Constant blue screens. Event viewer is blaming realtek audio

[shadowferix]

Build:
CPU: Intel i5 6500 3.2 GHz
GPU: Nvidia Geforce GTX 970 4gb
SSD: Samsung 750 EVO 500gb SSD
RAM: HyperX FURY Black 16GB Kit (2x8GB) 2133MHz DDR4
PSU: Coolermaster G550M Bronze Certified
MOBO: Asus Z170 Pro Gaming'
OS: Windows 10 64 bit
Cooling: Coolermaster Hyper 212 EVO


I've been having blue screens on my computer for the past few months. I took it to a PC repair shop and they ran stress tests on my GPU and could not replicate the crashes. They went through my event viewer and saw that realtek hd audio was causing the crashes every single time. I tried disabling realtek and upgrading to the newest drivers for it but I'm still having the same issue. The blue screens stopped for a while and I thought it fixed itself but I was wrong. They pretty much come and go as they please. I think it started after the Fall Creators Update.

Yesterday I had a lot of blue screens. Not all the minidumps were saved though. I think this is because I got one blue screen and then it would attempt to restart and get another. I got about 3 blue screens before I was actually able to get back onto my computer.

1: System Service Exception What Failed: afd.sys
2: Kmode Exception Not Handled What Failed: NTFS.sys
3: System Service Exception (Nothing stated for what failed)

I've ran memtest86 about 4-5 times and my ram passed every time. I don't know if that's the issue but that's what my real life friends keep telling me. I'm already on my 3rd and 4th sticks and I don't even know if the others were bad or not because I didn't memtest them.

I have minidump files here:
https://www.dropbox.com/s/2qejfoqitf8uz63/022118-3359-01.dmp?dl=0
https://www.dropbox.com/s/lyqbryzex1jbfui/022118-3375-01.dmp?dl=0

Like I said I'm completely lost and don't know what to do. I just want to be able to play video games in peace again without worrying about a random crash happening.

 

[doolittle]

I have seen a lot of problems with updating to 1709 via windows update - a fresh install from ISO/USB usually corrects them nicely.

 

[Sedivy]

Are you good? I'm not sure. With driver verifier off, run it for a while, play games, see if you can get it to happen again spontaneously.
For windows update, you need to specifically tell it not to do 1709 if you even have the option. For how long? Until issues are worked out to the point that subsequent updates address the faults with previous ones. I'd say few months at least.
If you have windows 10 pro, you can defer the update in your settings. If you're not on pro, you can hide it like so:
https://www.tenforums.com/tutorials/8280-hide-show-windows-updates-windows-10-a.html
I also agree with doolittle, if you're not at your wits end and still have patience for potentially having to roll back again, reinstalling 1709 might not be entirely bad. I've had issues myself with it, and reinstall of 1709 fixed it for me. It wasn't the same issue though so I can't guarantee it'll be the same for you. If you are willing to try, it might be worth it. If you've had enough of updating and rolling back, then just stay at 1703 for a while.

 

[johnbl]

driver verifier does not really stress your system, it just check drivers for common programming mistakes and calls a bugcheck when it finds one.

verifier detected a problem with e1d65x64.sys this is
Intel Pro/1000 Network Adapter driver
\SystemRoot\system32\DRIVERS\e1d65x64.sys Thu Mar 10 06:16:33 2016

problem is the stack looks corrupted in the memory dump.
looks like the nt kernel has been replaced with a older version.
looks like your gpu drivers are not matched, one from the local windows driver store and the NVidia audio driver from a different build.

somehow you have a nt kernel from a old build on your system.
ntoskrnl.exe Fri Mar 17 21:40:44 2017

you should do a clean install from a fresh, known good image of windows
then install the motherboard drivers from the motherboard vendors website.
I would then go to the intel website and download the current intel network driver for your motherboard.
then after the windows updates are done, reboot the machine and run the NVidia gpu set up software and reboot when finished.

you might want to figure out how you got the old kernel installed, I would look for hacking software, viruses and malware.

 

[Karadjgne]

It's probably a leftover from the win7-win10 upgrade. Personally, I'd make sure the pc is registered at Microsoft account, dl a brand new copy of win10 and stick it on a USB bootable, that matches the key, scrap the current OS entirely and start over with a full clean win10 install, with no old OS junk included. That not only cleans up the C drive, but gets rid of any old drivers that might be conflicting, any possible virus or malware etc. Then it's just a matter of reinstalling mobo drivers, and software etc.

If all that fails to stop the issue, then I'd be taking a serious look at the SSD as possibly starting to fail, I'd use Samsung magician 4.3? to verify. Just don't use the optimizer boost, it's been known to play havoc with systems. OP, you didn't by any chance in the past use magician with the boost did you?

 

[johnbl]

no, you would never get a modified windows 10 nt kernel with proper build info for the wrong build during the update.
you would have to use a hacked install image or run a hack tool after the update was installed. the kernel is a core protected windows file. best to make a new image directly from Microsoft server, install it and be more cautious on what programs are being run (malware/hack/virus)

It's probably a leftover from the win7-win10 upgrade. Personally, I'd make sure the pc is registered at Microsoft account, dl a brand new copy of win10 and stick it on a USB bootable, that matches the key, scrap the current OS entirely and start over with a full clean win10 install, with no old OS junk included. That not only cleans up the C drive, but gets rid of any old drivers that might be conflicting, any possible virus or malware etc. Then it's just a matter of reinstalling mobo drivers, and software etc.

If all that fails to stop the issue, then I'd be taking a serious look at the SSD as possibly starting to fail, I'd use Samsung magician 4.3? to verify. Just don't use the optimizer boost, it's been known to play havoc with systems. OP, you didn't by any chance in the past use magician with the boost did you?

 

[Karadjgne]

https://forums.anandtech.com/threads/dont-use-asus-update-to-flash-your-bios.128328/

Step by step bios update. Follow exactly.

If op went through MS to get the update, then I agree, there shouldn't be any issues, I'm running an updated version and it's flawless, but that was at the time of the free MS update. If op got a version from other than MS, such as Kinguin or other Grey-market sites, there's no telling exactly what's what or if the update is fully secure and not hacked and slashed. There's several 'light' versions of win7/8/10 out there with much of the OS missing due to C drive size restrictions, intended as a clean install, but failed to remove the 'update' switch. Or it could be that somehow the OS is linking up with the OldOS files still stored on the drive, just in case of revert to old OS. I've seen crazier things happen.

A full, clean install (not update) of win10, dl from MS, should fix all that, removing any old OS files, any possible links etc. The only thing in the OS will be win10. Nothing else.

 

[shadowferix]

So I made a bad decision and decided to let my computer update itself to 1709 from 1703 through windows update. Within 10 minutes I got 3 blue screens saying kmode exception not handled and another mentioning NTFS.sys failed. It tried to restart and it just won't. As soon as it passes the Asus logo for bios it just freezes on attempting to repair.

I'm going to try downloading 1709 from tb.rg-adguard.net again (the link provided in a help article from earlier) and see if I have any stability at all. 1703 worked amazing. I played video games for 5-6 hours with no issues whatsoever. As soon as we're back on 1709 this happens though.

When I went back to 1703 yesterday I completely wiped my ssd and only installed 3 programs and drivers. Is it possible that something made it through the wipe? Or is it one of the programs or my mobo installing the older windows 7 crap? When I built this computer a year and a half ago I bought a windows 10 disk so I have a product key and all that. How can I go about downloading 1703 directly from them instead of the website I mentioned above? I also need to disable all updates so I don't have this issue again. (If the 1709 version I am trying now doesn't work)

This is on mobile so sorry if it is all scrunched together or rambling 🙁

 

[Sedivy]

Well...this now depends on what you're going to do. Are you attempting to repair the current installation or installing new?
If you're repairing from the windos disc, then after you start up, roll back the way you did before. If you're wiping and installing new, and judging by the johnbl's comments, you really should, then while you're updating, just don't go past 1703. You can select individual updates.
The refresh option you speak of is not a real reinstall. It resets the settings and uninstalls programs but it's not a true rebuild of the windows I think (others can correct me if this isn't the case). Backup your data and just reinstall. That way you might be able to even possibly install 1709 without issues.

 

[johnbl]

you can not do a update and expect it to work when you have modified kernel files.
you have to do a clean install from a new boot image obtained directly from Microsoft.
google "windows 10 install image" to get to the Microsoft tool to make the image, then use the key that you have or install without a key in the hope that your old image was not a pirate version.

 

[shadowferix]

I did a clean install from a 1709 image of windows but this time I did not install any driver updates for my mobo from the respective site. I haven't had any issues at all in the past 6~ hours. I will try installing the mobo drivers and see if I begin having issues then. If I do that pretty much means one of them is the issue right?

 

[doolittle]

I did a clean install from a 1709 image of windows but this time I did not install any driver updates for my mobo from the respective site. I haven't had any issues at all in the past 6~ hours. I will try installing the mobo drivers and see if I begin having issues then. If I do that pretty much means one of them is the issue right?

yes exactly, so what I would do is check your device manager for any missing drivers (yellow "!" warnings) and just install those, install the latest gpu driver, you are good to go.

 

[Colif]

Windows 10 is likely to update drivers that match your motherboard anyway, its helpful like that. So even if you don't install any drivers, it will

last time I installed my Asus motherbaord, windows update grabbed a package called AMD which doesn't, for a change, match the obvious source. It actually stands for Asus Motherboard drivers and they have a pack for every motherboard. Sure, they not going to be the latest drivers but they will work.

I try not to use driver verifer, it leaves people in boot loops too often for my liking. It would be my last choice.

Fresh install often best way to fix problems associated with old win 7 drivers.

 

[shadowferix]

Well that didn't last long. I didn't update anything like you guys said. I went to install Blizzard's battle net client and then I went to install Overwatch. Got a bluescreen about 30% into the download. I wish this would just end already this is depressing 🙁

Minidump here:
https://www.dropbox.com/s/ni5uj8hhflxy37s/022518-3828-01.dmp?dl=0

 

[Sedivy]

Bug Check 0x3B: SYSTEM_SERVICE_EXCEPTION -This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
Cause

This error has been linked to excessive paged pool usage and may occur due to user-mode graphics drivers crossing over and passing bad data to the kernel code.

Please update the ATI drivers.

https://answers.microsoft.com/en-us/windows/forum/all/blue-screen-error-0x3b-systemserviceexception/7eeea12d-a97a-477b-b4c3-1fda74a7315e

Doesn't seem to like your current video drivers. Try to go to last stable version instead of just the latest one.

 

[shadowferix]

Bug Check 0x3B: SYSTEM_SERVICE_EXCEPTION -This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
Cause

This error has been linked to excessive paged pool usage and may occur due to user-mode graphics drivers crossing over and passing bad data to the kernel code.

Please update the ATI drivers.

https://answers.microsoft.com/en-us/windows/forum/all/blue-screen-error-0x3b-systemserviceexception/7eeea12d-a97a-477b-b4c3-1fda74a7315e

Doesn't seem to like your current video drivers. Try to go to last stable version instead of just the latest one.

How can I determine what version is stable? I've been having this issue off and on for the past 3-4 months? Do I want to go back to like October/November for my graphics drivers? I'm guessing it's just going to be trial and error until it seems stable again?

 

[johnbl]

change the memory dump type from a mini memory dump to a kernel memory dump then see if you can get another bugcheck and provide the new c:\windows\memory.dmp file. it will contain the proper debug info to figure out the problem.

Note: the build looks much better, the bugcheck was caused when a program called agent.exe ran, called a file filter and ended up causing memory corruption that was detected by windows and windows shut down the system.

you should find out what agent.exe is and maybe look to see what file fliters are installed on the system.
(maybe a virus scanner? but I did not see the proper drivers and minidumps strip out the info on file fliter drivers)

 

[Sedivy]

I...think but I'm not 100% certain as I don't play anymore, but I think agent.exe was related to blizzard wow updater. Or maybe blizzard updater in general? I seem to remember panicking over it at the time cause I didn't know what it was, and it would run in the background even when I wasn't playing. I could be wrong on this, it's been a while.

 

[johnbl]

could be, agent.exe is a generic name. just not sure why a file a file filter would be involved.
might want to start cmd.exe or powershell as an admin and run
fltmc.exe instances

to list the file filters that are installed, just to see if something strange is installed.

I...think but I'm not 100% certain as I don't play anymore, but I think agent.exe was related to blizzard wow updater. Or maybe blizzard updater in general? I seem to remember panicking over it at the time cause I didn't know what it was, and it would run in the background even when I wasn't playing. I could be wrong on this, it's been a while.

 

[Sedivy]

Uh well from what I remember the process was running in the background to basically pre-download patches via bittorrent, to speed up patch days so their servers aren't overloaded with direct download requests once the updates went live on the servers. This was wow though and their patches could be many gigabytes in size. Not sure it applies to overwatch or whatever he's playing.

 

[shadowferix]

Agent.exe is related to the blizzard client used for updating their games. I'm not too sure what else it does beyond that. I read some forum threads after googling it and it had mixed opinions.

I did not rollback my graphics card drivers yet. Two dumps are here. I'm pretty sure the second one is the kernel dump because it is a lot bigger. If it isn't let me know and I'll try to find the correct one.

Dumps:
Mini: https://www.dropbox.com/s/jeb34pcisud8z4v/022518-3625-01.dmp?dl=0
Kerenel? (Was close to 1gb): https://www.dropbox.com/s/h06u148tekn7nxc/MEMORY.DMP?dl=0

 

[johnbl]

looking at one of the memory dumps
NVDisplay.Container.exe did a call to try to find out how many displays your machine has,
this lead to some calls to allocate memory which lead to a memory access violation which caused the bugcheck.

so, I would be looking at any thing related to the NVidia program that was running, or something special about your monitor or how it is connected to the system. or problems with your graphic driver files.

for example, do you have multi monitors installed? tv connected ? maybe gsync monitor or freesync ? maybe a very fast refresh rate 144Hz?

notes:
here are the installed drivers for the GPU
\SystemRoot\system32\drivers\nvhda64v.sys Fri Dec 15 00:17:43 2017
\SystemRoot\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_7a39871618b19f06\nvlddmkm.sys Tue Jan 23 14:24:56 2018

these look like the Microsoft update drivers. I am not sure Microsoft installed the
NVDisplay.Container.exe so it could just be hitting a bug.

I would reboot and install the current NVidia drivers from NVidia and see if you get another bugcheck.
(if you have not already done so, I may have looked at the bugchecks in the wrong order)

 

[shadowferix]

looking at one of the memory dumps
NVDisplay.Container.exe did a call to try to find out how many displays your machine has,
this lead to some calls to allocate memory which lead to a memory access violation which caused the bugcheck.

so, I would be looking at any thing related to the NVidia program that was running, or something special about your monitor or how it is connected to the system. or problems with your graphic driver files.

for example, do you have multi monitors installed? tv connected ? maybe gsync monitor or freesync ? maybe a very fast refresh rate 144Hz?

notes:
here are the installed drivers for the GPU
\SystemRoot\system32\drivers\nvhda64v.sys Fri Dec 15 00:17:43 2017
\SystemRoot\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_7a39871618b19f06\nvlddmkm.sys Tue Jan 23 14:24:56 2018

these look like the Microsoft update drivers. I am not sure Microsoft installed the
NVDisplay.Container.exe so it could just be hitting a bug.

I would reboot and install the current NVidia drivers from NVidia and see if you get another bugcheck.
(if you have not already done so, I may have looked at the bugchecks in the wrong order)

This is the monitor I have: https://www.amazon.com/Acer-GN246HL-Bbid-24-Inch-Display/dp/B00KO4518I

I'm running it at 144 hz. No second monitor/tv hooked up. Not sure on the gsync/freesync. I'm also on the current version of nvidia drivers downloaded directly from their website. Do you want another one of the kernel dumps I sent you? It took like 10-15 minutes for me to upload to dropbox so between trying to get a crash and uploading it it can take a while.

Edit: Overwatch crashed me to my desktop but I haven't got a bluescreen yet. That game is pretty much still unplayable. There's a dump file for that. If you're interested in that let me know I don't know if it will contain anything useful though. You know better than I do. Is there anyway to force another bluescreen or do I just need to be patient and do what I normally do?

 

[johnbl]

I would go to the setup inside the monitor and see if I could set it up for a lower frequency until I updated the GPU drivers. I would expect the problem is going to be related to the high refresh rate of the monitor.
I have not used one but I think I have seen various bugs related to this. the lower frequency could be a work around until you get the GPU driver updates installed.

looking at one of the memory dumps
NVDisplay.Container.exe did a call to try to find out how many displays your machine has,
this lead to some calls to allocate memory which lead to a memory access violation which caused the bugcheck.

so, I would be looking at any thing related to the NVidia program that was running, or something special about your monitor or how it is connected to the system. or problems with your graphic driver files.

for example, do you have multi monitors installed? tv connected ? maybe gsync monitor or freesync ? maybe a very fast refresh rate 144Hz?

notes:
here are the installed drivers for the GPU
\SystemRoot\system32\drivers\nvhda64v.sys Fri Dec 15 00:17:43 2017
\SystemRoot\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_7a39871618b19f06\nvlddmkm.sys Tue Jan 23 14:24:56 2018

these look like the Microsoft update drivers. I am not sure Microsoft installed the
NVDisplay.Container.exe so it could just be hitting a bug.

I would reboot and install the current NVidia drivers from NVidia and see if you get another bugcheck.
(if you have not already done so, I may have looked at the bugchecks in the wrong order)

This is the monitor I have: https://www.amazon.com/Acer-GN246HL-Bbid-24-Inch-Display/dp/B00KO4518I

I'm running it at 144 hz. No second monitor/tv hooked up. Not sure on the gsync/freesync. I'm also on the current version of nvidia drivers downloaded directly from their website. Do you want another one of the kernel dumps I sent you? It took like 10-15 minutes for me to upload to dropbox so between trying to get a crash and uploading it it can take a while.

Edit: Overwatch crashed me to my desktop but I haven't got a bluescreen yet. That game is pretty much still unplayable. There's a dump file for that. If you're interested in that let me know I don't know if it will contain anything useful though. You know better than I do. Is there anyway to force another bluescreen or do I just need to be patient and do what I normally do?

 

[shadowferix]

I would go to the setup inside the monitor and see if I could set it up for a lower frequency until I updated the GPU drivers. I would expect the problem is going to be related to the high refresh rate of the monitor.
I have not used one but I think I have seen various bugs related to this. the lower frequency could be a work around until you get the GPU driver updates installed.

looking at one of the memory dumps
NVDisplay.Container.exe did a call to try to find out how many displays your machine has,
this lead to some calls to allocate memory which lead to a memory access violation which caused the bugcheck.

so, I would be looking at any thing related to the NVidia program that was running, or something special about your monitor or how it is connected to the system. or problems with your graphic driver files.

for example, do you have multi monitors installed? tv connected ? maybe gsync monitor or freesync ? maybe a very fast refresh rate 144Hz?

notes:
here are the installed drivers for the GPU
\SystemRoot\system32\drivers\nvhda64v.sys Fri Dec 15 00:17:43 2017
\SystemRoot\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_7a39871618b19f06\nvlddmkm.sys Tue Jan 23 14:24:56 2018

these look like the Microsoft update drivers. I am not sure Microsoft installed the
NVDisplay.Container.exe so it could just be hitting a bug.

I would reboot and install the current NVidia drivers from NVidia and see if you get another bugcheck.
(if you have not already done so, I may have looked at the bugchecks in the wrong order)

This is the monitor I have: https://www.amazon.com/Acer-GN246HL-Bbid-24-Inch-Display/dp/B00KO4518I

I'm running it at 144 hz. No second monitor/tv hooked up. Not sure on the gsync/freesync. I'm also on the current version of nvidia drivers downloaded directly from their website. Do you want another one of the kernel dumps I sent you? It took like 10-15 minutes for me to upload to dropbox so between trying to get a crash and uploading it it can take a while.

Edit: Overwatch crashed me to my desktop but I haven't got a bluescreen yet. That game is pretty much still unplayable. There's a dump file for that. If you're interested in that let me know I don't know if it will contain anything useful though. You know better than I do. Is there anyway to force another bluescreen or do I just need to be patient and do what I normally do?

I lowered it to 60 hz. I'm almost certain my gpu is up to date though. It's showing the latest version installed under properties in device manager and in the geforce experience app.

 

[johnbl]

maybe make sure you have the proper cables.
hdmi 1.3, or DVI-D connector.

I would go to the setup inside the monitor and see if I could set it up for a lower frequency until I updated the GPU drivers. I would expect the problem is going to be related to the high refresh rate of the monitor.
I have not used one but I think I have seen various bugs related to this. the lower frequency could be a work around until you get the GPU driver updates installed.

looking at one of the memory dumps
NVDisplay.Container.exe did a call to try to find out how many displays your machine has,
this lead to some calls to allocate memory which lead to a memory access violation which caused the bugcheck.

so, I would be looking at any thing related to the NVidia program that was running, or something special about your monitor or how it is connected to the system. or problems with your graphic driver files.

for example, do you have multi monitors installed? tv connected ? maybe gsync monitor or freesync ? maybe a very fast refresh rate 144Hz?

notes:
here are the installed drivers for the GPU
\SystemRoot\system32\drivers\nvhda64v.sys Fri Dec 15 00:17:43 2017
\SystemRoot\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_7a39871618b19f06\nvlddmkm.sys Tue Jan 23 14:24:56 2018

these look like the Microsoft update drivers. I am not sure Microsoft installed the
NVDisplay.Container.exe so it could just be hitting a bug.

I would reboot and install the current NVidia drivers from NVidia and see if you get another bugcheck.
(if you have not already done so, I may have looked at the bugchecks in the wrong order)

This is the monitor I have: https://www.amazon.com/Acer-GN246HL-Bbid-24-Inch-Display/dp/B00KO4518I

I'm running it at 144 hz. No second monitor/tv hooked up. Not sure on the gsync/freesync. I'm also on the current version of nvidia drivers downloaded directly from their website. Do you want another one of the kernel dumps I sent you? It took like 10-15 minutes for me to upload to dropbox so between trying to get a crash and uploading it it can take a while.

Edit: Overwatch crashed me to my desktop but I haven't got a bluescreen yet. That game is pretty much still unplayable. There's a dump file for that. If you're interested in that let me know I don't know if it will contain anything useful though. You know better than I do. Is there anyway to force another bluescreen or do I just need to be patient and do what I normally do?

I lowered it to 60 hz. I'm almost certain my gpu is up to date though. It's showing the latest version installed under properties in device manager and in the geforce experience app.