[SOLVED] BSODs and miscellaneous errors within the last week - Dump uploaded

[drumsloot]

Hello,

I bought a pre-built PC back in October 2021. It's been running wonderfully, but in the last week, I've been having an assortment of issues all hit at once, and I'm at a loss for what to do. I have done Memchecks, SFC, DSIM, and activated Driver Verifier, but I can't see any issues with my system despite it throwing up weird errors, and generally feeling janky and upset.

• I got a BSOD just today the moment I turned my back on my PC. I didn't catch what it said. I ran Memtest86, but when my PC rebooted, it bluescreened and had a do a system restore to fix things. The memtest never started. Once I was back to my desktop, I checked event viewer; the dump file I have attached to this post (see link below) is relevant to this repair. With WinDbg, I'm struggling to see what the problem is.
• Just 2 days ago, my PC ran into an issue on boot stating that my PC / Device needs to be repaired. "The header checksum for this file doesn't match the computed checksum. File: \windows\system32\windload.efi - Error code: 0xc0000221 (I fixed this by removing and reinserting my CMOS battery by a friend's recommendation)
• When I double click open a high resolution image fil with JPEGView, sometimes it will make my fans spin, and then it'll just give up, and won't open the image at all. If I try again, it might work, but I get the error "The file could not be read! Reason: not enough memory available". Windows Photos does not produce this error however.
• When I double click a .txt file from a fresh boot, I get an error telling me to "reinstall the application", which is weird. If I try again, the document opens in Notepad without issue.
• Boots are sluggish and my PC will wait just under a second any time I try to get it to play any media, e.g. YouTube videos, Spotify, offline video files, etc.

I'm at a loss. It feels like my Windows 11 install has slowly crumbled and collapsed.
Here's my specs:

Windows 11 64 Bit Home Edition
Intel Core i9-11900K 3.5GHz (Rocket Lake)
Asus GeForce RTX 3090 ROG Strix Gaming
Samsung 980 Pro 500GB M.2
Samsung 4TB 870 EVO SSD
Team Group Night Hawk RGB 64GB (4x16GB)
Asus ROG Strix Z590-A Gaming WIFI

Here's the Dump file: https://drive.google.com/file/d/1L41bFj9ioU8ruaP8B5ilMgXBnCYIiVEY/view?usp=sharing

Thank you to anyone who can give advice!

 

[Colif]

"The file could not be read! Reason: not enough memory available"

odd error to get on a pc with 64gb of ram, have you changed the page file at all?
Download Samsung Magician and run it on both ssd - https://semiconductor.samsung.com/consumer-storage/support/tools/ - run diagnostics and check SMART

latest bios on motherboard?

open command prompt admin
type chkdsk x: /f (replace x with drive letter of ssd)
if run on c drive, 2 paragraphs will appear. Agreee to running at restart and restart PC to let it run.
running it on a drive that isn't C shouldn't require a restart.

I will ask a friend to convert dumps

 

[drumsloot]

Thank you so much for your reply and thorough response! I will try all of this tomorrow. Really appreciate it.

 

[Colif]

Can you change your dump type to minidumps and we can check results of those, my friend has slow internet and downloading an entire memory dump can take hours

Can you follow option one on the following link - here - and then do this step below: Small memory dumps - Have Windows Create a Small Memory Dump (Minidump) on BSOD - that creates a file in c windows/minidump after the next BSOD

1. Open Windows File Explore
   
2. Navigate to C:\Windows\Minidump
   
3. Copy the mini-dump files out onto your Desktop
   
4. Do not use Winzip, use the built in facility in Windows
   
5. Select those files on your Desktop, right click them and choose 'Send to' - Compressed (zipped) folder
   
6. Upload the zip file to the Cloud (OneDrive, DropBox . . . etc.)
   
7. Then post a link here to the zip file, so we can take a look for you . . .
   

its possible someone else will read it while you wait.

 

[johnbl]

edit 4: debugger indicated that no pagefile.sys was found.
It could explain why verifier hit a bug in its own code.
I would create a pagefile.sys and just reboot and retest and maybe verifier be stupid and break. windows is a paging operating system, if no pagefile is on disk, windows will create a small one in RAM. I expect verifier might need too much page file space for this condition.
(trying to break into the debugger is a bug in verifier, that microsoft should fix)

edit 3: looks like filter manager read something from the registry before the bugcheck. might just be a bad value.
will see if I can find the key. (ove4r 900 registry keys open, can not tell which one was related to the problem)

edit 2: verifier breaking and called a breakpoint so it would go into a kernel debugger. Normally would not happen on retail code.

edit: this looks like it was caused by a bug in verifier testing. IE it broke verifier. Looking, I do see that verifier is turned on and various flags are set.

you should disable verifier by running
verifier.exe /reset
or exclude filecrypt.sys from the verifier driver testing.
you might have to exclude the fileter manager from testing (not sure) fltmgr.sys
system was up for 8 seconds before bugcheck.

bugcheck looks like it was caused by a invalid parameter given to
filecrypt.sys (windows encryption filter)

will see if I can find out why in a minute
-----------
edit: adding the stack in case other people try to run verifier without a pagefile.sys and hit this bug.

: kd> kc
# Call Site
00 nt!KeBugCheckEx
01 nt!PspSystemThreadStartup$filt$0
02 nt!_C_specific_handler
03 nt!RtlpExecuteHandlerForException
04 nt!RtlDispatchException
05 nt!KiDispatchException
06 nt!KiExceptionDispatch
07 nt!KiDebugServiceTrap
08 nt!DebugPromptAfterInt3
09 nt!DbgPrompt
0a FLTMGR!FltpvPrintErrors
0b FLTMGR!FltpvValidateVerifierState
0c FLTMGR!FltvInstanceSetup
0d FLTMGR!FltpDoInstanceSetupNotification
0e FLTMGR!FltpInitInstance
0f FLTMGR!FltpCreateInstanceFromName
10 FLTMGR!FltpEnumerateRegistryInstances
11 FLTMGR!FltpDoVolumeNotificationForNewFilter
12 FLTMGR!FltStartFiltering
13 filecrypt!DriverEntry
14 filecrypt!GsDriverEntry
15 nt!PnpCallDriverEntry
16 nt!IopLoadDriver
17 nt!IopInitializeSystemDrivers
18 nt!IoInitSystem
19 nt!Phase1Initialization
1a nt!PspSystemThreadStartup
1b nt!KiStartSystemThread

 

[johnbl]

I expect you just need to run verifier.exe /reset
and let windows make a pagefile.sys (virtual memory) on your system.
some programs will just refuse to run with a internal pagefile in ram. typical for some photo edit software.

 

[drumsloot]

OK, I just had an assortment of new BSODs. Without a system restore, I was not able to get back into Windows at all. This occurred after using nVidia GeForce Experience to scan my system automatically for overclock potential. It restarted mid-scan, and that was it - I was no longer able to reach Windows without hitting a blue screen.

Here are the non-generic errors I got in order:

1. The digital signature for this file couldn't be verified. Error code: 0x0000428
2. The operating system couldn't be loaded because the kernel is missing or contains errors. File: \windows\system32\ntoskrnl.exe - Error code: 0x0000221
3. The operating system couldn't be loaded because a critical system driver is missing or contains errors. File: \windowszsystem32\drivers\evbd0a.sys - Error code: 0x0000221
4. The operating system couldn't be loaded because a critical system driver is missing or contains errors. File: \windowszsystem32\drivers\bfadi.sys - Error code: 0x0000221

Note how it's a different integral system file every time. I also got a few generic blue / black screens which did not state an error code or file, or just showed a temporary STOPCODE which looked generic.

Each time my computer kicked up an error on boot, it gave me the option to press Enter to try again, or press F1 to enter Recovery Environment. Pressing F1 actually made my PC restart each time. I got the same result if I pressed Esc for UEFI Firmware Settings.

Verifier is no longer running. I have now reset all overclocking software. I activated minidumps before all these BSODs were going on, but once I got back into Windows at last, I checked and saw that my system had reverted back to standard dumps. I have uploaded the new dump file here if anyone would like to take a look. https://drive.google.com/file/d/1Or56lbGC0c46uqxZpHDHV1LFFG6zNt-0/view?usp=sharing

Thank you for your help so far, everyone. I am beginning to worry my M.2 is failing or something quite sinister is going on with my PC.

 

[drumsloot]

I downloaded Samsung Magician and gave it a go. It updated the firmware for both of my SSDs (I didn't know SSDs needed firmware?) and it also checked the health of them. Both are performing excellently, according to that.
Additionally, Userbenchmark is giving my PC a really good score, so I no longer think there's any sort of hardware fault.
After the system restore described in my previous post, there have been no problems. Other than giving Windows 11 a reinstall, I just don't know what else to do to prevent these issues from rearing their ugly heads.

 

[Colif]

Additionally, Userbenchmark is giving my PC a really good score, so I no longer think there's any sort of hardware fault.

it just measures performance, as in speed, not health.

ssd firmware updates the memory controller and can make them better.

edit 4: debugger indicated that no pagefile.sys was found.
It could explain why verifier hit a bug in its own code.
I would create a pagefile.sys and just reboot and retest and maybe verifier be stupid and break. windows is a paging operating system, if no pagefile is on disk, windows will create a small one in RAM. I expect verifier might need too much page file space for this condition.
(trying to break into the debugger is a bug in verifier, that microsoft should fix)

-----------
edit: adding the stack in case other people try to run verifier without a pagefile.sys and hit this bug.

I assume from presence of minidumps now you set up a page file?

OOM error with 64gb of ram suddenly makes sense if you didn't have a page file. I know its common advice to remove page file if you have 64gb of ram but really, Windows will only use it if you run out of ram. Its default size is likely 2gb now - I have 32gb of ram, page file is only 2gb. Its not like you will miss it , you could put it on the 4tb ssd and not even notice its there.

without a page file, windows doesn't have anywhere to put itself if you need all 64gb of ram for something. Its about only time it uses it, if it has to decompress files in ram and write to drive.

most of time windows, when you close a program, doesn't write the data to storage right away. Instead it compresses it in ram, thinking if you open program again its much faster to decompress it in ram than move it from slower storage drives. It only writes it to drive if you turn PC off or need that space.

errors where victim is a moving target make me think its ram.

what did you check ram with?
Try running memtest86 on each of your ram sticks, one stick at a time, up to 4 passes. Only error count you want is 0, any higher could be cause of the BSOD. Remove/replace ram sticks with errors.
Memtest is created as a bootable USB so that you don’t need windows to run it

with 64gb of ram, its going to take a while to check it so I would run it overnight.

 

[drumsloot]

I do have a page file! According to System Properties > Advanced > Performance Options > Advanced > Virtual Memory, I have 4096 MB currently allocated to the page file. It was checked as "automatically manage paging file size for all drives".
I have now changed this to "Custom Size" and set both Initial Size and Maximum Size to 9066 MB, which is what the "recommended" paging file size is shown as in that same window. Perhaps the page file was too small, which caused these problems?

I'll run Memtest tomorrow. Thank you so much.

 

[Colif]

You should leave it as automatic, if you restrict it to any size it might cause errors. Windows will expand it if it needs to. it can grow it to twice size of ram if it needs to.
With 64gb, it shouldn't need to.. unless you use 64gb a lot. What do you run that uses all the ram?

Windows hardly ever uses page file, its the last choice.

 

[Mr.Tibbs]

Re-install Windows 11 and you will see your hardware is O.K.

Re-set your PC, and save your files option, but put all your files on a USB.
Write down all the key codes to re install your software. Some are in your account for your software.

I had the same problem and then I could not boot up without an error
message about secure boot keys. I had a Western Digital NVMe although.

 

[drumsloot]

You should leave it as automatic, if you restrict it to any size it might cause errors. Windows will expand it if it needs to. it can grow it to twice size of ram if it needs to.
With 64gb, it shouldn't need to.. unless you use 64gb a lot. What do you run that uses all the ram?

Windows hardly ever uses page file, its the last choice.

Thank you, I have reverted it to be automatic. After doubling it, however, I did not discover any problems at all.

I run very intensive programs; video editing software (Camtasia), Photoshop, as well as streaming software like OBS and Streamer.bot, so a lot of RAM is necessary for what I do. I only recently doubled from 32 to 64GB within the last couple of weeks.

I have yet to run the Memtests, I forgot to do it today and now I won't have time. Will do it soon.

 

[Colif]

I only recently doubled from 32 to 64GB within the last couple of weeks.

is that one set of ram?
did you double your ram amount by just adding one set to an existing set?
did the errors only start when you added more ram?

if so, that could be reason for BSOD.
Sets are only tested to work with the sticks in the set. Putting 2 sets together can cause BSOD. The more sticks you combine the more chance of errors.

If you want 64gb of ram, you best buy one set.

 

[drumsloot]

is that one set of ram?
did you double your ram amount by just adding one set to an existing set?
did the errors only start when you added more ram?

if so, that could be reason for BSOD.
Sets are only tested to work with the sticks in the set. Putting 2 sets together can cause BSOD. The more sticks you combine the more chance of errors.

If you want 64gb of ram, you best buy one set.

I purchased 2 additional sticks of identical RAM; same brand, same model, same size. I was under the impression that doing so wouldn't result in any problems?

I'll keep that in mind for the future.

The above BSODs occurred after the RAM was added, but were not immediately after; the BSODs occurred whenever I tried to overclock my GPU, so I thought that might have been what was wrong.

 

[Colif]

Intel cpu are generally better at mix/matching but its doesn't always work.

 

[drumsloot]

Intel cpu are generally better at mix/matching but its doesn't always work.

Good to know. Thank you so much for all your help!!