[SOLVED] can anyone help me

[Zodiac2160]

Hi
i keep getting random bsod errors with different codes i tested every hardware component and everything seems fine here is my specs
Operating System
Windows 10 Pro 64-bit
CPU
AMD Ryzen 5 3500X 47 °C
Matisse 7nm Technology
RAM
8.00GB Single-Channel Unknown @ 1596MHz (16-18-18-36)
Motherboard
Gigabyte Technology Co. Ltd. B450M GAMING (AM4) 31 °C
Graphics
S22F350 (1920x1080@60Hz)
2047MB NVIDIA GeForce GTX 1660 SUPER (ZOTAC International) 32 °C
Storage
111GB Patriot Burst (SATA (SSD)) 33 °C
931GB Western Digital WDC WD10EZEX-21WN4A0 (SATA ) 33 °C
931GB Western Digital WDC WD10JPVX-60JC3T0 (SATA ) 30 °C
and here is the memory.dmp

Spoiler: Dump info

Microsoft (R) Windows Debugger Version 10.0.20153.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.


Path validation summary *
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff80313000000 PsLoadedModuleList = 0xfffff80313c2a4b0
Debug session time: Sun Feb 7 18:40:43.245 2021 (UTC + 2:00)
System Uptime: 0 days 0:10:46.872
Loading Kernel Symbols
...............................................................
................................................................
................................................................
...
Loading User Symbols

Loading unloaded module list
...........
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff803133f5a80 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffff80317e6c320=0000000000000139
0: kd> !analyze -v
***

• *
• Bugcheck Analysis *
• *

***

KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: fffff80317e6c640, Address of the trap frame for the exception that caused the bugcheck
Arg3: fffff80317e6c598, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------


KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 2952

Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-E2QA0OP

Key : Analysis.DebugData
Value: CreateObject

Key : Analysis.DebugModel
Value: CreateObject

Key : Analysis.Elapsed.mSec
Value: 3053

Key : Analysis.Memory.CommitPeak.Mb
Value: 75

Key : Analysis.System
Value: CreateObject

Key : WER.OS.Branch
Value: vb_release

Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key : WER.OS.Version
Value: 10.0.19041.1


ADDITIONAL_XML: 1

OS_BUILD_LAYERS: 1

BUGCHECK_CODE: 139

BUGCHECK_P1: 3

BUGCHECK_P2: fffff80317e6c640

BUGCHECK_P3: fffff80317e6c598

BUGCHECK_P4: 0

TRAP_FRAME: fffff80317e6c640 -- (.trap 0xfffff80317e6c640)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffd3810a557158 rbx=0000000000000000 rcx=0000000000000003
rdx=ffffd3810a08e158 rsi=0000000000000000 rdi=0000000000000000
rip=fffff803134127b0 rsp=fffff80317e6c7d0 rbp=fffff8030f8b3180
r8=0000000000000102 r9=0000000000000000 r10=fffff8030f8b6ac0
r11=000000018190e7fb r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
nt!KiTryUnwaitThread+0x1c6460:
fffff803134127b0 cd29 int 29h Resetting default scope EXCEPTION_RECORD: fffff80317e6c598 -- (.exr 0xfffff80317e6c598) ExceptionAddress: fffff803134127b0 (nt!KiTryUnwaitThread+0x00000000001c6460) ExceptionCode: c0000409 (Security check failure or stack buffer overrun) ExceptionFlags: 00000001 NumberParameters: 1 Parameter[0]: 0000000000000003 Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY BLACKBOXBSD: 1 (!blackboxbsd) BLACKBOXNTFS: 1 (!blackboxntfs) BLACKBOXPNP: 1 (!blackboxpnp) BLACKBOXWINLOGON: 1 PROCESS_NAME: System ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application. EXCEPTION_CODE_STR: c0000409 EXCEPTION_PARAMETER1: 0000000000000003 EXCEPTION_STR: 0xc0000409 STACK_TEXT: fffff80317e6c318 fffff80313407a69 : 0000000000000139 0000000000000003 fffff80317e6c640 fffff80317e6c598 : nt!KeBugCheckEx fffff80317e6c320 fffff80313407e90 : fffff80317e6c758 0000000000000000 fffff80317e6c4d0 0000000000000000 : nt!KiBugCheckDispatch+0x69 fffff80317e6c460 fffff80313406223 : ffffd381059fa010 0000000000000000 ffffffffffffffd1 fffff80325e3ea52 : nt!KiFastFailDispatch+0xd0 fffff80317e6c640 fffff803134127b0 : 0000000000000000 0000000000989680 0000000000000002 0000000000000000 : nt!KiRaiseSecurityCheckFailure+0x323 fffff80317e6c7d0 fffff803132452d6 : ffffd3810a557188 0000000000000000 ffffd3810a557250 0000000000000000 : nt!KiTryUnwaitThread+0x1c6460 fffff80317e6c830 fffff80313244e7c : ffffd3810a557180 0000000000000000 fffff80317e6cb18 0000000000000000 : nt!KiTimerWaitTest+0x1e6 fffff80317e6c8e0 fffff803132072e9 : 0000000000000000 0000000000000000 0000000000140001 000000000000607c : nt!KiProcessExpiredTimerList+0xdc fffff80317e6c9d0 fffff803133f95ee : 0000000000000000 fffff8030f8b3180 fffff80313d27600 ffffd3810af8a080 : nt!KiRetireDpcList+0x9d9 fffff80317e6cc60 0000000000000000 : fffff80317e6d000 fffff80317e67000 0000000000000000 00000000`00000000 : nt!KiIdleLoop+0x9e


SYMBOL_NAME: nt!KiTimerWaitTest+1e6

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: 1e6

FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_KTIMER_LIST_CORRUPTION_nt!KiTimerWaitTest

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {efb56395-a173-53f8-073d-d3c8cfd50e2b}

Followup: MachineOwner
---------

 

[Colif]

right click start button
choose powershell (admin)
type SFC /scannow and press enter
once its completed, copy/paste this command into same window:
Repair-WindowsImage -Online -RestoreHealth
and press enter

SFC fixes system files, second command cleans image files, re run SFC if it failed to fix all files and restart PC


Can you follow option one on the following link - here - and then do this step below: Small memory dumps - Have Windows Create a Small Memory Dump (Minidump) on BSOD - that creates a file in c windows/minidump after the next BSOD

Open Windows File Explorer

Navigate to C:\Windows\Minidump

Copy the mini-dump files out onto your Desktop

Do not use Winzip, use the built in facility in Windows

Select those files on your Desktop, right click them and choose 'Send to' - Compressed (zipped) folder

Upload the zip file to the Cloud (OneDrive, DropBox . . . etc.)

Then post a link here to the zip file, so we can take a look for you . . .

 

[Zodiac2160]

right click start button
choose powershell (admin)
type SFC /scannow and press enter
once its completed, copy/paste this command into same window:
Repair-WindowsImage -Online -RestoreHealth
and press enter

SFC fixes system files, second command cleans image files, re run SFC if it failed to fix all files and restart PC


Can you follow option one on the following link - here - and then do this step below: Small memory dumps - Have Windows Create a Small Memory Dump (Minidump) on BSOD - that creates a file in c windows/minidump after the next BSOD

Open Windows File Explorer

Navigate to C:\Windows\Minidump

Copy the mini-dump files out onto your Desktop

Do not use Winzip, use the built in facility in Windows

Select those files on your Desktop, right click them and choose 'Send to' - Compressed (zipped) folder

Upload the zip file to the Cloud (OneDrive, DropBox . . . etc.)

Then post a link here to the zip file, so we can take a look for you . . .

https://drive.google.com/file/d/15nedCpTCn3JGYmPwi3N6ylnppISBq6sO/view?usp=sharing here it is

 

[Colif]

can you make the link accessible to anyone with the link? its an option on google drive see link -

https://support.google.com/drive/answer/2494822?co=GENIE.Platform=Android&hl=en

 

[Zodiac2160]

can you make the link accessible to anyone with the link? its an option on google drive see link -

https://support.google.com/drive/answer/2494822?co=GENIE.Platform=Android&hl=en

https://drive.google.com/file/d/15nedCpTCn3JGYmPwi3N6ylnppISBq6sO/view?usp=sharing Done

 

[Colif]

okay, I ask a friend to convert them, he might post soon or alter, i don't know. He will include a link I can use to read a conversion of the dump files. He might have an answer for you, depends how obvious it all is.

 

[Zodiac2160]

Thank you for caring

 

[gardenman]

Hi, I ran the dump file through the debugger and got the following information: https://jsfiddle.net/t1czhv0b/show This link is for anyone wanting to help. You do not have to view it. It is safe to "run the fiddle" as the page asks.

File information:	021021-7015-01.dmp (Feb 9 2021 - 20:05:42)
Bugcheck:	KMODE_EXCEPTION_NOT_HANDLED (1E)
Probably caused by:	memory_corruption (Process: System)
Uptime:	0 Day(s), 1 Hour(s), 31 Min(s), and 14 Sec(s)

Possible Motherboard page: https://www.gigabyte.com/Motherboard/B450M-GAMING-rev-1x
There is a minor BIOS update available for your system. You are using version F60f and the latest is F60h. Wait for additional information before deciding to update or not. Important: Verify that I have linked to the correct motherboard. Updating your BIOS can be risky. Never try it when you might lose power (lightning storms, recent power outages, etc).

This information can be used by others to help you. Someone else will post with more information. Please wait for additional answers. Good luck.

 

[Colif]

Do you use the Apple charger?
weird rgb fusion uses a 2008 driver.
what is this for?

Aug 12 2017

pneteth.sys

PDANet Broadband Adapter driver (June Fabrics Technology Inc.)

Have you run gigabyte app centre? it updates drivers, but it also tries to give you all the extra apps you don't really need.
There could be a newer version of chipset drivers - https://www.amd.com/en/support/chipsets/amd-socket-am4/b450

Update lan drivers, 3rd link down under Windows 10 header - https://www.realtek.com/en/componen...0-1000m-gigabit-ethernet-pci-express-software

 

[Zodiac2160]

Do you use the Apple charger?
weird rgb fusion uses a 2008 driver.
what is this for?

Aug 12 2017

pneteth.sys

PDANet Broadband Adapter driver (June Fabrics Technology Inc.)

Have you run gigabyte app centre? it updates drivers, but it also tries to give you all the extra apps you don't really need.
There could be a newer version of chipset drivers - https://www.amd.com/en/support/chipsets/amd-socket-am4/b450

Update lan drivers, 3rd link down under Windows 10 header - https://www.realtek.com/en/componen...0-1000m-gigabit-ethernet-pci-express-software

yes i ran gigabyte center should i uninstall it ? and no i did not use apple charger i just plug a usb type c and i use rgb fusion installed by gigabyte center and i tested the ram with memtest86 and no errors shown up

 

[Colif]

problem i have with app centre is it auto selects everything when you run it
so you have to untick the tick next to the header sections or it installs everything

So that is likely why you have the apple charger installed as it assumes you want everything when really, I don't want Norton Internet Security. You can uninstall Apple charger by right clicking the application in start menu list

I doubt App shop is causing the errors

did you install pdanet to use phone as a WIFI hotspot?

 

[Zodiac2160]

problem i have with app centre is it auto selects everything when you run it
so you have to untick the tick next to the header sections or it installs everything

So that is likely why you have the apple charger installed as it assumes you want everything when really, I don't want Norton Internet Security. You can uninstall Apple charger by right clicking the application in start menu list

I doubt App shop is causing the errors

did you install pdanet to use phone as a WIFI hotspot?

Yes that's right i got a bsod right now should I upload it to see it?

 

[Colif]

yes, show us any dump files you get from BSOD. More info I get, closer I can get to answer.

 

[Zodiac2160]

yes, show us any dump files you get from BSOD. More info I get, closer I can get to answer.

https://drive.google.com/file/d/1uT6dF86zMsD-u_ZN4Pltjgt3jWCkGoAC/view?usp=sharing

 

[Zodiac2160]

https://drive.google.com/file/d/1uT6dF86zMsD-u_ZN4Pltjgt3jWCkGoAC/view?usp=sharing

thats all the minidumps i found

 

[Colif]

okay, gardenman should read them when he returns.

 

[Zodiac2160]

okay, gardenman should read them when he returns.

waiting for him and thanks again

 

[gardenman]

The fiddle site is apparently down. Using PasteBin for now.

I ran the dump files through the debugger and got the following
information: https://pastebin.com/8Xkafp4H This link is for anyone wanting to help. You do not have to view it. It is safe to "run the fiddle" as the page asks.

Spoiler: Dump File Results

File information:	021121-6640-01.dmp (Feb 10 2021 - 20:07:27)
Bugcheck:	IRQL_GT_ZERO_AT_SYSTEM_SERVICE (4A)
Probably caused by:	ntkrnlmp.exe (Process: csrss.exe)
Uptime:	0 Day(s), 2 Hour(s), 58 Min(s), and 10 Sec(s)

File information:	021021-6578-01.dmp (Feb 10 2021 - 11:52:09)
Bugcheck:	APC_INDEX_MISMATCH (1)
Probably caused by:	ntkrnlmp.exe (Process: EpicGamesLaunc)
Uptime:	0 Day(s), 0 Hour(s), 21 Min(s), and 55 Sec(s)

File information:	021021-6468-01.dmp (Feb 10 2021 - 11:29:19)
Bugcheck:	APC_INDEX_MISMATCH (1)
Probably caused by:	ntkrnlmp.exe (Process: EpicGamesLaunc)
Uptime:	0 Day(s), 0 Hour(s), 57 Min(s), and 15 Sec(s)

This information can be used by others to help you. Someone else will post with more information. Please wait for additional answers. Good luck.

 

[Colif]

Try running memtest86 on your ram stick, up to 4 passes. Only error count you want is 0, any higher could be cause of the BSOD. Remove/replace ram sticks with errors.

Memtest is created as a bootable USB so that you don’t need windows to run it

you getting errors I don't normally see, hence the memtest.

 

[Zodiac2160]

Try running memtest86 on your ram stick, up to 4 passes. Only error count you want is 0, any higher could be cause of the BSOD. Remove/replace ram sticks with errors.

Memtest is created as a bootable USB so that you don’t need windows to run it

you getting errors I don't normally see, hence the memtest.

I did it before no errors the memory looks fine

 

[Zodiac2160]

I will do the test again

 

[Colif]

i didn't know you had.

csrss.exe is the client for your user on windows. doesn't tell me a great deal about potential cause.
all 3 seem to be the same thing
nt!KiSystemServiceExitPico+0x1fe they all have the same memory address it seems. So probably the same driver each time.

which is unusual. I don't exactly know what its doing
Pico is a Unix text editor... the more i look the less I am sure. pretty sure its part of windows, I have seen it before.

can you run this, it might give me some clues. It will create a zip file so if you can upload it, I see what it shows - https://www.sysnative.com/forums/pages/bsodcollectionapp/

 

[gardenman]

More (unhelpful) info about Pico processes:
https://docs.microsoft.com/en-us/archive/blogs/wsl/pico-process-overview

 

[Colif]

at least you got past the kmspico answers I was getting, and its hopefully not involved. I assume ops PC has a valid license

it seems it allows Windows to run an application inside another application process without setting up a VM. that is my laymans understanding of what i read. Don't know if command I see is coming from pico provider or the pico process itself.

Given your search result is from the Windows subsystem for linux, I still don't know what it was doing.

 

[Zodiac2160]

at least you got past the kmspico answers I was getting, and its hopefully not involved. I assume ops PC has a valid license

it seems it allows Windows to run an application inside another application process without setting up a VM. that is my laymans understanding of what i read. Don't know if command I see is coming from pico provider or the pico process itself.

Given your search result is from the Windows subsystem for linux, I still don't know what it was doing.

i cant reach the site can u upload it to google drive