BSoD on startup, then auto reset and works fine

[riccardi50]

I have a new build that I just finished. On a cold boot up, I will get a blue screen of death telling me "something went wrong and windows needs to restart..." yadda yadda. So it automatically restarts and then windows loads up perfectly. This only happens the first time I start up the computer. If the computer is running and I reset it without turning it off it will work fine. The errors I get have all been different so there is no consistency there. Nothing is overclocked.

Things I've done so far:
Run memtest - no errors
updated all my drivers

This is a real head scratcher for me and any help would be much appreciated.

 

[Colif]

Can you follow option one here
and then do this step below: Small memory dumps - Have Windows Create a Small Memory Dump (Minidump) on BSOD

that creates a file in c windows/minidump after the next BSOD
copy that file to documents
upload the copy from documents to a cloud server and share the link here and I will get someone to convert them for me

It looks to me like a device driver doesn't like the new startup method of Win 10. I would turn off fast startup and see if that helps - https://www.tenforums.com/tutorials/4189-turn-off-fast-startup-windows-10-a.html

The way win 10 works, the only time PC is off (with fast startup on) is during a restart, or if you unplug it. Shutting it down puts it to sleep, it saves a copy of all active drivers + a copy of the kernel into ram so that when you restart, it should be a lot faster. This only works if drivers/BIOS are compatible with feature.

Do you have latest BIOS as well?

 

[riccardi50]

Can you follow option one here
and then do this step below: Small memory dumps - Have Windows Create a Small Memory Dump (Minidump) on BSOD

that creates a file in c windows/minidump after the next BSOD
copy that file to documents
upload the copy from documents to a cloud server and share the link here and I will get someone to convert them for me

It looks to me like a device driver doesn't like the new startup method of Win 10. I would turn off fast startup and see if that helps - https://www.tenforums.com/tutorials/4189-turn-off-fast-startup-windows-10-a.html

The way win 10 works, the only time PC is off (with fast startup on) is during a restart, or if you unplug it. Shutting it down puts it to sleep, it saves a copy of all active drivers + a copy of the kernel into ram so that when you restart, it should be a lot faster. This only works if drivers/BIOS are compatible with feature.

Do you have latest BIOS as well?

I already turned off fast restart and the issue hasn't gone away, also my MOBO has the latest update. I guess I should have put that in the things I've tried. I'll try your memdump from option 1 you recommend so you can see them. If it helps, these are the random BSoD errors I'm getting:

memory_management
kmode_exception_not_handled
attempted_write_to_readonly_memory
bad_pool_header

 

[Colif]

i helped someone just 2 days ago with a similar range of errors and they too had run memtest and found no errors.

They all look like memory related errors. They can also be drivers. I won't get ahead of myself and will wait for dump files.

Do you have any Asus utilities installed? AI Suite can cause BSOD, for example. Not usually these ones though,
I guess you got the driver updates from the Asus web site

 

[riccardi50]

i helped someone just 2 days ago with a similar range of errors and they too had run memtest and found no errors.

They all look like memory related errors. They can also be drivers. I won't get ahead of myself and will wait for dump files.

Do you have any Asus utilities installed? AI Suite can cause BSOD, for example. Not usually these ones though,
I guess you got the driver updates from the Asus web site

The MOBO is actually Asrock and no, no Asus stuff installed. All the stuff I got from the asrock website. Also, I've right clicked on everything in the device manager and checked for update. It'll be probably tomorrow till I have the DUMP uploaded for you. Any specific cloud server you recommend?

 

[R0GG]

it's probably a memory clock or timing or memory voltage issue, double check your bios settings on those.

 

[Colif]

I should have asked for specs, I was going from your sig

can you tell us parts of PC?

List of Cloud Servers:
google drive: https://www.google.com.au/drive/
Onedrive: https://onedrive.live.com/
Dropbox: https://www.dropbox.com/h

there are more, this was off the top of my head. Take your pick.

 

[riccardi50]

Can you follow option one here
and then do this step below: Small memory dumps - Have Windows Create a Small Memory Dump (Minidump) on BSOD

that creates a file in c windows/minidump after the next BSOD
copy that file to documents
upload the copy from documents to a cloud server and share the link here and I will get someone to convert them for me

It looks to me like a device driver doesn't like the new startup method of Win 10. I would turn off fast startup and see if that helps - https://www.tenforums.com/tutorials/4189-turn-off-fast-startup-windows-10-a.html

The way win 10 works, the only time PC is off (with fast startup on) is during a restart, or if you unplug it. Shutting it down puts it to sleep, it saves a copy of all active drivers + a copy of the kernel into ram so that when you restart, it should be a lot faster. This only works if drivers/BIOS are compatible with feature.

Do you have latest BIOS as well?

I had 5 dmp files made but google drive would only let me upload 2 of them as it kept saying could not read file:
https://drive.google.com/open?id=1rSkhxUYW-mgnyHvNzVFzgTw0SaUUHeSN
https://drive.google.com/open?id=1FivjKhqAmo8CgvlTEyGXj-kEBfrIJ0q_

Hope that helps.

The specs of the computer that we are talking about are:
i3-8350k
asrock z370 sli/ac
ADATA DDR4 2666 XPG ram 2 x 8gb
ASUS 1050 ti - driver only updated from device manager, not through nvidia experience or asus website
Sandisk 240 gb ssd

 

[gardenman]

Hi, I ran the dump file through the debugger and got the following information: https://pste.eu/p/HjdD.html

File: 040418-5437-01.dmp (Apr 4 2018 - 12:09:58)
BugCheck: [SYSTEM_SERVICE_EXCEPTION (3B)]
Probably caused by: ntkrnlmp.exe (Process: svchost.exe)
Uptime: 0 Day(s), 0 Hour(s), 00 Min(s), and 05 Sec(s)

File: 040418-5609-02.dmp (Apr 4 2018 - 09:14:00)
BugCheck: [SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007E)]
Probably caused by: memory_corruption (Process: System)
Uptime: 0 Day(s), 0 Hour(s), 00 Min(s), and 05 Sec(s)

Motherboard: https://www.asrock.com/MB/Intel/Z370%20Killer%20SLIac/index.asp
You have the latest BIOS available for your system.

I can't help you with this. Colif will usually reply a few hours later. Wait for additional replies. Good luck.

 

[Colif]

your ram reported as 2667 but that could be a rounding calculation. Did you check your memory settings as ROGG suggested?

All your drivers seem new enough to not cause these errors. Looks like Microsoft finally updated their Nvidia driver to Jan 18 version now. Their drivers are normally more stable than the latest ones direct from Nvidia

 

[R0GG]

I would compare bios settings in detail before cold boot (BSOD) and after reset or automatic restart ( successful system boot), check Bios loading profile ( whether it is an Over Clock OC) and Bios default loading profile in case of error, suspecting your bios might have custom settings which could be a slight non optimized Overclock and that after a restart it resets itself to it's optimal or default values.


BSOD analyser of your System Dump file :

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff802b698aa81, Address of the instruction which caused the bugcheck
Arg3: ffff9d0de2e5e750, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!RtlDeleteNoSplay+71
fffff802`b698aa81 48395808 cmp qword ptr [rax+8],rbx
CONTEXT: ffff9d0de2e5e750 -- (.cxr 0xffff9d0de2e5e750)
iopl=0 nv up ei ng nz na po cy
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010287
nt!RtlDeleteNoSplay+0x71:
fffff802`b698aa81 48395808 cmp qword ptr [rax+8],rbx ds:002b:ff69b48b`84cae9c0=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1
[i]DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT[/i]
BUGCHECK_STR: 0x3B
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 1
BAD_PAGES_DETECTED: 430a
LAST_CONTROL_TRANSFER: from fffff807ae4d4bf1 to fffff802b698aa81
SYMBOL_NAME: PAGE_NOT_ZERO
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Unknown_Module
IMAGE_NAME: Unknown_Image
DEBUG_FLR_IMAGE_TIMESTAMP: 0
STACK_COMMAND: .cxr 0xffff9d0de2e5e750 ; kb
BUCKET_ID: PAGE_NOT_ZERO
Followup: MachineOwner
---------

*** Memory manager detected 17162 instance(s) of page corruption, target is likely to have memory corruption.

 

[johnbl]

normally with a hacked nt kernel you would want to do a reinstall of windows from a known good source. Then update the motherboard drivers and do the windows updates
(second bugcheck showed the corrupted kernel)

 

[Colif]

normally with a hacked nt kernel you would want to do a reinstall of windows from a known good source. Then update the motherboard drivers and do the windows updates
(second bugcheck showed the corrupted kernel)

whats showing its hacked?

BUILD_VERSION: 10.0.16299.309 is what he shows as having, its the same as what I have and what another BSOD i was just looking at is showing as current build?

 

[johnbl]

memory dump #2 shows a corrupted kernel
82 errors : !nt (fffff801383f94ea-fffff8013853368f)

functions inside of the kernel that free pool memory were modified, then in the stack trace something tried to use the freed pool memory. I would guess malware modification or a bad driver.
verifier.exe functions if turned on should force a bugcheck and name the driver. But you would still have the modified kernel and would want to reinstall.

normally with a hacked nt kernel you would want to do a reinstall of windows from a known good source. Then update the motherboard drivers and do the windows updates
(second bugcheck showed the corrupted kernel)

whats showing its hacked?

BUILD_VERSION: 10.0.16299.309 is what he shows as having, its the same as what I have and what another BSOD i was just looking at is showing as current build?

 

[riccardi50]

your ram reported as 2667 but that could be a rounding calculation. Did you check your memory settings as ROGG suggested?

All your drivers seem new enough to not cause these errors. Looks like Microsoft finally updated their Nvidia driver to Jan 18 version now. Their drivers are normally more stable than the latest ones direct from Nvidia

Yeah I think that's just a rounding thing. I check the settings and they all seemed fine.

 

[riccardi50]

I would compare bios settings in detail before cold boot (BSOD) and after reset or automatic restart ( successful system boot), check Bios loading profile ( whether it is an Over Clock OC) and Bios default loading profile in case of error, suspecting your bios might have custom settings which could be a slight non optimized Overclock and that after a restart it resets itself to it's optimal or default values.


BSOD analyser of your System Dump file :

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff802b698aa81, Address of the instruction which caused the bugcheck
Arg3: ffff9d0de2e5e750, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!RtlDeleteNoSplay+71
fffff802`b698aa81 48395808 cmp qword ptr [rax+8],rbx
CONTEXT: ffff9d0de2e5e750 -- (.cxr 0xffff9d0de2e5e750)
iopl=0 nv up ei ng nz na po cy
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010287
nt!RtlDeleteNoSplay+0x71:
fffff802`b698aa81 48395808 cmp qword ptr [rax+8],rbx ds:002b:ff69b48b`84cae9c0=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1
[i]DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT[/i]
BUGCHECK_STR: 0x3B
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 1
BAD_PAGES_DETECTED: 430a
LAST_CONTROL_TRANSFER: from fffff807ae4d4bf1 to fffff802b698aa81
SYMBOL_NAME: PAGE_NOT_ZERO
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Unknown_Module
IMAGE_NAME: Unknown_Image
DEBUG_FLR_IMAGE_TIMESTAMP: 0
STACK_COMMAND: .cxr 0xffff9d0de2e5e750 ; kb
BUCKET_ID: PAGE_NOT_ZERO
Followup: MachineOwner
---------

*** Memory manager detected 17162 instance(s) of page corruption, target is likely to have memory corruption.

If it helps, I borrowed some RAM from a buddy that had compatible RAM for this mobo and it worked flawlessly (ripjaws 4 2400). I'm just going to order up some of that stuff and call it a day, unless you all can think of anything else?