Question BSOD ntoskernel.exe

[JakubVlcek]

Hey,
I own a laptop Lenovo legion with AMD Ryzen 7 4800h processor and Nvidia Geforce RTX 2060 GPU and i keep experiencing blue screen of death while playing games.

Here I am posting my Minidump file and also screenshot from blscrnwiever where you can see that it crashes quite often. Sometimes there is a different error code but always the same driver cause ntoskrnl.exe.
If someone can give me any advice on how to fix this I would be grateful.

Link: https://www.mediafire.com/folder/vpj3essf0wpou/BSOD

Thank you in advance for your help!

 

[Fix_that_Glitch]

Are your gpu drivers up to date? What kind of memory do you have in the laptop? Is anything overclocked or using any overclocking program?

 

[JakubVlcek]

Are your gpu drivers up to date? What kind of memory do you have in the laptop? Is anything overclocked or using any overclocking program?

I actually already tried to completely remove the graphic drivers and reinstalled it again but i left out GeForce Experience since it s not vital and it was happening even before. I restored default settings in BIOS because I was not sure if laptop was overclocked. So no overclocking from my side.

Memory: 16 GB 2x 8GB - DDR4 3200MHZ - I am not an expert so tell meif you need some more info about it and how can i access it .

If it helps it is this laptop: LENOVO Legion 5 15ARH05H

 

[Fix_that_Glitch]

Go here and run the diagnostics program on this page. See if it tells you anything. laptops and netbooks :: legion series :: legion 5 15arh05h - Lenovo Support US

 

[JakubVlcek]

Go here and run the diagnostics program on this page. See if it tells you anything. laptops and netbooks :: legion series :: legion 5 15arh05h - Lenovo Support US

It just finished and no problems were found. :/

 

[Satan-IR]

Do you have any anti-virus security suite installed? Avast perhaps?

Have you check RAM with Memtest86?

 

[JakubVlcek]

Do you have any anti-virus security suite installed? Avast perhaps?

Have you check RAM with Memtest86?

I just got another error out of the blue - minidump is here: https://www.mediafire.com/folder/1uqvipz6mf2ha/BSOD_2

To reply: I do not currently have any antivirus, I had installed kaspersky to check for viruses but it found nothing.

I tested my memory just by Windows memory diagnostic tool and it came without any error.
So i tested just now with memtest64 and did 6 loops with no error. I am not sure how many loops are considered a good practice.

Could a Windows reinstall solve my problem ?

 

[Satan-IR]

I just got another error out of the blue - minidump is here: https://www.mediafire.com/folder/1uqvipz6mf2ha/BSOD_2

To reply: I do not currently have any antivirus, I had installed kaspersky to check for viruses but it found nothing.

I tested my memory just by Windows memory diagnostic tool and it came without any error.
So i tested just now with memtest64 and did 6 loops with no error. I am not sure how many loops are considered a good practice.

Could a Windows reinstall solve my problem ?

I asked because I've seen antivirus sometimes resulting in "64_IP_MISALIGNED" which was in the previous dump.

Many BSODs are caused by drivers and sometimes by hardware especially faulty RAM. If neither Windows memory diagnostic and Memtest didn't show errors the RAM is probably OK.

Therefore, a clean installation of Windows might help by removing possible corrupt or faulty drivers.

I'd say wait for input by others including @Colif before reinstalling Windows.

 

[JakubVlcek]

So, today I reinstalled Windows to Windows 10 Pro and it happened again twice in one hour. I did a clean installation from USB and problem is still there. I would be super grateful for any other suggestions. I am not even sure if it counts as a faulty piece and if warranty will cover it since PC runs it just gets error sometimes which just restart PC.

 

[Colif]

I didn't see the mention, I get a lot of alerts and don't always see them all.

There are over 290 BSOD codes, so saying you having BSOD isn't exact enough

if it survives a clean install its not likely to be software.

I have asked a friend to convert dumps, even though they from an old install, they might offer clues.

Can you follow option one on the following link - here - and then do this step below: Small memory dumps - Have Windows Create a Small Memory Dump (Minidump) on BSOD - that creates a file in c windows/minidump after the next BSOD

1. Open Windows File Explore
   
2. Navigate to C:\Windows\Minidump
   
3. Copy the mini-dump files out onto your Desktop
   
4. Do not use Winzip, use the built in facility in Windows
   
5. Select those files on your Desktop, right click them and choose 'Send to' - Compressed (zipped) folder
   
6. Upload the zip file to the Cloud (OneDrive, DropBox . . . etc.)
   
7. Then post a link here to the zip file, so we can take a look for you . . .
   

 

[JakubVlcek]

Okay I am sending the minidumps zipped throught the link here: https://www.mediafire.com/folder/tq9aa49qxrlux/Minidumps

One beggining with 021422 is more recent but had different BSOD code so i also added the next one which had IRQL NOT LESS OR EQUAL (most common one)

Also my BlueScreeView is showing that address is ntoskrnl.exe + 3f73b0 (Not sure if it can help you with analysis)

Thanks for your effort I hope we can find the solution here.

 

[Satan-IR]

IF correct that's a bugcheck 50 with with win32kbase.sys

This can have various causes from faulty RAM, faulty driver code to corrupt NTFS volume. You can check ram with memtest.

Also you can run the SFC. Follow the below steps:

1. Open Command Prompt.
2. Select “Run as Administrator”.
3. Type “sfc /scannow” without quotes and hit Enter.

 

[JakubVlcek]

It is bugcheck 50 yeah. I already did run memtest86 it came out with zero errors. I reinstalled the PC and downloaded drivers from manufacturers site. I also tried rolling them back. At least GPU drivers. I also did sfc/scannow. Nothing shows any trouble. Maybe faulty NTFS could be the problem but i am not sure how to check that. Then I also read somewhere that it could be motherboard but idk how to test that either.

 

[gardenman]

Hi, Colif asked me to take a look at the dumps. I ran the dump files through the debugger and got the following information: https://jsfiddle.net/pdz7c3s4/show This link is for anyone wanting to help. You do not have to view it. It is safe to "run the fiddle" as the page asks.

Spoiler: Dump File Results

File information:	021422-11171-01.dmp (Feb 14 2022 - 01:46:14)
Bugcheck:	PAGE_FAULT_IN_NONPAGED_AREA (50)
Probably caused by:	memory_corruption (Process running at time of crash: esrv.exe)
Uptime:	0 Day(s), 11 Hour(s), 40 Min(s), and 38 Sec(s)

File information:	021322-10500-01.dmp (Feb 13 2022 - 05:54:04)
Bugcheck:	IRQL_NOT_LESS_OR_EQUAL (A)
Probably caused by:	memory_corruption (Process running at time of crash: System)
Uptime:	0 Day(s), 0 Hour(s), 35 Min(s), and 19 Sec(s)

File information:	021222-15031-01.dmp (Feb 12 2022 - 09:13:16)
Bugcheck:	SYSTEM_SERVICE_EXCEPTION (3B)
Probably caused by:	memory_corruption (Process running at time of crash: Wow_FS_40944.exe)
Uptime:	0 Day(s), 0 Hour(s), 10 Min(s), and 52 Sec(s)

Possible Motherboard page: https://pcsupport.lenovo.com/us/en/...oks/legion-series/legion-5-15arh05h/downloads
You are using the latest BIOS.

This information can be used by others to help you. Someone else will post with more information. Please wait for additional answers. Good luck.

 

[Satan-IR]

Thanks to gadrenman, is that esrv.exe the Intel driver update utility? I wonder what others have to say on this but I'd uninstall it and also prevent it's service (probably esrv_svc) from running at startup.

What is the Wow_FS_40944.exe?

I also did sfc/scannow. Nothing shows any trouble. Maybe faulty NTFS could be the problem but i am not sure how to check that.

That command "sfc /scannow" checks the NTFS file system. If it didnt' show any problems the file system is OK.

 

[johnbl]

I looked at the dumps, win32kbase driver is being modified. this can be a malware attack on the windows core driver or maybe a bad spot in your memory.

things you can do.
- run a memory checker from outside windows something like memtest86
(will find certain types of memory errors)

- virus scan (might find malware) if you find something you have to remove malware, then fix the modified files.

- reinstall windows from a clean windows install (often faster than locating problems)

- you should also check for motherboard vendors driver update and bios updates.
the bios update can clear some mistakes from the bios and maybe wipe malware that can hide in the firmware.

 

[JakubVlcek]

I looked at the dumps, win32kbase driver is being modified. this can be a malware attack on the windows core driver or maybe a bad spot in your memory.

things you can do.
- run a memory checker from outside windows something like memtest86
(will find certain types of memory errors)

- virus scan (might find malware) if you find something you have to remove malware, then fix the modified files.

- reinstall windows from a clean windows install (often faster than locating problems)

- you should also check for motherboard vendors driver update and bios updates.
the bios update can clear some mistakes from the bios and maybe wipe malware that can hide in the firmware.

I already did all of this and it did not change anything. But thanks

 

[JakubVlcek]

Thanks to gadrenman, is that esrv.exe the Intel driver update utility? I wonder what others have to say on this but I'd uninstall it and also prevent it's service (probably esrv_svc) from running at startup.

What is the Wow_FS_40944.exe?

That command "sfc /scannow" checks the NTFS file system. If it didnt' show any problems the file system is OK.

Yeah I do have Intel Driver and Support Assistant if that is the case. So uninstall that ?
Also here is the screenshot of the services. Which one should i stop or disable?
https://www.mediafire.com/view/mf4fd873y6jyqqf/services.png/file

Wow_FS_40944.exe It is an executable file for a game. can it cause the problems ? Because the crashes happen even when the game is not played. I also asked another players if it is happening to them and they said it never did.

I also read in an article that some users disabled restart at system failure. Would you say it is safe to try?

 

[Satan-IR]

Yeah I do have Intel Driver and Support Assistant if that is the case. So uninstall that ?
Also here is the screenshot of the services. Which one should i stop or disable?
https://www.mediafire.com/view/mf4fd873y6jyqqf/services.png/file

Wow_FS_40944.exe It is an executable file for a game. can it cause the problems ? Because the crashes happen even when the game is not played. I also asked another players if it is happening to them and they said it never did.

I also read in an article that some users disabled restart at system failure. Would you say it is safe to try?

That shot is from the task manager. If you end/close it there it might very well restart on its own or start next time you boot/start Windows.
If you decide to stop the service you can to to Administrative Services then Services find esrv_svc and change it from enabgled to Disabled or Manual. If you change it to manual you can start it anytime you'd need it again.

Yes I guessed it's World of Warcraft but had to ask.

I also read in an article that some users disabled restart at system failure. Would you say it is safe to try?

Disabling restarts would sometimes prevent the system from restarting but if something major goes wrong with the system (which is probably the case hence the BSODs) that session of Windows would probbaly not be good for doing anything by the user until you restart yourself. It might give ht user some time to save any unasved work

 

[JakubVlcek]

That shot is from the task manager. If you end/close it there it might very well restart on its own or start next time you boot/start Windows.
If you decide to stop the service you can to to Administrative Services then Services find esrv_svc and change it from enabgled to Disabled or Manual. If you change it to manual you can start it anytime you'd need it again.

Yes I guessed it's World of Warcraft but had to ask.



Disabling restarts would sometimes prevent the system from restarting but if something major goes wrong with the system (which is probably the case hence the BSODs) that session of Windows would probbaly not be good for doing anything by the user until you restart yourself. It might give ht user some time to save any unasved work

Ok so I will try to disable that service. What does it affect or will that have some effect on my PC ?

 

[Satan-IR]

Ok so I will try to disable that service. What does it affect or will that have some effect on my PC ?

I don't think uninstalling that and disabling the service afterward would have any negative effect on the PC. If by any chance that's the culprit for BSODs you will know. If the system BSODs again after this you can reinstall the app again from the manufacturer's service anytime.

 

[JakubVlcek]

I don't think uninstalling that and disabling the service afterward would have any negative effect on the PC. If by any chance that's the culprit for BSODs you will know. If the system BSODs again after this you can reinstall the app again from the manufacturer's service anytime.

Ok I unisntalled the Intel driver support and service stopped by itself so it should be covered. If I experience BSOD again I will get back to you with minidump
Thank you

 

[Colif]

the processes named in the dumps are the victims, not cause. very rarely do dumps actually show driver names. removing the victim doesn't normally fix the problem.

If I listened to anyone in this thread it would be Johnbl but he isn't here often enough for my liking... He knows dumps better than I do.

crash 1 looks like its GPU driver related maybe. I see operations for monitors...
where did you get GPU drivers from? I can see they the latest ones (I have them) but maybe try getting them from Lenovo instead as if they don't work from the maker of laptop, you have other problems.
try running DDU and reinstall drivers - https://forums.tomshardware.com/faq...n-install-of-your-video-card-drivers.2402269/

 

[JakubVlcek]

the processes named in the dumps are the victims, not cause. very rarely do dumps actually show driver names. removing the victim doesn't normally fix the problem.

If I listened to anyone in this thread it would be Johnbl but he isn't here often enough for my liking... He knows dumps better than I do.

crash 1 looks like its GPU driver related maybe. I see operations for monitors...
where did you get GPU drivers from? I can see they the latest ones (I have them) but maybe try getting them from Lenovo instead as if they don't work from the maker of laptop, you have other problems.
try running DDU and reinstall drivers - https://forums.tomshardware.com/faq...n-install-of-your-video-card-drivers.2402269/

Thank you, I will try that if the next crash appears but currently I am recovering from a wisdom tooth extraction and I am not using the PC enough to test it.

My current drivers are from nvidia page.

I also thought that it could be a problem with graphic card. Since there is nvidia and also amd processor comes with one. Could the switching between them cause this ? I haven t found any threads about this.

 

[Colif]

Do you use LAN or WIFI?

Your WIFI drivers are newer than mine

Jan 03 2022

Netwtw10.sys

Intel Wi-Fi driver

But your Ethernet drivers are old

May 26 2020

rt640x64.sys

Realtek NICDRV 8169 PCIe GBE Family Controller driver https://www.realtek.com/en/

If you use Ethernet cable, download Win11 Auto Installation Program (NetAdapterCx) from under windows header here - https://www.realtek.com/en/componen...0-1000m-gigabit-ethernet-pci-express-software

the processes running may not be cause but they can offer clues as to potential cause. 2 of yours are internet related so maybe.

I also thought that it could be a problem with graphic card. Since there is nvidia and also amd processor comes with one. Could the switching between them cause this ? I haven t found any threads about this.

shouldn't be but its always a good idea to try them from the lenovo site as it could be tied into the swapping. I can guess AMD one used for everything that isn't a game. That is normally how it works.

I don't see any AMD GPU drivers... i see CPU has radeon graphics but is it ever used?
wonder what dxdiag shows. (wonders if this is a rabbit hole that might not be related)