[SOLVED] Computer getting bluescreens every day since I upgraded to Windows 11 ?

[ConorDuey2000]

Hey. Ever since I upgraded to Windows 11, my computer has been getting multiple bluescreens every day and so far, I've found absolutely no way to fix this. Since half of them are caused by "wdiwifi.sys" I've updated my Wi-Fi drivers, but Windows told me that the best drivers for my device are already installed. Since my motherboard is an Asus Tuf Gaming x570-Plus Wi-Fi motherboard, I also uninstalled my Wi-Fi drivers and installed the Wi-Fi driver's from Asus' website multiple times and I still get bluescreens that are caused by "wdiwifi.sys". The other half of the bluescreens are caused by "ntoskrnl.exe" and I think that's because of my Wi-Fi drivers. I've attached some dump files for you to look at.

https://drive.google.com/file/d/1qeoFLskHpv17OK33p2CFEC1M4kLLBOL5/view?usp=sharing

I've looked all though the internet for a fix and I've found absolutely nothing. Can you please help me fix this?

 

[Colif]

clean install is the hammer approach to BSOD fixing... but with 2 viruses. It might make sense.

If you lucky you don't have a BSOD after

 

[ConorDuey2000]

OK, but as Colif said malware shouldn't cause BSODs usually but if there was infection other data/files could've gone corrupt too, like drivers after they were installed maybe.

I would wipe and do a clean install of OS after finding malware in system. Unless removing the "viruses" and maybe later checking file system with "/sfc scannow" shows no problems and BSODs cease to happen.

The thing is, if I reformat my computer, I'll lose all of my files. Plus, I don't think that reformatting my computer will solve my problem. It must be a problem with Windows 11 because I've been getting these bluescreens ever since I upgraded to Windows 11. I think that VMWare is the cause of these bluescreens that I'm having so I've decided to stop all VMWare services, set these services to start manually, and disable the VMWare Tray Process from executing on startup so I'll only use VMWare when I need to. I'll give you an update to see if the VMWare bluescreens continue to happen or not.

 

[Colif]

tried updating it since its from 2019? drivers are anyway.

 

[ConorDuey2000]

Alright. This is getting worse. I just left my computer idle for fifteen minutes and it bluescreened with a "DPC_WATCHDOG_VIOLATION" probably caused by "ntoskrnl.exe". It seems that deleting those viruses and setting those VMWare services to manual didn't do anything to stop those "DPC_WATCHDOG_VIOLATION" bluescreens. I really need to have this problem fixed because I'm sick and tired of my computer bluescreening multiple times on a daily basis, even when I'm in the middle of working on something, losing all of my progress. Also, no, I'm not reformatting my computer. I'll literally lose all of my files and I don't have the money to buy data backup stuff and I definitely don't have $2,000 so I can buy a new computer and replace my current one. Please help me stop my computer from having constant bluescreens ASAP. Any suggestions to reformat my computer will be ignored.

By the way, if you wanna help me find the cause of those "DPC_WATCHDOG_VIOLATION" bluescreens on my computer, here is my computer's most minidump that happened when I recently left my computer idle for fifteen minutes.

 

[johnbl]

You do need to turn off armory crate in bios or it will just come back and put files on your system, I would suspect it would be a target for malware also. IE hide programs in bios and install them when you boot your system before windows loads. Plus, windows would not be able to delete the files.

 

[ConorDuey2000]

You do need to turn off armory crate in bios or it will just come back and put files on your system, I would suspect it would be a target for malware also. IE hide programs in bios and install them when you boot your system before windows loads. Plus, windows would not be able to delete the files.

I tried uninstalling Armory Crate and turning it off in the bios, but that just made my computer more unstable. I had to restore my computer to an earlier restore point to fix what happened. Anyway, here are the most recent minidumps on my computer. One of them said that it was caused by "amdppm.sys".

 

[ConorDuey2000]

By the way, I also have another problem. My computer freezes at random at least once a day and I'd have to do a hard reset. This even happens when I'm working on something and I lose all of my progress and I have to start all over again. In fact, just recently, I was working on something and my compute froze for absolutely no reason without warning so I had to turn my computer off and turn it back on, again, losing all of the progress that I made on my work and having to start all over again. I can't provide any minidumps whenever my computer freezes because it doesn't give me any when that happens. This is getting so bad that it's making me enjoy using my computer less and less and I'm very upset that I haven't gotten any help in fixing my computer, yet. Please. I'm begging you guys on this forum. Analyze all of the dumps that I sent and stop my computer from crashing.

Also, don't tell me to uninstall Armory Crate or turn it off in the bios. I did that, already, and it make my computer worse, so I had to restore it to an earlier restore point to fix my computer's problems.

 

[ConorDuey2000]

I recently left my computer idle for three minutes and it bluescreen. This time, it was an "IRQL_NOT_LESS_OR_EQUAL" bluescreen that was caused by "afd.sys". Here is the minidump for that bluescreen that just happened on my computer.

 

[johnbl]

I recently left my computer idle for three minutes and it bluescreen. This time, it was an "IRQL_NOT_LESS_OR_EQUAL" bluescreen that was caused by "afd.sys". Here is the minidump for that bluescreen that just happened on my computer.

running qbittorrent.exe looks like it was sending a datagram and it caused AFD.sys to break. looks like it tried to write to memory address zero.

could be app issue , network driver issue, tcp/ip issue or afd.sys.
(or vm network)

why do you have kprocesshacker.sys installed?
not sure what ctiaio64.sys is used for.

spcvbus.sys would be a suspect driver for memory corruption due to its file date of 2013. It is most likely not putting a pooltag that is now required of all drivers on current versions of windows. you should remove it or confirm it passes verifier.exe tests.

 

[gardenman]

not sure what ctiaio64.sys is used for.

I'm guessing it's a Creative Technology driver, likely Audio Input Output. I have seen the following Creative driver before: CtiIo64.sys with a slightly different name.

 

[ConorDuey2000]

running qbittorrent.exe looks like it was sending a datagram and it caused AFD.sys to break. looks like it tried to write to memory address zero.

could be app issue , network driver issue, tcp/ip issue or afd.sys.
(or vm network)

why do you have kprocesshacker.sys installed?
not sure what ctiaio64.sys is used for.

spcvbus.sys would be a suspect driver for memory corruption due to its file date of 2013. It is most likely not putting a pooltag that is now required of all drivers on current versions of windows. you should remove it or confirm it passes verifier.exe tests.

I haven't used Process Hacker that much and I haven't used it in a pretty long time, so I decided to uninstall it. Also, I do have qBittorrent 24/7 so that might be the cause of the internet related bluescreens on my computer.

 

[ConorDuey2000]

Alright. Once again, I left my computer idle for about three minutes and it got a bluescreen. This time, it was an "ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY" bluescreen that was probably caused by "csrss.exe". Here is the minidump for that bluescreened that just happened on my computer.

 

[johnbl]

Alright. Once again, I left my computer idle for about three minutes and it got a bluescreen. This time, it was an "ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY" bluescreen that was probably caused by "csrss.exe". Here is the minidump for that bluescreened that just happened on my computer.

csrss.exe used a bad page table entry and attempted to run data as code.
csrss.exe is a target for malware. this could be malware, or it could be a bug in your storage driver. I would delete the pagefile,sys and create another one by turning off virtual memory rebooting and turning it back on. I would also do a malware scan, then run cmd.exe as an admin then run
dism.exe /online /cleanup-image /restorehealth

Run the DISM.exe /Online /Cleanup-image /Restorehealth Tool (softwaretested.com)

you might want to reinstall from a clean windows image if you can not resolve the issue. I can not tell which storage device the pagefile was on.

looks like something trying to run in the kernel memory space but outside of a module. I looked at the raw stack but could not find any symbols to get a clue of what was going on.

 

[johnbl]

is your machine trying to connect to some wireless printer?
urn:uuid:1c852a4d-b800-1f08-abcd-b4b52f04e33b

maybe turn it off and reboot your computer and see if you still bugcheck.

or look in windows control panel device manager and see if it is trying to do a printer install and failing.

change the memory dump type to kernel and it will put the debug info into the memory.dmp file.

oh, I did find the rebuild the raw stack but it only had normal windows code.

 

[Colif]

I'm guessing it's a Creative Technology driver, likely Audio Input Output. I have seen the following Creative driver before: CtiIo64.sys with a slightly different name.

could just as easily be a virus/malware if op has Torrent running 24/7

Only result for that file name is this post. So I would scan for viruses, since you already found 2

I think that I found the problem to the wdiwifi.sys bluescreens. I found two viruses on my computer and I removed both of them. I'll give you an update to see if the wdiwifi.sys bluescreens continue to happen or not.

What did you use to find/remove them?
I would try
https://www.hitmanpro.com/en-us
or
https://www.bitdefender.com.au/solutions/free.html

you might want to reinstall from a clean windows image if you can not resolve the issue. I can not tell which storage device the pagefile was on.

I agree with this message. If you had 2 Viruses, you were already told to install on last page.

 

[johnbl]

windows scans your network and installs software drivers for devices it finds.
you can turn off the scanning and delete the registry key. These devices might have some pretty poor drivers programming.
start regedit.exe then find the hkey local machine
here is the path in the registry:
HKLM:\System\CurrentControlSet\Enum\SWD\DAFWSDProvider
then you can see what the vendor of the device is and maybe delete the entry and turn off the network scanning.
look for urn:uuid:1c852a4d-b800-1f08-abcd-b4b52f04e33b
here is better info on the subject:
Clean up the WSD and UPnP device list – systemcenterdiary (wordpress.com)

here is info on universal plug and play:
What is UPnP? Yes, It's Still Dangerous in 2022 | UpGuard

a kernel memory dump generally will show the state of plug and play. It might show some issue related to this problem. The minidump would not have the info.
DAFWSDProvider not sure what DAF stands for but WSD means web services for devices. some of this stuff can be used for a printer trying to tell your computer that it is low on ink or something. This stuff can be really buggy and require firmware updates to the device itself rather than any change to your computer. if this is the case, you can stop all of the network activity by disconnecting then let your machine go idle and see if you still bugcheck.
-----------
edit: DAF= Device Association Framework

 

[ConorDuey2000]

I've gotten a lot of bluescreens since last night. One bluescreen happened while I was writing a long document and I had to start all over at the beginning. Here are the most recent minidumps on my computer.

 

[ConorDuey2000]

windows scans your network and installs software drivers for devices it finds.
you can turn off the scanning and delete the registry key. These devices might have some pretty poor drivers programming.
start regedit.exe then find the hkey local machine
here is the path in the registry:
HKLM:\System\CurrentControlSet\Enum\SWD\DAFWSDProvider
then you can see what the vendor of the device is and maybe delete the entry and turn off the network scanning.
look for urn:uuid:1c852a4d-b800-1f08-abcd-b4b52f04e33b
here is better info on the subject:
Clean up the WSD and UPnP device list – systemcenterdiary (wordpress.com)

here is info on universal plug and play:
What is UPnP? Yes, It's Still Dangerous in 2022 | UpGuard

a kernel memory dump generally will show the state of plug and play. It might show some issue related to this problem. The minidump would not have the info.
DAFWSDProvider not sure what DAF stands for but WSD means web services for devices. some of this stuff can be used for a printer trying to tell your computer that it is low on ink or something. This stuff can be really buggy and require firmware updates to the device itself rather than any change to your computer. if this is the case, you can stop all of the network activity by disconnecting then let your machine go idle and see if you still bugcheck.
-----------
edit: DAF= Device Association Framework

I'm unable to delete the registry key because Windows won't let me. I'm also unable to run the PowerShell script because running PowerShell scripts is disabled on my computer.

 

[ConorDuey2000]

Yet again, my computer froze while I left it idle for about three minutes and I had to turn my computer off and turn it back on, again. Luckily, I wasn't working on anything when it froze. However, since it froze instead of getting a bluescreen, I didn't get any minidumps.

 

[johnbl]

I'm unable to delete the registry key because Windows won't let me. I'm also unable to run the PowerShell script because running PowerShell scripts is disabled on my computer.

maybe you need to make sure regedit is run as an administrator.
ie you can start cmd.exe as an admin then run
start regedit.exe and it will inherit the elevated permissions.
you can right mouse click on the registry key and it will brining up permissions. on my machine I have one samsung device under this setting and admin have full control while user only has read rights.

 

[ConorDuey2000]

maybe you need to make sure regedit is run as an administrator.
ie you can start cmd.exe as an admin then run
start regedit.exe and it will inherit the elevated permissions.

In ran Regedit as administrator and it still won't let me delete the file. However, I'd like to add that the latest minidump on my computer said that the bluescreen was probably caused by "tcpip.sys". I ran "netsh int ip reset" in an elevated Command Prompt window and I hope that this stops "tcpip.sys" from causing bluescreens on my computer.

 

[johnbl]

In ran Regedit as administrator and it still won't let me delete the file. However, I'd like to add that the latest minidump on my computer said that the bluescreen was probably caused by "tcpip.sys". I ran "netsh int ip reset" in an elevated Command Prompt window and I hope that this stops "tcpip.sys" from causing bluescreens on my computer.

tcpip is the network transport. it is not likely to be the cause as it is on all the windows machines and gets updated fixes automatically pushed out by windows update. (over 1 billion windows 10 machines is a pretty good test bed)
focus on 3rd party network aware software as being the most likely cause.

 

[ConorDuey2000]

Here is another minidump that just got created after my computer's most recent bluescreen. It was a "DPC_WATCHDOG_VIOLATION" bluescreen that was probably caused by the Corsair service that I need for my computer's keyboard.

 

[ConorDuey2000]

Yet again, I got another bluescreen on my computer. Here is the minidump for it. It's an "ATTEMPTED_WRITE_TO_READONLY_MEMORY" bluescreen that was probably caused by Discord.

 

[ConorDuey2000]

After about five minutes of being on, my computer got another bluescreen because of Discord. Here is the minidump for that bluescreen. It's a "PAGE_FAULT_IN_NONPAGED_AREA" bluescreen.