall the port driver?
 
yes, uninstall the port, windows plug and play will reinstall the driver a few seconds later. see if it still thinks there is a device connected when it reinstalles. (hopefully it will not bugcheck)
you might also go in bios and see if there is anything special about that port. one port may chain together a bunch of other ports. since you have a usb3 and a usb 3.1 port your usb 2 devices might be emulated by the usb 3.1 device.
if it has bugs in the chip or driver it might not work correctly. you should check to see if your motherboard has a update for the intel cpu chipset and the asmedia 3.1 usb chipset.
(these also depend on the bios version so you would have to make sure the bios is current)
the intel usb 3 ports are more likely to have fewer bugs since the driver will get updated via windows update.





 

JayTee3

Distinguished
May 9, 2017
163
2
18,695


How would I do this in BIOS?
 
you would do this in control panel device manager. right mouse click to bring up the menu


if you disable hardware in bios, then windows will not see the hardware.


 

JayTee3

Distinguished
May 9, 2017
163
2
18,695


So do I disable it or go into bios and check first? I'm not sure what u said, it sounded like u said i should go into bios and see if it will break any other usb ports if i disable that port before uninstalling it in device manager?
 
I would use control panel device manager first, to delete the device and let plug and play reinstall it.
if that does not help, I would look at the options in bios for the device. There could be some option to force certain version support, or to turn off certain ports.



 
Status
Not open for further replies.