Question Constant Bsod only in normal mode please help.

[Lpee10]

So ever since the 20th of October i've been getting bsod's constantly only in normal mode never in safe mode.
Things i've tried
sfc scannow
memtest 86
reinstalling windows
reverting gpu drivers and updating them
re seating ram
however obviously like most things pc related it doesnt work or has not helped.
I have a screen dump off the bsod's im getting so if someone can point out what is causing that would be amazing thank you
https://www.mediafire.com/file/67ibf0x30hbf0p4/WhoCrashedOutput.htm/file


just incase link doesn't work

Spoiler: WhoCrashed log file

Crash Dump Analysis

Crash dumps are enabled on your computer.

Crash dump directories:
C:\Windows
C:\Windows\Minidump

On Wed 08/12/2021 12:39:08 your computer crashed or a problem was reported
crash dump file: C:\Windows\Minidump\120821-20875-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x3F71B0)
Bugcheck code: 0x1000007E (0xFFFFFFFFC0000005, 0xFFFFF8041E363C1B, 0xFFFF8B081EBB8728, 0xFFFF8B081EBB7F60)
Error: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a system thread generated an exception which the error handler did not catch.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Wed 08/12/2021 12:39:08 your computer crashed or a problem was reported
crash dump file: C:\Windows\MEMORY.DMP
This was probably caused by the following module: wof.sys (Wof+0x21474)
Bugcheck code: 0x7E (0xFFFFFFFFC0000005, 0xFFFFF8041E363C1B, 0xFFFF8B081EBB8728, 0xFFFF8B081EBB7F60)
Error: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED
file path: C:\Windows\system32\drivers\wof.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Windows Overlay Filter
Bug check description: This bug check indicates that a system thread generated an exception that the error handler did not catch.
The crash took place in a Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.



On Wed 08/12/2021 12:08:50 your computer crashed or a problem was reported
crash dump file: C:\Windows\Minidump\120821-27750-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x3F71B0)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF80547E745C6, 0xFFFFC701C15F8920, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Wed 08/12/2021 11:00:30 your computer crashed or a problem was reported
crash dump file: C:\Windows\Minidump\120821-22093-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x3F71B0)
Bugcheck code: 0xA (0x170, 0xD, 0x0, 0xFFFFF8031AE166CB)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above. This is a software bug.
This bug check belongs to the crash dump test that you have performed with WhoCrashed or other software. It means that a crash dump file was properly written out.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Tue 07/12/2021 22:11:02 your computer crashed or a problem was reported
crash dump file: C:\Windows\Minidump\120721-31921-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x3F71B0)
Bugcheck code: 0x139 (0x3, 0xFFFFF80050C91700, 0xFFFFF80050C91658, 0x0)
Error: KERNEL_SECURITY_CHECK_FAILURE
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: The kernel has detected the corruption of a critical data structure.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Tue 07/12/2021 21:08:04 your computer crashed or a problem was reported
crash dump file: C:\Windows\Minidump\120721-24437-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x3F71B0)
Bugcheck code: 0x18 (0x0, 0xFFFFA086B25CA460, 0x2, 0xFFFFFFFFFFFFFFFF)
Error: REFERENCE_BY_POINTER
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that the reference count of an object is illegal for the current state of the object.
This bug check belongs to the crash dump test that you have performed with WhoCrashed or other software. It means that a crash dump file was properly written out.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.





Conclusion


6 crash dumps have been found and analyzed. No offending third party drivers have been found. Connsider using WhoCrashed Professional which offers more detailed analysis using symbol resolution. Also configuring your system to produce a full memory dump may help you.


Read the topic general suggestions for troubleshooting system crashes for more information.

Note that it's not always possible to state with certainty whether a reported driver is responsible for crashing your system or that the root cause is in another module. Nonetheless it's suggested you look for updates for the products that these drivers belong to and regularly visit Windows update or enable automatic updates for Windows. In case a piece of malfunctioning hardware is causing trouble, a search with Google on the bug check errors together with the model name and brand of your computer may help you investigate this further.

 

[Colif]

wof.sys - Windows overlay Filesystem filter. The Windows Overlay Fileystem allows to present data as a file tree. Not really giving me any clues as to what cause might be.
who crashed blaming ntoskrnl as usual. Its victim, not cause.

I get a friend to convert dumps, we see what drivers running at time.

what are specs of the PC?

 

[Lpee10]

3060ti
ASUS tuf gaming plus ii
16GB DDR4 300MHZ ram
two 1tb hdd
1 120gb ssd with windows
700w seasonic psu
ryzen 3600

 

[Drew125]

When I get home I will check the dumps. I will post what I find.

 

[Lpee10]

ok thank you, more crashes since today
it's getting beyond a joke
Welcome to WhoCrashed (Home Edition) v 6.70

Spoiler: WhoCrashed log file

This program checks for drivers which have been crashing your computer. If your computer has displayed a blue (or black) screen of death, suddenly rebooted or shut down then this program might help you find the root cause of the problem and a solution.

Whenever a computer suddenly reboots without displaying any notice or blue (or black) screen of death, the first thing that is often thought about is a hardware failure. In reality, on Windows a lot of system crashes are caused by malfunctioning device drivers and kernel modules. In case of a kernel error, many computers do not show a blue or black screen unless they are configured for this. Instead these systems suddenly reboot without any notice.

This program will analyze your crash dumps with the single click of a button. It will tell you what drivers are likely to be responsible for crashing your computer. It will report a conclusion which offers suggestions on how to proceed in any situation while the analysis report will display internet links which will help you further troubleshoot any detected problems.

To obtain technical support visit www.resplendence.com/support

Click here to check if you have the latest version or if an update is available.

Just click the Analyze button for a comprehensible report ...



Home Edition Notice


This version of WhoCrashed is free for use at home only. If you would like to use this software at work or in a commercial environment you should get the professional edition of WhoCrashed which allows you to perform more thorough and detailed analysis. It also offers a range of additional features such as remote analysis on remote directories and remote computers on the network.

Please note that this version of WhoCrashed is not licensed for use by professional support engineers.

Click here for more information on the professional edition.
Click here to buy the the professional edition of WhoCrashed.


System Information (local)


Computer name: DESKTOP-IHRQL57
Windows version: Windows 10, 10.0, version 2009, build: 19044
Windows dir: C:\Windows
Hardware: ASUSTeK COMPUTER INC., TUF B450-PLUS GAMING
CPU: AuthenticAMD AMD Ryzen 5 3600 6-Core Processor 8664, level: 23
12 logical processors, active mask: 4095
RAM: 17085939712 bytes (15.9GB)




Crash Dump Analysis


Crash dumps are enabled on your computer.

Crash dump directories:
C:\Windows
C:\Windows\Minidump

On Wed 08/12/2021 22:03:58 your computer crashed or a problem was reported
crash dump file: C:\Windows\Minidump\120821-26312-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x3F72A0)
Bugcheck code: 0x50 (0xFFFFC50100006039, 0x0, 0xFFFFF80640363C1B, 0x2)
Error: PAGE_FAULT_IN_NONPAGED_AREA
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that invalid system memory has been referenced.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Wed 08/12/2021 22:03:58 your computer crashed or a problem was reported
crash dump file: C:\Windows\MEMORY.DMP
This was probably caused by the following module: wof.sys (Wof+0x21474)
Bugcheck code: 0x50 (0xFFFFC50100006039, 0x0, 0xFFFFF80640363C1B, 0x2)
Error: PAGE_FAULT_IN_NONPAGED_AREA
file path: C:\Windows\system32\drivers\wof.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Windows Overlay Filter
Bug check description: This indicates that invalid system memory has been referenced.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in a Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.



On Wed 08/12/2021 21:56:54 your computer crashed or a problem was reported
crash dump file: C:\Windows\Minidump\120821-19125-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x3F71B0)
Bugcheck code: 0x50 (0xFFFF80060000001C, 0x0, 0xFFFFF80238D63C1B, 0x2)
Error: PAGE_FAULT_IN_NONPAGED_AREA
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that invalid system memory has been referenced.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Wed 08/12/2021 21:28:53 your computer crashed or a problem was reported
crash dump file: C:\Windows\Minidump\120821-18171-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x3F71B0)
Bugcheck code: 0xA (0xBE, 0xFF, 0x9E, 0xFFFFF80442C16DFA)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above. This is a software bug.
This bug check belongs to the crash dump test that you have performed with WhoCrashed or other software. It means that a crash dump file was properly written out.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Wed 08/12/2021 20:58:54 your computer crashed or a problem was reported
crash dump file: C:\Windows\Minidump\120821-10140-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x3F71B0)
Bugcheck code: 0xA (0xDFFBD20, 0xFF, 0x97, 0xFFFFF8024261E380)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above. This is a software bug.
This bug check belongs to the crash dump test that you have performed with WhoCrashed or other software. It means that a crash dump file was properly written out.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Wed 08/12/2021 20:56:47 your computer crashed or a problem was reported
crash dump file: C:\Windows\Minidump\120821-15609-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x3F71B0)
Bugcheck code: 0xA (0x6DCDB3A388, 0xFF, 0x0, 0xFFFFF803723FADB6)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above. This is a software bug.
This bug check belongs to the crash dump test that you have performed with WhoCrashed or other software. It means that a crash dump file was properly written out.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.





Conclusion


6 crash dumps have been found and analyzed. No offending third party drivers have been found. Connsider using WhoCrashed Professional which offers more detailed analysis using symbol resolution. Also configuring your system to produce a full memory dump may help you.


Read the topic general suggestions for troubleshooting system crashes for more information.

Note that it's not always possible to state with certainty whether a reported driver is responsible for crashing your system or that the root cause is in another module. Nonetheless it's suggested you look for updates for the products that these drivers belong to and regularly visit Windows update or enable automatic updates for Windows. In case a piece of malfunctioning hardware is causing trouble, a search with Google on the bug check errors together with the model name and brand of your computer may help you investigate this further.

 

[gardenman]

Hi, I've edited your post to hide the big log file in a "spoiler". Please use spoilers when posting longer log files, thanks.

Also, upload the actual minidump files. You'll find them in the C:\Windows\minidump folder. You'll very likely need to copy them to another folder before uploading them, or else you might get permission errors.

When I get home I will check the dumps. I will post what I find.

The more help, the better.

 

[Lpee10]

When I get home I will check the dumps. I will post what I find.

any luck?

 

[Lpee10]

https://easyupload.io/m/bccqo7 i have more dumps since yesterday

 

[gardenman]

I ran the dump files through the debugger and got the following information: https://jsfiddle.net/8wcL2ps0/show This link is for anyone wanting to help. You do not have to view it. It is safe to "run the fiddle" as the page asks.

Spoiler: Dump File Results

File information:	120921-19875-01.dmp (Dec 9 2021 - 10:50:44)
Bugcheck:	PAGE_FAULT_IN_NONPAGED_AREA (50)
Probably caused by:	memory_corruption (Process: System)
Uptime:	0 Day(s), 0 Hour(s), 21 Min(s), and 31 Sec(s)

File information:	120821-26312-01.dmp (Dec 8 2021 - 17:03:58)
Bugcheck:	PAGE_FAULT_IN_NONPAGED_AREA (50)
Probably caused by:	memory_corruption (Process: System)
Uptime:	0 Day(s), 0 Hour(s), 03 Min(s), and 11 Sec(s)

File information:	120821-19125-01.dmp (Dec 8 2021 - 16:56:54)
Bugcheck:	PAGE_FAULT_IN_NONPAGED_AREA (50)
Probably caused by:	memory_corruption (Process: System)
Uptime:	0 Day(s), 0 Hour(s), 27 Min(s), and 25 Sec(s)

File information:	120821-18171-01.dmp (Dec 8 2021 - 16:28:53)
Bugcheck:	IRQL_NOT_LESS_OR_EQUAL (A)
Probably caused by:	memory_corruption (Process: System)
Uptime:	0 Day(s), 0 Hour(s), 04 Min(s), and 44 Sec(s)

File information:	120821-10140-01.dmp (Dec 8 2021 - 15:58:54)
Bugcheck:	IRQL_NOT_LESS_OR_EQUAL (A)
Probably caused by:	memory_corruption (Process: System)
Uptime:	0 Day(s), 0 Hour(s), 01 Min(s), and 36 Sec(s)

The overclocking drivers "NTIOLib_X64.sys" (MSI Afterburner or other MSI software) and "RTCore64.sys" (MSI Afterburner) were found on your system. Overclocks (and OC drivers) can cause BSODs.

There is a BIOS update available for your TUF B450-PLUS GAMING motherboard. You are using version 3002 and the latest is version 3211. Wait for additional information before deciding to update or not. Important: Verify that I have linked to the correct motherboard. Updating your BIOS can be risky. Never try it when you might lose power (lightning storms, recent power outages, etc).

This info can be used by others to help you. Someone else will post with more information. Please wait for additional answers. Good luck.

 

[Drew125]

Sorry for the delay yesterday was a long day.

Spoiler

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffffbb0100000006, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80221b63c1b, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

DUMP_CLASS: 1

DUMP_QUALIFIER: 400

BUILD_VERSION_STRING: 10.0.19041.1348 (WinBuild.160101.0800)

SYSTEM_MANUFACTURER: System manufacturer

SYSTEM_PRODUCT_NAME: System Product Name

SYSTEM_SKU: SKU

SYSTEM_VERSION: System Version

BIOS_VENDOR: American Megatrends Inc.

BIOS_VERSION: 3002

BIOS_DATE: 03/11/2021

BASEBOARD_MANUFACTURER: ASUSTeK COMPUTER INC.

BASEBOARD_PRODUCT: TUF B450-PLUS GAMING

BASEBOARD_VERSION: Rev X.0x

DUMP_TYPE: 2

BUGCHECK_P1: ffffbb0100000006

BUGCHECK_P2: 0

BUGCHECK_P3: fffff80221b63c1b

BUGCHECK_P4: 2

READ_ADDRESS: fffff802224fb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
ffffbb0100000006

FAULTING_IP:
nt!RtlCompressBufferXpressHuffStandard+18b
fffff802`21b63c1b 413809 cmp byte ptr [r9],cl

MM_INTERNAL_CODE: 2

CPU_COUNT: c

CPU_MHZ: e10

CPU_VENDOR: AuthenticAMD

CPU_FAMILY: 17

CPU_MODEL: 71

CPU_STEPPING: 0

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: CODE_CORRUPTION



IMAGE_NAME: memory_corruption

FOLLOWUP_NAME: memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MEMORY_CORRUPTOR: LARGE

FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE

BUCKET_ID: MEMORY_CORRUPTION_LARGE

PRIMARY_PROBLEM_CLASS: MEMORY_CORRUPTION_LARGE

After checking your dump files they point to a large memory or code corruption. I would recommand you to run MemTest and check your ram and run a SFC scan. Let me know the results.