[SOLVED] BSOD ntoskrnl.exe

[Terminus676]

Hey friends,

I have an issue. I recently had a little bit of really slow internet. I didnt see any network usage so I reset my router. Didn't work. So I shrugged it off, started a virus scan with Windows Defender and continued browsing. After a short time I suddenly got a BSOD. Out of the blue. It said that it had a serious issue and needed to collect data, then restarted. I loaded back up and checked my CPU temps cause I have a 5.1 Ghz OC on my processor (that has been running stable for 4+ months now with everything from games over utility programs, etc).

I checked the logs and it gave me the following in image 1 (sorry, text is in German, but the important stuff should be identifiable).
https://ibb.co/qYzWrpQ
I checked the logs of course and this is what it tells me (pic 2).
https://ibb.co/fGhHPdJ
And I don't know if this is related, but it also showed in the event diplay, that a windows service was set from "automatic" to "manual". The name of the service is "BITS" (see image 3).
https://ibb.co/qmsWVp4
(somehow the option to link the images directly doesn't seem to work, sry im not that savy when it comes to forum posts)

My setup:

CPU: i7-8700k 3.7 Ghz (OCed to 5.1 Ghz stable, tested with Cinebench and P95, and 4 months error-free)
RAM: 16GB DDR4 (I think its DDR4)
MSI RTX 2070 Armored Edition 8GB VRAM
Windows 10 x64

I didn't install a lot of new programs lately, aside from World of Warcraft maybe, but thats been running stable too at 120 FPS without temperature issues.

Got surprised a lot by this sudden BSOD out of nowhere. I hope it doesn't happen again, but I thought Id post this and ask if someone can help me identify what the issue could have been and how I can fix this if it happens again. Any advice would help a lot. I just hope I don't get to spend another week or two with issues and headaches.

 

[Colif]

System service exception - wish i had looked at 2nd picture before working out what error 0x0000003b was '
NTOSKRNL = windows kernel. It handles all driver requests, power management, and memory management. It sits between Hardware and Applications. It got blamed but its not the cause. it is involved in virtually everything PC does.

We don't have an upload feature so that is why you couldn't find a way to link photos directly.

Can you go to c windows/minidump
copy the minidump file to documents
upload the copy from documents to a file sharing web site,
and share the link in your thread so we can help fix the problem

there should be a minidump since you ran bluescreenview.

One BSOD isn't anything too worry about, but if you get more show us the minidumps and we try to fix it.

Can you remove overclock while we fix problem.

 

[Terminus676]

So I ran Defender again and it found a "high thread" "hack:tool" of some sort. My PC was being weird and my secondary antivirus didn't find anything. After a lot of problems, restarts I did a system recovery from a point 3 days ago, but I continued to have the same "threat" shown in Windows Defender (even without scan) and it was unable to delete it. After scanning my windows system for defective parts it found some and repaired them, but it was too much for me. I moved some important PFDs to my two other HDDs and did a complete partition delete and system reinstall.

After that I ran Windows Defender again in "full scan" and it again got a BSOD. Ill try to upload the file and post it in here, I read it out with "whocrashed" this time. It showed me the same issue with ntoskrnl.exe.

I decided it might be the OC I had and that Windows Defender was going too hard on my CPU, so I disabled the OC for now. Scan of C drive didn't crash anything, neither did D drive. But it got stuck on scanning the E drive.

event viewer

crash dump report

report conclusion

I also noticed this while the scan was "stuck"
very weird

processes being "stopped" in resource monitor, couln't continue them.

I checked my SSD (C) with crystal disk info and it seems fine.

I might be able to make a memtest but ill first need a bootable USB for that and the one I have has my clean windows install on it, so thats an issue.

I also think I might (not sure) have a memory leak.
Around 450MB in non-paged pool. Could be wrong though, Im just sensitive there since I had a similar issue at some point. Either way im installing poolmon rn to see if there is something to it.

After that I try to rescan my E drive again and hope it works.

There is still a windows update I can make, and I will. And ill also install the newest nvidia drivers (if I dont already have them).

This shouldn't be happening on a new Version of Windows. I had no issues before and at this point I kind of arrived at desperation mode.

Ill post the minidump soon, ill just have to find out how. Hier is the dump:

Minidump

 

[gardenman]

Hi, I ran the dump file through the debugger and got the following information: https://jsfiddle.net/gh0kb9mj/show This link is for anyone wanting to help. You do not have to view it. It is safe to "run the fiddle" as the page asks.

File information:	120520-5484-01.dmp (Dec 5 2020 - 14:26:42)
Bugcheck:	WHEA_UNCORRECTABLE_ERROR (124)
Probably caused by:	memory_corruption (Process: MsMpEng.exe)
Uptime:	0 Day(s), 0 Hour(s), 04 Min(s), and 52 Sec(s)

Possible Motherboard page: https://www.msi.com/Motherboard/MAG-Z390-TOMAHAWK
There is a BIOS update available for your system. You are using version 1.2 and the latest is 1.B. Wait for additional information before deciding to update or not. Important: Verify that I have linked to the correct motherboard. Updating your BIOS can be risky. Never try it when you might lose power (lightning storms, recent power outages, etc).

This information can be used by others to help you. Someone else will post with more information. Please wait for additional answers. Good luck.

 

[Terminus676]

Alright ill sit and wait for now.
I deactivated the OC and went back to default (XMP profile still active). I installed some drivers and poolmon just in case. But I dont think its a memory leak, nothing suggests that.

The Windows Defender is running through the drive that "got stuck" earlier right now. If its succesfull it will have been run on all drives I have. After that ill download the windows optional update that I see in my feed and restart. then I can try another "full scan" just to see if the issue is isolated to the "full scan" option only. Maybe this is where the problem is at. If that is ALSO not the problem the only relation I can see is that my OC must have somehow overheated my CPU during the WinDefender full scan. That's unlikely, but really what else is there left to try? (aside from the MB update, which I will wait on you guys opionion before doing). If nothing at all turns up ill run my PC on the factory CPU clock for now and test programs, games, etc. And then Ill clock back to 5.1. If the BSOD happens again then, I can pretty much tell what it was and tune it down to 5.0 for a hopefully stable build. Though it baffles me that I used this system for 4 months without any issues.

 

[Terminus676]

My E drive seems to have shown a detection
"Hack.Tool/Win32 Agent". Unfortunately Im an idiot and clicked too fast, not looking at the details page.

EDIT: Might be a little file I have on my PC, something harmless. Doesnt explain the BSOD though. Might however be two unrelated issues. One with Defender causing the BSOD, and one with it falsely detecting one of my programs as a threat.

 

[johnbl]

first bugcheck from the image was just a access violation most likly one of the bits was flipped in the memory address being use.
the bugcheck in the minidump is a partial dump
basically shows a fatal error in the CPU. the data is not of the proper format for my debugger.

6: kd> !sysinfo cpuspeed
CPUID: "Intel(R) Core(TM) i7-8700K CPU @ 3.70GHz"
MaxSpeed: 3700
CurrentSpeed: 3696

Machine ID Information [From Smbios 2.8, DMIVersion 0, Size=4510]
BiosMajorRelease = 5
BiosMinorRelease = 13
BiosVendor = American Megatrends Inc.
BiosVersion = 1.20
BiosReleaseDate = 11/14/2018
SystemManufacturer = Micro-Star International Co., Ltd.
SystemProductName = MS-7B18
SystemFamily = Default string
SystemVersion = 1.0
SystemSKU = Default string
BaseBoardManufacturer = Micro-Star International Co., Ltd.
BaseBoardProduct = MAG Z390 TOMAHAWK (MS-7B18)
BaseBoardVersion = 1.0


System looks like a clean windows install without any of the motherboard vendors drivers installed.
bios is from 11/14/2018

the system up timer was 4 min 52 seconds.
and a hardware error caused the bugcheck.

I would reset the bios to defaults, check the voltages, make sure the cpu fans are working, i would set the system to high performance mode
(or be looking at hardware that goes to sleep at 5 minutes)

looks like plug and play is having some problems installing some hardware but the info is not saved in a minidump , you would have to change the memory dump type to kernel and provide the memory.dmp file

I would be looking trying to find out what the plug and play is trying to install and why it is failing.
maybe something like a USB thumb network card, or a USB cooler connected to the USB ports.

you would need to make the kernel memory dump, provide it so someone can run
!pnptriage
command in the debugger and so they can look at what is running on the other CPU cores.
(some hardware device setup failing over and over)

 

[Terminus676]

first bugcheck from the image was just a access violation most likly one of the bits was flipped in the memory address being use.
the bugcheck in the minidump is a partial dump
basically shows a fatal error in the CPU. the data is not of the proper format for my debugger.

6: kd> !sysinfo cpuspeed
CPUID: "Intel(R) Core(TM) i7-8700K CPU @ 3.70GHz"
MaxSpeed: 3700
CurrentSpeed: 3696

Machine ID Information [From Smbios 2.8, DMIVersion 0, Size=4510]
BiosMajorRelease = 5
BiosMinorRelease = 13
BiosVendor = American Megatrends Inc.
BiosVersion = 1.20
BiosReleaseDate = 11/14/2018
SystemManufacturer = Micro-Star International Co., Ltd.
SystemProductName = MS-7B18
SystemFamily = Default string
SystemVersion = 1.0
SystemSKU = Default string
BaseBoardManufacturer = Micro-Star International Co., Ltd.
BaseBoardProduct = MAG Z390 TOMAHAWK (MS-7B18)
BaseBoardVersion = 1.0


System looks like a clean windows install without any of the motherboard vendors drivers installed.
bios is from 11/14/2018

the system up timer was 4 min 52 seconds.
and a hardware error caused the bugcheck.

I would reset the bios to defaults, check the voltages, make sure the cpu fans are working, i would set the system to high performance mode
(or be looking at hardware that goes to sleep at 5 minutes)

looks like plug and play is having some problems installing some hardware but the info is not saved in a minidump , you would have to change the memory dump type to kernel and provide the memory.dmp file

I would be looking trying to find out what the plug and play is trying to install and why it is failing.
maybe something like a USB thumb network card, or a USB cooler connected to the USB ports.

you would need to make the kernel memory dump, provide it so someone can run
!pnptriage
command in the debugger and so they can look at what is running on the other CPU cores.
(some hardware device setup failing over and over)

Well can you walk me through it? Im not sure how to do that. I can update all my drivers again, would you recommend that? Or should I do something else first?

I want my system to be fixed as quickly as possible. My assumption is the CPU fail might be related to my 5.1 Ghz OC, unless you are telling me that its highly unlikely. I had my AVX offset on 0, so maybe it was that.

The HackTool I found seems to be an old c I forgot, its nothing too major, but im gonna delete it (although atm it seems stuck at deletion, so this is worrying me). Still waiting on confirmation for the BIOS driver update? If yes what on the page should I install and what not? MSI drivers (sorry its in German)

 

[johnbl]

Well can you walk me through it? Im not sure how to do that. I can update all my drivers again, would you recommend that? Or should I do something else first?

I want my system to be fixed as quickly as possible. My assumption is the CPU fail might be related to my 5.1 Ghz OC, unless you are telling me that its highly unlikely. I had my AVX offset on 0, so maybe it was that.

The HackTool I found seems to be an old c I forgot, its nothing too major, but im gonna delete it (although atm it seems stuck at deletion, so this is worrying me). Still waiting on confirmation for the BIOS driver update? If yes what on the page should I install and what not? MSI drivers (sorry its in German)

people should not take memory dumps on a overclocked system seriously. it just takes too much time to look for a bit getting flipped because of timing/voltages issues in the electronics. generally, overclock driver should always be removed before debugging problems.
It is also a good idea to upgrade the BIOS or reset it to defaults for the same reason. I generally recommend updating the bios and the motherboard drivers before debugging since this is often the fix that people have to do after the problem is debugged.

google "how to change windows memory dump type to kernel memory dump"
should show you where in the UI the setting is located.

something like Control Panel ->performance and Maintenance ->system tab -> advanced->startup and recovery
will get you close to the setting

 

[Terminus676]

It is also a good idea to upgrade the BIOS or reset it to defaults for the same reason. I generally recommend updating the bios and the motherboard drivers before debugging since this is often the fix that people have to do after the problem is debugged.

Interesting, the people I have talked to so far (one of them helped me with my first OC too) were telling me that I should never update the BIOS unless I feel its absolutely necessary, since it could literally brick my system. And I don't really have the budget to risk that.

That being said. I think I solved the issue. Me and a friend of me. We figured out it might have actually been Windows Defender using AVX. Because when I set my AVX offset to -1 in the BIOS and ran a full scan it didn't BSOD. There was no detection of any malicious software either. System seems to be running stable and fine. Might have jumped the gun on that Windows reinstall tbh. Im still glad I did it, it helped me streamline and get a clean start. You know, ease of mind too. But everything works as intended now.

Ill report back if I get any more issues or if more BSODs occur. But for now the issue seems solved. I hope really it is, this is just giving me a lot of stress. The system is pretty new and Im very busy IRL, so its hard to sit there for multiple days trying to figure out why I had 2 BSODs.

I want to thank everyone who gave me advice on this. Its great to know that there are always people online willing to lend a hand to a stranger who isn't as versed in technical issues. Im glad people like you exist, being able to see through issues like that, come up with possible solutions. Or hell, even just read out that crash dump data and say what the basic information in it is. Thanks a lot.

 

[Colif]

Interesting, the people I have talked to so far (one of them helped me with my first OC too) were telling me that I should never update the BIOS unless I feel its absolutely necessary, since it could literally brick my system. And I don't really have the budget to risk that.

This is mostly right, you should never update bios on a whim, or because there is an updated version. But Bios updates are a way to fix BSOD as it could be the software in windows is expecting you to have a newer BIOS and if it doesn't do what they expect it can cause errors.

BIOS updates are one known way to fix WHEA errors. Not guaranteed but tis one way. There is no guaranteed way.

You are on bios version 7B18v12 as although BIOS reports it is on 1.20, I know MSI bios report the management bios number in that field, not the actual bios number.

there are at least 7 newer bios since this one and they all improvement system stability. If system is new, its another good reason as often they fix features that weren't quite right, or add new features, or MB could have been sitting in its box for a year or so before you got it. One of the updates add optane support, for instance.

https://www.msi.com/Motherboard/support/MAG-Z390-TOMAHAWK

MSI even make it easy for you