BSOD please help

[lagastrolo]

Hello everyone,

Could someone please help me out. Recently i've bought a pc, but on the 2nd day i kept getting BSOD, i have no idea how it comes.

I've tried a lot of things:

-CMOS reset
-Clean win10 install
-Even put 1 Ram out of the DIMM slots

i am just clueless. I get BSOD when i watch video's on youtube. thats when i most likely happens.

My PC specs:

Processor: Intel(R) Core (TM) i7-6700K CPU @ 4.00GHz
Ram: 8.00GB
System Type: 64 bit
Windows: 10
Video card: Nvidia Geofore GTX 1060
Motherboard: msi z170a gaming m7

Here is the dump file:

Crash Dump Analysis provided by OSR Open Systems Resources, Inc. (http://www.osr.com)
Online Crash Dump Analysis Service
See http://www.osronline.com for more information
Windows 8 Kernel Version 15063 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0xfffff802`bc08d000 PsLoadedModuleList = 0xfffff802`bc3d95c0
Debug session time: Thu Aug 24 01:46:04.964 2017 (UTC - 4:00)
System Uptime: 1 days 0:02:56.659
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

RESOURCE_NOT_OWNED (e3)
A thread tried to release a resource it did not own.
Arguments:
Arg1: ffffa90164a0f4f0, Address of resource
Arg2: ffffa9016464c080, Address of thread
Arg3: ffffa90163a83200, Address of owner table if there is one
Arg4: 0000000000000002

Debugging Details:
------------------

TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

BUGCHECK_STR: 0xE3

PROCESS_NAME: csrss.exe

CURRENT_IRQL: 0

BAD_PAGES_DETECTED: 99d5

LAST_CONTROL_TRANSFER: from fffff802bc22330b to fffff802bc1f9560

STACK_TEXT:
ffffe701`6318b5e8 fffff802`bc22330b : 00000000`000000e3 ffffa901`64a0f4f0 ffffa901`6464c080 ffffa901`63a83200 : nt!KeBugCheckEx
ffffe701`6318b5f0 fffff802`bc0f162a : ffffe701`6318b810 ffffa901`63c4a780 00000000`00000001 ffff991e`715d29ae : nt!ExpReleaseResourceSharedForThreadLite+0x1323cb
ffffe701`6318b6b0 ffff991e`71249884 : 00000000`00000004 ffffe701`6318b802 00000000`00000001 00000000`00000002 : nt!ExReleaseResourceAndLeaveCriticalRegion+0xea
ffffe701`6318b710 ffff991e`715a967e : 00000000`00000000 ffffa901`6464c080 00000000`00000000 00000000`00000005 : win32kfull!RawInputThread+0x14d4
ffffe701`6318ba10 ffff991e`7123d5df : ffffa901`00000002 ffffe701`66f61d80 ffffa901`6464c080 00000000`00000000 : win32kbase!xxxCreateSystemThreads+0x12e
ffffe701`6318ba50 fffff802`bc204413 : ffffa901`6464c080 00000000`00000005 0000028f`5f4042a0 00000000`00001c38 : win32kfull!NtUserCallNoParam+0x2f
ffffe701`6318ba80 00007ff9`3c7b1124 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
000000cf`c96ffa88 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7ff9`3c7b1124


STACK_COMMAND: kb

SYMBOL_NAME: PAGE_NOT_ZERO

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Unknown_Module

IMAGE_NAME: Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP: 0

BUCKET_ID: PAGE_NOT_ZERO

Followup: MachineOwner
---------

*** Memory manager detected 39381 instance(s) of page corruption, target is likely to have memory corruption.



End of Dumpfile

Could someone please help me out, i would really appreciate it.

ty for reading my post and for your time.

Kind regards,

Lorenzo

 

[Colif]

Never seen that BSOD before,

The RESOURCE_NOT_OWNED bug check has a value of 0x000000E3. This indicates that a thread tried to release a resource it did not own. Historically this error was associated with ntfs

can you look in c:\windows folder and change view to show hidden items and see how big your memory.dmp file is. If its only small (since its a clean install, it should be), can you copy it to documents and then upload it to a file sharing site and share a link here, someone who can read the dumps will see what they can figure out

 

[lagastrolo]

Tyvm for your time. I am not good with these kind of stuff, but i tried to upload the minidump file to a website. Here is the link:

https://ufile.io/vze62

 

[gardenman]

Hi, I think Colif was looking for the C:\Windows\Memory.dmp file. It's usually a pretty big file.

I ran the minidump file through the debugger and got the following information: https://pastebin.com/dfpeAnfr

File: 082317-3609-01.dmp (Thu Aug 24 01:46:04 2017)
BugCheck E3, {ffffa90164a0f4f0, ffffa9016464c080, ffffa90163a83200, 2}
Probably caused by: win32kfull.sys (Process: csrss.exe)

You are running BIOS version 1.G (10/17/2016). There is a newer BIOS out for you system, it's version 7976v1I (05/08/2017). Verify the link below is correct for your system and consider updating your BIOS.
https://us.msi.com/Motherboard/support/Z170A-GAMING-M7.html

I can't help you with this. Wait for someone else to reply. Good luck.

 

[Colif]

download and run msi live update, it is possible the error was caused by an older intel driver. You will find it on the utility page here

updating bios could help as well, I am not 100% sure about this error as I have not seen it before

update killer ethernet drivers - http://www.killernetworking.com/driver-downloads

 

[lagastrolo]

Thank you very much for your reply. I just updated my BIOS and killernetwork drivers.
If i will get any BSOD i will let you know

thanks again.

Kind regards

 

[lagastrolo]

Just had another BSOD:

Instant Online Crash Analysis, brought to you by OSR Open Systems Resources, Inc.

Show DivPrimary Analysis

Crash Dump Analysis provided by OSR Open Systems Resources, Inc. (http://www.osr.com)
Online Crash Dump Analysis Service
See http://www.osronline.com for more information
Windows 8 Kernel Version 15063 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0xfffff800`7b80c000 PsLoadedModuleList = 0xfffff800`7bb585c0
Debug session time: Sat Aug 26 20:56:56.977 2017 (UTC - 4:00)
System Uptime: 0 days 0:18:49.672
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000011, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8007b879483, address which referenced memory

Debugging Details:
------------------

TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2

READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPagedPoolEnd
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
0000000000000011

CURRENT_IRQL: 2

FAULTING_IP:
nt!KiExitDispatcher+e3
fffff800`7b879483 0fb64611 movzx eax,byte ptr [rsi+11h]

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

BUGCHECK_STR: AV

PROCESS_NAME: chrome.exe

BAD_PAGES_DETECTED: 934f

TRAP_FRAME: ffffa70050f677a0 -- (.trap 0xffffa70050f677a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000000004c rbx=0000000000000000 rcx=0000000000000002
rdx=fffff8007bc04200 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8007b879483 rsp=ffffa70050f67930 rbp=0000000000000001
r8=fffff8007bc04200 r9=0000000000000000 r10=00000000000000ff
r11=fffff8007b80c000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
nt!KiExitDispatcher+0xe3:
fffff800`7b879483 0fb64611 movzx eax,byte ptr [rsi+11h] ds:00000000`00000011=??
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff8007b9838a9 to fffff8007b978560

STACK_TEXT:
ffffa700`50f67658 fffff800`7b9838a9 : 00000000`0000000a 00000000`00000011 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffffa700`50f67660 fffff800`7b981e7d : ffff9083`04ba6c60 ffff9083`00000000 00000000`00000000 ffffa700`50f67948 : nt!KiBugCheckDispatch+0x69
ffffa700`50f677a0 fffff800`7b879483 : fffff800`7a942180 fffff800`7bcadd98 00000000`00000000 fffff800`00000001 : nt!KiPageFault+0x23d
ffffa700`50f67930 fffff800`7b878fe9 : ffff9083`055aa850 000000f2`00000000 00000000`00000000 00000000`00000000 : nt!KiExitDispatcher+0xe3
ffffa700`50f679a0 fffff800`7bcbc222 : 00000000`00000000 00000000`00000000 00000000`00000130 000000f2`a47fea60 : nt!KeSetEvent+0x99
ffffa700`50f67a30 fffff800`7b983413 : ffff9083`0533c080 00000000`00000000 00000000`00000000 ffff9083`055aa850 : nt!NtSetEvent+0x92
ffffa700`50f67a80 00007ff9`a4bc5564 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
000000f2`a47fe9b8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7ff9`a4bc5564


STACK_COMMAND: kb

SYMBOL_NAME: PAGE_NOT_ZERO

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Unknown_Module

IMAGE_NAME: Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP: 0

BUCKET_ID: PAGE_NOT_ZERO

Followup: MachineOwner
---------

*** Memory manager detected 37711 instance(s) of page corruption, target is likely to have memory corruption.


This free analysis is provided by OSR Open Systems Resources, Inc.
Want a deeper understanding of crash dump analysis? Check out our Windows Kernel Debugging and Crash Dump Analysis Seminar (opens in new tab/window)
Show DivCrash Code Links

Show DivInformation About Address 0x11

Show DivLoaded Module List

Show DivRaw Stack Contents

Show DivDump Header Information

Show DivStrings

 

[Colif]

at least its a new error, and one i have seen (too many times), can you give us the dump file again and we see what it can show us this time. That error usually caused by a driver, sometimes can be ram but normally a driver

it might help to run memtest86 on your ram stick. If it finds any errors, its a sign you need to replace the ram as the only score you want is 0. It creates a bootable USB so can run outside of windows

ram is a long shot only as 1st error had something to do with file system.

 

[lagastrolo]

i just did the memtest86, no errors. pass completed. Do i have to run it a few more times?

 

[Colif]

Fine, it was just a long shot after all. If you upload the dump we will try to find cause of error, hopefully find something other than killer drivers to blame. I know you updated them but they are well known for causing crashes, you just don't have any other choice

 

[lagastrolo]

Here is the (mini)dumpfile:

Instant Online Crash Analysis, brought to you by OSR Open Systems Resources, Inc.

Show DivPrimary Analysis

Crash Dump Analysis provided by OSR Open Systems Resources, Inc. (http://www.osr.com)
Online Crash Dump Analysis Service
See http://www.osronline.com for more information
Windows 8 Kernel Version 15063 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0xfffff801`5ee0f000 PsLoadedModuleList = 0xfffff801`5f15b5c0
Debug session time: Sun Aug 27 05:12:01.018 2017 (UTC - 4:00)
System Uptime: 0 days 1:39:55.713
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffffa0814a9f9670, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffffa0814a9f95c8, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------

TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

BUGCHECK_STR: 0x139

PROCESS_NAME: System

CURRENT_IRQL: 2

BAD_PAGES_DETECTED: aa33

LAST_CONTROL_TRANSFER: from fffff8015ef868a9 to fffff8015ef7b560

STACK_TEXT:
ffffa081`4a9f9348 fffff801`5ef868a9 : 00000000`00000139 00000000`00000003 ffffa081`4a9f9670 ffffa081`4a9f95c8 : nt!KeBugCheckEx
ffffa081`4a9f9350 fffff801`5ef86c10 : 00000000`00000000 00000000`00000000 00000005`76d1a9d4 00000005`76d1b7c7 : nt!KiBugCheckDispatch+0x69
ffffa081`4a9f9490 fffff801`5ef85bf7 : 00000000`00140001 00000000`000000ff 00000000`00000000 ffffb18c`781f31f0 : nt!KiFastFailDispatch+0xd0
ffffa081`4a9f9670 fffff801`5ef8bcd2 : ffffb18c`00000000 ffffb18c`00000000 ffffb18c`6ff367c0 ffffb18c`6f295000 : nt!KiRaiseSecurityCheckFailure+0xf7
ffffa081`4a9f9800 fffff801`5ee7efd3 : ffffa081`4aa40180 00000000`00000000 00000000`00000001 00000000`00000000 : nt!KiDeferredReadyThread+0x10f562
ffffa081`4a9f98c0 fffff801`5ee807d9 : 00000000`00000000 ffffb18c`782b11f0 ffffa081`4a9f9a98 00000000`00000000 : nt!KiReadyThread+0x33
ffffa081`4a9f98f0 fffff801`5ee81707 : ffffa081`4aa40180 00000000`003bb94f 00000000`00000000 00000000`00037d86 : nt!KiProcessExpiredTimerList+0x189
ffffa081`4a9f99e0 fffff801`5ef7e60a : 00000000`00000000 ffffa081`4aa40180 00000000`00000000 ffffa081`4aa4cd80 : nt!KiRetireDpcList+0x367
ffffa081`4a9f9be0 00000000`00000000 : ffffa081`4a9fa000 ffffa081`4a9f3000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x5a


STACK_COMMAND: kb

SYMBOL_NAME: PAGE_NOT_ZERO

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Unknown_Module

IMAGE_NAME: Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP: 0

BUCKET_ID: PAGE_NOT_ZERO

Followup: MachineOwner
---------

*** Memory manager detected 43571 instance(s) of page corruption, target is likely to have memory corruption.


This free analysis is provided by OSR Open Systems Resources, Inc.
Want a deeper understanding of crash dump analysis? Check out our Windows Kernel Debugging and Crash Dump Analysis Seminar (opens in new tab/window)
Show DivCrash Code Links

Show DivLoaded Module List

Show DivRaw Stack Contents

Show DivDump Header Information

Show DivStrings


END OF DUMPFILE


these BSOD appears when i watch youtube vids, i have no idea why, i can watch youtube but after a while, i just end up having the BSOD...

rly weird 🙁


ty for your reply once again

 

[lagastrolo]

Update: BSOD - after watching youtube for 2 hours.


BEGIN OF BSOD FILE:

Instant Online Crash Analysis, brought to you by OSR Open Systems Resources, Inc.

Show DivPrimary Analysis

Crash Dump Analysis provided by OSR Open Systems Resources, Inc. (http://www.osr.com)
Online Crash Dump Analysis Service
See http://www.osronline.com for more information
Windows 8 Kernel Version 15063 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0xfffff800`0be9b000 PsLoadedModuleList = 0xfffff800`0c1e75c0
Debug session time: Sun Aug 27 22:44:08.501 2017 (UTC - 4:00)
System Uptime: 0 days 17:31:45.196
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

RESOURCE_NOT_OWNED (e3)
A thread tried to release a resource it did not own.
Arguments:
Arg1: ffffbb8645876d90, Address of resource
Arg2: ffffbb863e1b9080, Address of thread
Arg3: ffffbb864595e4f0, Address of owner table if there is one
Arg4: 0000000000000002

Debugging Details:
------------------

TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

BUGCHECK_STR: 0xE3

PROCESS_NAME: csrss.exe

CURRENT_IRQL: 0

BAD_PAGES_DETECTED: 9340

LAST_CONTROL_TRANSFER: from fffff8000c03130b to fffff8000c007560

STACK_TEXT:
ffff8180`0853f5e8 fffff800`0c03130b : 00000000`000000e3 ffffbb86`45876d90 ffffbb86`3e1b9080 ffffbb86`4595e4f0 : nt!KeBugCheckEx
ffff8180`0853f5f0 fffff800`0beff62a : ffff8180`0853f810 ffffbb86`455210f0 00000000`00000001 ffff92b2`2eab29ae : nt!ExpReleaseResourceSharedForThreadLite+0x1323cb
ffff8180`0853f6b0 ffff92b2`2d649884 : 00000000`00000004 ffff8180`0853f802 00000000`00000001 00000000`00000002 : nt!ExReleaseResourceAndLeaveCriticalRegion+0xea
ffff8180`0853f710 ffff92b2`2ea8967e : 00000000`00000000 ffffbb86`3e1b9080 00000000`00000000 00000000`00000005 : win32kfull!RawInputThread+0x14d4
ffff8180`0853fa10 ffff92b2`2d63d5df : ffffbb86`00000002 ffff8180`0debed80 ffffbb86`3e1b9080 00000000`00000000 : win32kbase!xxxCreateSystemThreads+0x12e
ffff8180`0853fa50 fffff800`0c012413 : ffffbb86`3e1b9080 00000000`00000005 00000272`b6504500 00000000`00002444 : win32kfull!NtUserCallNoParam+0x2f
ffff8180`0853fa80 00007ffb`7dea1124 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
000000e6`2a4ff868 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7ffb`7dea1124


STACK_COMMAND: kb

SYMBOL_NAME: PAGE_NOT_ZERO

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Unknown_Module

IMAGE_NAME: Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP: 0

BUCKET_ID: PAGE_NOT_ZERO

Followup: MachineOwner
---------

*** Memory manager detected 37696 instance(s) of page corruption, target is likely to have memory corruption.


This free analysis is provided by OSR Open Systems Resources, Inc.
Want a deeper understanding of crash dump analysis? Check out our Windows Kernel Debugging and Crash Dump Analysis Seminar (opens in new tab/window)
Show DivCrash Code Links

Show DivLoaded Module List

Show DivRaw Stack Contents

Show DivDump Header Information

Show DivStrings


END OF DUMPFILE

 

[Colif]

Instead of using the online site to produce that file, can you do this again and we will look at the dumps, as there are ways to see what drivers are running at time it crashed

can you look in c:\windows folder and change view to show hidden items and see how big your memory.dmp file is. If its only small (since its a clean install, it should be), can you copy it to documents and then upload it to a file sharing site and share a link here, someone who can read the dumps will see what they can figure out

Also, can you do this so next time it crashes the file will be a lot smaller:

Can you follow option one here
and then do this step below: Small memory dumps - Have Windows Create a Small Memory Dump (Minidump) on BSOD

that creates a file in c windows/minidump
copy that file to documents
upload the copy from documents to a cloud server and share the link here

 

[lagastrolo]

Tyvm for your reply:

here is the minidump file.

i removed one of my Ram sticks and havent got any BSOD so far watching youtube vids, but i got BSOD of Teamspeak 3 lol ???

here is the file:

https://ufile.io/pap8y

Would appreciate your answer!

Kind regards,

 

[gardenman]

Hi, I ran the dump file through the debugger and got the following information: https://pastebin.com/WEsZeErd

File: 090517-3421-01.dmp (Tue Sep 5 23:04:28.407 2017)
BugCheck: [RESOURCE_NOT_OWNED (E3)]
Probably caused by: win32kfull.sys (Process: ts3client_win6)
System Uptime: 3 days 23:48:05.102

I can't help you with this. Wait for someone else to reply. Good luck.

 

[Colif]

So according to report your bios is dated 25th April 2017 yet on motherboard web site there isn't one with that date. Your version is 1.I0 yet that doesn't match up with any and newest is 7976v1I dated 8th May 2017, so not sure whats going on. Unless MSI have two Z170A Gaming M7 boards

Teamspeak crashed but i can't guess what caused it. I mean, I could, it could be LAN or Audio drivers, but you appear to have newest of both. IT doesn't help your board uses Killer internet as I could just point at them but that doesn't help.

I would read posting instructions on this Page below, and see if they can get to bottom of this - https://www.tenforums.com/bsod-crashes-debugging/

or if you lucky axe0axe01 will read this and figure out what I am missing

 

[axe0axe0]

Just reading this. Lagastrolo, if you still need help, follow https://www.sysnative.com/forums/bsod-crashes-kernel-debugging/68-blue-screen-of-death-bsod-posting-instructions-windows-10-8-1-8-7-vista.html, upload the zip to a 3rd party uploader and post a share link.