Question BSOD help

Toggle sidebar Toggle sidebar
Sort by date Sort by votes
J

johnbl

Polypheme
Nov 4, 2012
10,182
230
67,290
your system was running over 5 days then you ran
EpicGamesLauncher.exe
windows started a thread then went to set the thread priority and ended up setting it to a bogus value. This caused the system to bugcheck.

most likely you have a program that is corrupting system memory which later caused the system to crash.

your system is having problems with the driver xhunter1.sys
I would turn off the system virtual memory (pagefile.sys) reboot then turn it back on. this will clear the pagefile.sys and create a new one.

i would also remove this driver:
\SystemRoot\System32\drivers\ScpVBus.sys Sun May 5 14:31:26 2013

using the microsoft tool autoruns
Autoruns for Windows - Windows Sysinternals | Microsoft Docs

the above driver is known to cause system memory corruption .

the other problems I see are all related to issues with the pagefile.sys. I would just delete it and create another.
if you want to fix it, you might update the bios to the current version and make sure you have the current version of the motherboard storage drivers installed. (as a first fix attempt, assuming it is not related to some issue with xhunter1.sys driver you should google that driver to see if it has known problems)
 
Upvote 0 Downvote
oncelx

oncelx

Nov 27, 2020
9
0
10
johnbl said:
your system was running over 5 days then you ran
EpicGamesLauncher.exe
windows started a thread then went to set the thread priority and ended up setting it to a bogus value. This caused the system to bugcheck.

most likely you have a program that is corrupting system memory which later caused the system to crash.

your system is having problems with the driver xhunter1.sys
I would turn off the system virtual memory (pagefile.sys) reboot then turn it back on. this will clear the pagefile.sys and create a new one.

i would also remove this driver:
\SystemRoot\System32\drivers\ScpVBus.sys Sun May 5 14:31:26 2013

using the microsoft tool autoruns
Autoruns for Windows - Windows Sysinternals | Microsoft Docs

the above driver is known to cause system memory corruption .

the other problems I see are all related to issues with the pagefile.sys. I would just delete it and create another.
if you want to fix it, you might update the bios to the current version and make sure you have the current version of the motherboard storage drivers installed. (as a first fix attempt, assuming it is not related to some issue with xhunter1.sys driver you should google that driver to see if it has known problems)
Click to expand...
How to delete "pagefile.sys"
 
Upvote 0 Downvote
J

johnbl

Polypheme
Nov 4, 2012
10,182
230
67,290
oncelx said:
i'm still getting bsod. Is there any other information I can give you to help me ?

new minidump: https://drive.google.com/drive/folders/1UVUalKV8zyuj5MoO_vArKQiYXhRYOPqj
Click to expand...
it looks like the system was about to go into hibernation/sleep

it made a call to some bios/cpu sleep functions, tried to save some data, then tried to compress the data. at that point it got a bugcheck
System Uptime: 1 days 3:31:10.239

i would boot windows run cmd.exe as an admin then run
powercfg.exe /energy
it will run and see if it can detect a problem, it will make a report and put it in a file (i do not remember the location but you have to copy it to a new location before you can read it)


still taking a look at the memory dump to see if there is anything useful.
 
Upvote 0 Downvote
J

johnbl

Polypheme
Nov 4, 2012
10,182
230
67,290
johnbl said:
it looks like the system was about to go into hibernation/sleep

it made a call to some bios/cpu sleep functions, tried to save some data, then tried to compress the data. at that point it got a bugcheck
System Uptime: 1 days 3:31:10.239

i would boot windows run cmd.exe as an admin then run
powercfg.exe /energy
it will run and see if it can detect a problem, it will make a report and put it in a file (i do not remember the location but you have to copy it to a new location before you can read it)


still taking a look at the memory dump to see if there is anything useful.
Click to expand...
i did not see anything very useful. the raw stack did not show any windows functions the debugger recognized.

all i can suggest would be to change to a kernel memory dump and provide a memory.dmp file so I can see what is going on with the other cpu cores, and look at some of the other subsystems.
you might be able to avoid the problem changing the system to not go into what ever sleep mode you have selected. IE go into control panel power management and tell the system not to sleep and just do a shutdown at the end of the day.

you could also
powercfg.exe /systemsleepdiagnostics
or
powercfg /systempowerreport

to see if they report something or if they cause the system to bugcheck.
the minidump does not store any info about ACPI so the debugger commands can not look at it. A kernel memory dump would have the info.

Powercfg command-line options | Microsoft Docs

main reason i am looking at the power/sleep functions is because system called
nt!HaliAcpiSleep+0x1c6
just before your started it downward spiral to the bugcheck.
hal is windows hardware abstraction level driver ( a layer of software between your hardware and the other parts of windows)
ACPI is a Advanced Configuration and Power interface
it provides a way for windows to access power functions in your motherboard bios and CPU.

something is just not right on your system and it looks like it all started with this call.
 
Upvote 0 Downvote
oncelx

oncelx

Nov 27, 2020
9
0
10
johnbl said:
i did not see anything very useful. the raw stack did not show any windows functions the debugger recognized.

all i can suggest would be to change to a kernel memory dump and provide a memory.dmp file so I can see what is going on with the other cpu cores, and look at some of the other subsystems.
you might be able to avoid the problem changing the system to not go into what ever sleep mode you have selected. IE go into control panel power management and tell the system not to sleep and just do a shutdown at the end of the day.

you could also
powercfg.exe /systemsleepdiagnostics
or
powercfg /systempowerreport

to see if they report something or if they cause the system to bugcheck.
the minidump does not store any info about ACPI so the debugger commands can not look at it. A kernel memory dump would have the info.

Powercfg command-line options | Microsoft Docs

main reason i am looking at the power/sleep functions is because system called
nt!HaliAcpiSleep+0x1c6
just before your started it downward spiral to the bugcheck.
hal is windows hardware abstraction level driver ( a layer of software between your hardware and the other parts of windows)
ACPI is a Advanced Configuration and Power interface
it provides a way for windows to access power functions in your motherboard bios and CPU.

something is just not right on your system and it looks like it all started with this call.
Click to expand...

https://drive.google.com/drive/u/0/folders/1d0IdIod6u3e_zRVyZCb0Jb6gcr_Q6vAD
 
Upvote 0 Downvote
J

johnbl

Polypheme
Nov 4, 2012
10,182
230
67,290
oncelx said:
https://drive.google.com/drive/u/0/folders/1d0IdIod6u3e_zRVyZCb0Jb6gcr_Q6vAD
Click to expand...

memory dump shows the crash was triggered by a program "notmyfault64.exe"
calling a driver called Myfault.sys

basically this is a test tool used to crash your system so people can learn to use the debugger.
NotMyFault - Windows Sysinternals | Microsoft Docs
you would want to uninstall the driver:
C:\WINDOWS\system32\drivers\myfault.sys

8: kd> lmvm myfault
Browse full module list
start end module name
fffff80504190000 fffff80504198000 myfault (no symbols)
Loaded symbol image file: myfault.sys
Image path: \??\C:\WINDOWS\system32\drivers\myfault.sys
Image name: myfault.sys
Browse all global symbols functions data
Timestamp: Wed Jun 12 11:36:53 2019 (5D014645)
CheckSum: 0000953A
ImageSize: 00008000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Information from resource tables:
 
Upvote 0 Downvote
J

johnbl

Polypheme
Nov 4, 2012
10,182
230
67,290
johnbl said:
memory dump shows the crash was triggered by a program "notmyfault64.exe"
calling a driver called Myfault.sys

basically this is a test tool used to crash your system so people can learn to use the debugger.
NotMyFault - Windows Sysinternals | Microsoft Docs
you would want to uninstall the driver:
C:\WINDOWS\system32\drivers\myfault.sys

8: kd> lmvm myfault
Browse full module list
start end module name
fffff80504190000 fffff80504198000 myfault (no symbols)
Loaded symbol image file: myfault.sys
Image path: \??\C:\WINDOWS\system32\drivers\myfault.sys
Image name: myfault.sys
Browse all global symbols functions data
Timestamp: Wed Jun 12 11:36:53 2019 (5D014645)
CheckSum: 0000953A
ImageSize: 00008000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Information from resource tables:
Click to expand...


i will take a look to see if there was something else going wrong that I can detect
Processor Version AMD Ryzen 5 3600X 6-Core Processor
Processor Voltage 8bh - 1.1V
External Clock 100MHz
Max Speed 4400MHz
Current Speed 3800MHz

Manufacturer Micro-Star International Co., Ltd
Product B450 GAMING PLUS MAX (MS-7B86)
Version 3.0

BIOS Version H.70
BIOS Starting Address Segment f000
BIOS Release Date 06/17/2020


looks like there is a bios update on 11/27/2020
MSI Global
also an amd chipset driver on 11/9/2020
hopefully it will update amdppm.sys
here are some of the amd drivers you are currently running
generally if there is a date on the file it means it came from a non microsoft source
microsoft now displays a checksum in the date field. mixing drivers oem and microsoft drivers can have issues if someone screws up.

amdgpio2.sys Sun Sep 29 20:56:01 2019 (5D917CD1)
amdgpio3.sys Mon Mar 14 03:19:36 2016 (56E69038)
AMDPCIDev AMDPCIDev.sys Tue Sep 10 21:15:11 2019 (5D7874CF)
amdppm.sys C9C03000 (This is a reproducible build file hash, not a timestamp)
amdpsp.sys Wed Jun 19 07:45:11 2019 (5D0A4A77)

your plug and play system is having a problem starting some device
it thinks it is a problem with the registry, error code was
0xc0000034
which is
Error code: (NTSTATUS) 0xc0000034 (3221225524) - Object Name not found.
I will see if I can find the device name
device was ServiceName is "ScpVBus"

cpu id:
Identifier = REG_SZ AMD64 Family 23 Model 113 Stepping 0
ProcessorNameString = REG_SZ AMD Ryzen 5 3600X 6-Core Processor
~MHz = REG_DWORD 3800

get a error trying to read what the cpumicrocode level is.
(patches to fix known CPU bugs)
generally loaded from this file:
\SystemRoot\system32\mcupdate_AuthenticAMD.dll
 
Last edited:
Upvote 0 Downvote
J

johnbl

Polypheme
Nov 4, 2012
10,182
230
67,290
johnbl said:
i will take a look to see if there was something else going wrong that I can detect
Processor Version AMD Ryzen 5 3600X 6-Core Processor
Processor Voltage 8bh - 1.1V
External Clock 100MHz
Max Speed 4400MHz
Current Speed 3800MHz

Manufacturer Micro-Star International Co., Ltd
Product B450 GAMING PLUS MAX (MS-7B86)
Version 3.0

BIOS Version H.70
BIOS Starting Address Segment f000
BIOS Release Date 06/17/2020


looks like there is a bios update on 11/27/2020
MSI Global
also an amd chipset driver on 11/9/2020
hopefully it will update amdppm.sys
here are some of the amd drivers you are currently running
generally if there is a date on the file it means it came from a non microsoft source
microsoft now displays a checksum in the date field. mixing drivers oem and microsoft drivers can have issues if someone screws up.

amdgpio2.sys Sun Sep 29 20:56:01 2019 (5D917CD1)
amdgpio3.sys Mon Mar 14 03:19:36 2016 (56E69038)
AMDPCIDev AMDPCIDev.sys Tue Sep 10 21:15:11 2019 (5D7874CF)
amdppm.sys C9C03000 (This is a reproducible build file hash, not a timestamp)
amdpsp.sys Wed Jun 19 07:45:11 2019 (5D0A4A77)

your plug and play system is having a problem starting some device
it thinks it is a problem with the registry, error code was
0xc0000034
which is
Error code: (NTSTATUS) 0xc0000034 (3221225524) - Object Name not found.
I will see if I can find the device name
device was ServiceName is "ScpVBus"

cpu id:
Identifier = REG_SZ AMD64 Family 23 Model 113 Stepping 0
ProcessorNameString = REG_SZ AMD Ryzen 5 3600X 6-Core Processor
~MHz = REG_DWORD 3800

get a error trying to read what the cpumicrocode level is.
(patches to fix known CPU bugs)
generally loaded from this file:
\SystemRoot\system32\mcupdate_AuthenticAMD.dll
Click to expand...
overall i did not see anything to messed up.
just the driver pending a start and the outdated firmware and maybe chipset drivers of various dates.
i did not see anything running that would be unexpected.

looking at internal logs, did not see anything that looked out of place.
from
!wdfkd.wdfcrashdump loader
!wdflogdump (of the various logs) just showed some stuff going to sleep
(might be wrong if you are running with sleep turned off)
 
Last edited:
Upvote 0 Downvote
J

johnbl

Polypheme
Nov 4, 2012
10,182
230
67,290
oncelx said:
i'm still getting bsod. I updated the bios and chipset driver

new minidump: https://drive.google.com/drive/folders/1lcOEmFhZkfUyy1SiPtyPox6Y9UiDEXI6
Click to expand...
chrome was the process running (it uses gpu hardware acceleration by default now):
looked like a bug in a graphics driver. basically directx was cleaning up some list of objects and one was invalid.
normally you would suspect the graphics driver freeing a object twice, or some other program corrupting of the list.

to figure it you need to change the memory dump type to kernel and provide a kernel dump (memory.dmp)
this will show what the other cpu cores are doing and what other programs are running.

you might also disable chrome extensions or disable its access to the GPU for hardware acceleration. (if you think the problem could be chrome related or malware in chrome)
 
Upvote 0 Downvote
J

johnbl

Polypheme
Nov 4, 2012
10,182
230
67,290
johnbl said:
chrome was the process running (it uses gpu hardware acceleration by default now):
looked like a bug in a graphics driver. basically directx was cleaning up some list of objects and one was invalid.
normally you would suspect the graphics driver freeing a object twice, or some other program corrupting of the list.

to figure it you need to change the memory dump type to kernel and provide a kernel dump (memory.dmp)
this will show what the other cpu cores are doing and what other programs are running.

you might also disable chrome extensions or disable its access to the GPU for hardware acceleration. (if you think the problem could be chrome related or malware in chrome)
Click to expand...
second bugcheck was in
ctfmon.exe
it looks like it was trying to create a file and cause bogus call.
here is a description of the program:
The ctfmon process is used by Microsoft Office to activate the Alternative User Input Text Input Processor and the Microsoft Language Bar

really never looked at this program before. it looks like a filter driver called
bindflt!BfGetPreCreateFileName
just before the crash. bindflt.sys should be the driver name
------------
last bugcheck showed a idle cpu that just tried to run some location in memory
the raw stack shows a call amdppm!ReadGenAddr
then a totally strange call to tcpip!TcpTimerUpdateNextExpirationTick

normally you would not see these together.
does your bios have some network extensions enabled? something with network packet filters or bios network stack?
if so it might be broken. (this might be a key issue if you have special bios supported network settings, most people would leave them disabled by default) new windows security could treat them as a malware attack if you have secure boot turned on.
 
Last edited:
Upvote 0 Downvote
oncelx

oncelx

Nov 27, 2020
9
0
10
johnbl said:
------------
last bugcheck showed a idle cpu that just tried to run some location in memory
the raw stack shows a call amdppm!ReadGenAddr
then a totally strange call to tcpip!TcpTimerUpdateNextExpirationTick

normally you would not see these together.
does your bios have some network extensions enabled? something with network packet filters or bios network stack?
if so it might be broken. (this might be a key issue if you have special bios supported network settings, most people would leave them disabled by default) new windows security could treat them as a malware attack if you have secure boot turned on.
Click to expand...


How can I disable this?
my mainboard: Msi B450 Gaming Plus Max
 
Upvote 0 Downvote
J

johnbl

Polypheme
Nov 4, 2012
10,182
230
67,290
oncelx said:
How can I disable this?
my mainboard: Msi B450 Gaming Plus Max
Click to expand...
at this point I think the problem is in the new release of the AMD CPU, bios support or chipset.
motherboard vendors do not seem to have a fix yet so your best bet is that AMD knows what the problem is and they have made a fix in their drivers.

So: try installing the drivers from here:
AMD Drivers and Support for Radeon, Radeon Pro, FirePro, APU, CPU, Ryzen, desktops, laptops

select
processors->AMD ryzen Processors->AMD ryzen 5 desktop Processor-> then select your cpu.
and install the drivers and see if it helps.

let us know if it helps or not.
 
Upvote 0 Downvote
You must log in or register to reply here.

TRENDING THREADS

Latest posts

Moderators online

Share this page

COMPANY
RESOURCES
FOLLOW
Top Bottom