BSOD - Multiple Messages - Pre & Post Rebuild

[Nicholas_111]

Same as many others - multiple BSOD on custom build. Started a few months ago and I just can't get to the bottom of it.

The BSOD messages vary each time - SYSTEM_SERVICE_EXCEPTION, MEMORY_MANAGEMENT, PFN_LIST_CORRUPT, PAGE_FAULT_IN_NON_PAGED_AREA, etc

BOARD : Asus H97M-PLUS
CPU : Intel Core i7 4770S (previous i3 also having same issue)
Memory : 4 x 4Gb Crucial DDR3 PC3-12800
GPU : Asus Geforce GTX 960 (not OC)
OS DISK : Kingston SUV400

Main steps so far -
- I've upgraded the processor.
- I've done a full reinstall of Windows10.
- I've removed half the memory, then the other half.
- I've checked all drivers are manufacturer's latest.
- I've tried to diagnose with WinDbg and WhoCrashed but can't pinpoint the driver that is causing this.

Some various dumps - https://drive.google.com/file/d/0B_F4YXTojMf9eXZGR3ZzLWNaSVk/view?usp=sharing

I thought that doing the full wipe & reinstall would resolve this but it hasn't. This has been frustrating me so much. I hope someone can point me in the right direction.

Many thanks in advance.

 

[Colif]

they are all data errors one way or the other, 3 of them are suggesting its ram... last 3 in particular. They might also all just be drivers.

can you download and make a USB using memtest86. Test 1 stick at a time, any errors are too many and could point at cause. If sticks test out okay, check the slots on motherboard with a known working stick and make sure they don't report any errors as well (just test stick in each slot)

who crashed probably just blames ntoskrnl as usual.
can you upload windbg reports as well? they might help

I can't read dumps but a few around here can, I just thought I add some tips

 

[gardenman]

Hi, I ran the dump file(s) through the debugger and got the following information: https://pastebin.com/9geJHJD6

Spoiler

File: 071817-14000-01.dmp (Tue Jul 18 15:11:51.986 2017)
BugCheck 19, {d, ffffb08ca0fd3e20, 9abcecfa570b79e7, 9abcecfa560b79e7}
Probably caused by: Pool_Corruption (Process: System)

File: 071817-15953-01.dmp (Tue Jul 18 14:14:05.704 2017)
BugCheck: [PFN_LIST_CORRUPT (4E)] {99, 11117e, 2, 600011000111179}
Probably caused by: memory_corruption (Process: MpCmdRun.exe)

File: 071817-15500-01.dmp (Tue Jul 18 14:02:41.988 2017)
BugCheck: [MEMORY_MANAGEMENT (1A)] {41792, fffff48000002ea8, 1000000, 0}
Probably caused by: memory_corruption (Process: esrv.exe)

File: 071817-14421-01.dmp (Tue Jul 18 09:27:22.585 2017)
BugCheck: [FAULTY_HARDWARE_CORRUPTED_PAGE (12B)] {ffffffffc00002c4, c5d, 179a220, ffffad80ba255000}
*** WARNING: Unable to verify timestamp for win32k.sys
Probably caused by: memory_corruption (Process: MemCompression)

File: 072017-15578-01.dmp (Thu Jul 20 02:16:30.185 2017)
BugCheck: [MEMORY_MANAGEMENT (1A)] {41793, ffffe400db965e28, 9, 8}
Probably caused by: memory_corruption (Process: MsMpEng.exe)

File: 072017-14953-01.dmp (Thu Jul 20 16:17:06.990 2017)
BugCheck: [MEMORY_MANAGEMENT (1A)] {41792, fffff6805d1fee28, 1000000, 0}
Probably caused by: memory_corruption (Process: browser_broker.exe)

File: 072017-14750-01.dmp (Thu Jul 20 15:29:11.125 2017)
BugCheck: [DRIVER_OVERRAN_STACK_BUFFER (F7)] {1c8187c5a030, 2fb6679bbf70, ffffd0499864408f, 0}
Probably caused by: memory_corruption (Process: svchost.exe)

File: 072017-14453-01.dmp (Thu Jul 20 16:28:26.554 2017)
BugCheck: [KERNEL_SECURITY_CHECK_FAILURE (139)] {3, ffffb68180c955d0, ffffb68180c95528, 0}
*** WARNING: Unable to verify timestamp for win32k.sys
Probably caused by: memory_corruption (Process: System)

File: 071917-16546-01.dmp (Wed Jul 19 17:40:46.556 2017)
BugCheck: [PAGE_FAULT_IN_NONPAGED_AREA (50)] {fffff4fa40000040, 0, 0, 6}
*** WARNING: Unable to verify timestamp for win32k.sys
Probably caused by: memory_corruption (Process: System)

File: 071817-17531-01.dmp (Tue Jul 18 09:39:23.117 2017)
BugCheck 19, {22, ffff80017121a000, 1, 0}
Probably caused by: CI.dll (Process: System)

File: 071817-16312-01.dmp (Tue Jul 18 01:20:04.815 2017)
BugCheck: [SYSTEM_SERVICE_EXCEPTION (3B)] {c0000005, fffff80236c01fc7, ffffe48172648890, 0}
Probably caused by: ntkrnlmp.exe (Process: explorer.exe)

File: 072117-15484-01.dmp (Thu Jul 20 21:41:10.463 2017)
BugCheck: [MEMORY_MANAGEMENT (1A)] {41793, ffffb98115870e28, 9, 8}
Probably caused by: memory_corruption (Process: MsMpEng.exe)

File: 072117-14671-01.dmp (Thu Jul 20 22:04:22.263 2017)
BugCheck: [DPC_WATCHDOG_VIOLATION (133)] {1, 1e00, fffff800d9fef348, 0}
Probably caused by: memory_corruption (Process: WmiPrvSE.exe)

File: 072117-16578-01.dmp (Thu Jul 20 22:26:28.784 2017)
BugCheck: [MEMORY_MANAGEMENT (1A)] {41793, ffff810107a19ea8, 5, 4}
Probably caused by: memory_corruption (Process: MsMpEng.exe)

File: 072217-20640-01.dmp (Sat Jul 22 10:37:09.389 2017)
BugCheck: [SYSTEM_SERVICE_EXCEPTION (3B)] {c0000005, fffff80288124c95, ffffc38037d6b630, 0}
Probably caused by: memory_corruption (Process: svchost.exe)

I can't help you with this. Wait for someone else to reply. Good luck.

 

[Colif]

MsMpEng = Windows Defender
MPCMDRun = Defender again
Browser_Broker.exe = Part of Edge
WmPrvSE = Windows Management Instrumentation

One of the BSOD - Faulty Hardware Corrupted Page leads me to think memtest I suggested last time might help

esvr.exe could be part of Intel Driver Update Utility?

Instinct tells me its LAN drivers, might help to run an antivirus scan using something other than windows defender (like bitdefender free - https://www.bitdefender.com.au/solutions/free.html) as esvr.exe is also known to possibly be a virus.

 

[Nicholas_111]

Thanks for the suggestions.
memtest came back all clear - no errors.
I removed the Intel Driver Update Utility a few days ago as I'd read it can cause problems.
I've removed the GTX960 and haven't had any BSOD since, although only light usage since removed as was running those memtests.

 

[Colif]

Looks like you got some old files on here....

AsIO.sys (dated Wed Aug 2012) seems really old for a H97 board, either remove Asus AI Suite or update it.
TeeDriverW8x64.sys (dated Tue Jul 2015) might need an update too, its Intel Management engine Interface
RTKVHD64.sys (dated Tue May 2015) could also be updated, its Realtek HD Audio driver - see here: https://www.tenforums.com/drivers-hardware/5993-latest-realtek-hd-audio-driver-version.html
semav6msr64.sys (Dated Fri Jan 24 2014) = SEMA Software Driver.. well, that is odd: http://www.sema-soft.de/en/home/

dates on some of these make me wonder if you fresh installed win 10 at any stage?

peauth.sys (dated Sat Dec 1989) seems highly improbably... 1989? Not sure what it does - Protected Environment Authentication and Authorization Export Driver but its part of windows

your windows defender definition files appear to be from 2015, do you use it?

 

[Nicholas_111]

Colif - yes I did reinstall Windows 10 to try to resolve the BSOD issue and still got them after the reinstall. It was a full reinstall, not a repair. Previous OS was also Windows 10 Pro x64. I always put a blank TXT file on the root of C:\ just to be certain that the drive has been wiped.

I don't have the ASUS AI Suite installed. Maybe it came with a driver. I'll check for an update this evening.

That SEMA Software Driver is confusing me. It's linked to some software that I don't have (and have never heard of).

Windows Defender says it's up to date so it won't allow me to update it further. I've just done the reinstall last week so I haven't installed anything better so far - just keeping it simple to solve the BSOD issue.

I got an update for RealTek that's newer than the ASUS version.

 

[Colif]

ASio may also be part of GPU Tweak which may have come with GPU (its how I got the program)

semav6msr64.sys appears to be left over when you uninstall Intel Driver updater - that thing again

I noticed semav6msr64.sys on my system earlier today (also via Autoruns), and eventually tracked down the program which installed it - you heard it here first! It's an Intel file, and just coincidence that SEMA Software authored a driver file with the same name.

On my system the driver was installed by the Intel Driver Update Utility Installer, which I'd installed to update my Intel drivers. Uninstalling this program after use doesn't uninstall semav6msr64.sys, presumably due either to a bug in the uninstaller or to laziness of the development team who wrote it. I don't like leaving software package remnants on my system for no good reason, so removed it as follows:

1. Create a System Restore Point in case the following steps cause any problems.
2. Uninstall Intel Driver Update Utility Installer, if it appears in the installed programs list in Control Panel.
3. Rename semav6msr64.sys to semav6msr64.sys.bk [to be deleted sometime later if no problems are encountered].
4. If, and only if, you're comfortable editing the registry, delete the following keys (otherwise just leave them, they'll have negligible effect):

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SEMAV6MSR64
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\semav6msr64

https://www.tenforums.com/drivers-hardware/53785-what-semav6msr64-sys.html

realtek drivers often newer than Asus versions, especially on 97 family motherboards