[SOLVED] BSOD - NTOSKRNL.exe

[Paranoid01]

Hello everybody,

I'm coming with an issue I have been having for months now.

I have a random BSOD that can happen very randomly (but at least once a week) on what seems to me on random situations. Sometimes when I'm playing games, watching a video and even sometimes while the computer was idle (but very rare). I'm thinking perhaps it's my video card ?

I have had different errors for those:
KERNEL_SECURITY_CHECK_FAILURE
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M
SYSTEM_SERVICE_EXCEPTION
DRIVER_IRQL_NOT_LESS_OR_EQUAL (much rarer lately)

Here are my specs:

CPU: AMD R7 1700
GPU: AMD V64 - V: 19.7.2 (I have done several times the DDU on safe mode uninstall + clean install)
Motherboard: Asrock Taichi x370 - Bios v 5.10
RAM: G.Skill FlareX @ 3200 MHz - 2x8 Go


And here are the last reports from who crashed:

On Sun 25/08/2019 14:49:09 your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\Minidump\082519-15484-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x1BFCC0)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF8077B1CF882, 0xFFFFA20CF35DAF30, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Sun 25/08/2019 14:28:36 your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\Minidump\082519-16421-01.dmp
This was probably caused by the following module: hardware.sys (hardware)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF80761E4390D, 0xFFFFA70D5CCC0F20, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: hardware.sys .
Google query: hardware.sys SYSTEM_SERVICE_EXCEPTION



On Sun 25/08/2019 14:28:36 your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\MEMORY.DMP
This was probably caused by the following module: hardware.sys (hardware)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF80761E4390D, 0xFFFFA70D5CCC0F20, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: hardware.sys .
Google query: hardware.sys SYSTEM_SERVICE_EXCEPTION



On Tue 20/08/2019 15:25:54 your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\Minidump\082019-16312-01.dmp
This was probably caused by the following module: atikmdag.sys (0xFFFFF8052AD3C42F)
Bugcheck code: 0x1000007E (0xFFFFFFFFC0000005, 0xFFFFF8052AD3C42F, 0xFFFFB40AE68C0E98, 0xFFFFB40AE68C06E0)
Error: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M
file path: C:\WINDOWS\System32\DriverStore\FileRepository\u0344727.inf_amd64_77a3ed2bd62fd231\B344591\atikmdag.sys
product: ATI Radeon Family
company: Advanced Micro Devices, Inc.
description: ATI Radeon Kernel Mode Driver
Bug check description: This indicates that a system thread generated an exception which the error handler did not catch.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: atikmdag.sys (ATI Radeon Kernel Mode Driver, Advanced Micro Devices, Inc.).
Google query: atikmdag.sys Advanced Micro Devices, Inc. SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M



On Sun 18/08/2019 13:49:51 your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\Minidump\081819-16343-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x1BFCC0)
Bugcheck code: 0x139 (0x2, 0xFFFFFE06EEF41850, 0xFFFFFE06EEF417A8, 0x0)
Error: KERNEL_SECURITY_CHECK_FAILURE
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: The kernel has detected the corruption of a critical data structure.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Tue 13/08/2019 20:46:42 your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\Minidump\081319-18625-01.dmp
This was probably caused by the following module: hidclass.sys (0xFFFFF8051EABA6D5)
Bugcheck code: 0xD1 (0xFFFFDD0BF27FE690, 0x2, 0x0, 0xFFFFF8051EABA6D5)
Error: DRIVER_IRQL_NOT_LESS_OR_EQUAL
file path: C:\WINDOWS\system32\drivers\hidclass.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Hid Class Library
Bug check description: This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.
This bug check belongs to the crash dump test that you have performed with WhoCrashed or other software. It means that a crash dump file was properly written out.
The crash took place in a Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.


Any help is very appreciated.

Thank you

 

[Paranoid01]

My computer shut down during the last hour of driver verifier because of a power outage. Don't know if it will ruin the result but I kept it on to get a full 8 hours after. No BSOD.

Result of the the SFC SCAN:
-----
Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection found corrupt files but was unable to fix some of them.
For online repairs, details are included in the CBS log file located at
windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log. For offline
repairs, details are included in the log file provided by the /OFFLOGFILE flag.
PS C:\WINDOWS\system32> Repair-WindowsImage -Online -RestoreHealth
Repair-WindowsImage : The restore operation failed. Either the repair source was not found or the component store
cannot be repaired.
At line:1 char:2

• Repair-WindowsImage -Online -RestoreHealth
• ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

+ CategoryInfo : NotSpecified: ) [Repair-WindowsImage], COMException
+ FullyQualifiedErrorId : Microsoft.Dism.Commands.RepairWindowsImageCommand
-----
Something looks wrong.

-----
I'll go through with the Prime95 and Furmark benchmark over the weekend or beginning of next week . I doubt we will find anything as I already stress tested my Vega before without crashing and my CPU too. Both are at stock clocks btw. Will do it again anyway.

My PSU is a Seasonic Prime Ultra Titanium 650W

Also I have ran my computer with Malwarebytes, nothing detected.

I think I suspect the XMP profile used before being the culprit for the BSOD, so i'd like for the few next days just run my computer without it and see if I have more BSOD.

P.S: I checked in my reliability history and everytime I turn my PC on WMI Provider Host crashes multiple time while my computer is on. I don't see any error message while using but perhaps it's a lead ? (or maybe it's a dud )

 

[PC Tailor]

Did you run the DISM as administrator?
Does it let you run

• Repair-WindowsImage -Online -CheckHealth ?

 

[Paranoid01]

Alright I tried it again and it seems it works fine now.

Not sure what happened before.

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection found corrupt files and successfully repaired them.
For online repairs, details are included in the CBS log file located at
windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log. For offline
repairs, details are included in the log file provided by the /OFFLOGFILE flag.
PS C:\WINDOWS\system32> Repair-WindowsImage -Online -CheckHealth


Path :
Online : True
ImageHealthState : Repairable
RestartNeeded : False

I did a Prime95 stress test for an hour. I forgot it was on and launched a game with it running in parallel for about 10 minutes before realizing it was still running. It was stuttery to say the least but not as bad I would've thought. No BSOD in sight

 

[PC Tailor]

It would be stuttery as it would be pushing your CPU to the heavens and back. There would be little CPU resource to perform other tasks.

In actual fact, Prime95 by good practice standards should be run for 12 hours, but in reality, just letting it complete a blend test usually suffices. I'd leave it longer than 10 minutes though definitely. Most prime95 problems tend to be found in the first 20 minutes or so, but I've had CPUs pass Prime95 for 5 hours then fail.

 

[Paranoid01]

I'll redo a more thorough test if one hour is not enough, with the GPU following closely after. How many hours would you recommend for Furmark ?

 

[PC Tailor]

I'll redo a more thorough test if one hour is not enough, with the GPU following closely after. How many hours would you recommend for Furmark ?

Furmark problems are usually found much quicker, i'd say run it for 15+ minutes or so.

 

[Colif]

ImageHealthState : Repairable

dism (2nd command) didn't finish as expected
which version of win 10 are you on?
right click start
choose run
type winver and press enter
current version is 1903

if you are on 1903 now, try this
Download a copy of the win 10 iso from Here - create ISO by telling it you want to make DVD - and then mount that ISO in file explorer (see Here) and then copy paste the below command into command prompt (admin)


DISM /Online /Cleanup-Image /RestoreHealth /source:WIM:X:\Sources\Install.wim:1 /LimitAccess

Where "X" is the drive letter where the ISO is located. Simply change the "X" to the correct drive letter

if you don't copy/paste, the spacing has to be exact or you will get an error 87

once that command is run, redo SFC /scannow and restart PC

if you not on 1903 now, it becomes more complicated as the source command requires a copy of the ISO that currently matches the installed version of win 10. Only ISO on Microsoft website is for 1903

 

[Paranoid01]

Hi,

Just an update on the situation. I'm marking this as answered as I haven't had any crash in weeks now.

The issue was the memory set at 3200MHz frequency. I am now trying to do different timings to run it at advertised rate but I have been mostly going at base frequency.

Thank you all for the help