Question Intermittent "ntoskrnl.exe" BSOD ?

Page 2 - Seeking answers? Join the Tom's Hardware community: where nearly two million members share solutions and discuss the latest tech.
Toggle sidebar Toggle sidebar
I

ilfrit

Feb 6, 2025
30
1
35
Morning folks,

I was going to put up a thread 2 weeks ago when this started happening again. However it was ok for 2 weeks following a BIOS update. Now again this morning I've had 3 back to back BSODs, starting with the dreaded ntoskrnl.exe one.

History, purchased this from Scan Computers about 3 years ago. Within the first month had problems and they replaced the motherboard. This fixed the issues. About 12 months ago started having blue screen errors and running MemTest found some errors so Scan replaced the Ram under warranty. Started having issues again 3 months ago, updated the Bios and reset the RAM to default clock speeds. 2 weeks ago, the issue is back, latest BIOS update has not resolved it. Recent Memtest passed succesfully.

Hoping there is some hero that can help me out. Dump files at the bottom.

Edition Windows 11 Pro
Version 24H2
Installed on 02/‎10/‎2024
OS build 26100.3194
Experience Windows Feature Experience Pack 1000.26100.48.0

CPU: Intel i9-12900K 3.2Ghz (OC to 4.7Ghz)
CPU cooler: AOI 3xs Systems
Motherboard: asus rog strix z690-f gaming wifi (BIOS Update 4101 03/12/2024)
Ram: Corsair dominator DDR5 2x16GB 5600 C36
SSD/HDD: 1 x 2tb Samsung 970 Evo Plus M2, 1x 2tb Samsung 980 Pro M2
GPU: EVGA 3080ti
PSU: Corsair RM850xw 3 years old
Chassis: Corsair 600d
OS: Windows 11
Monitor: Asus ROG PG279Q

https://www.dropbox.com/scl/fo/pfq4...ey=8ad95kni3wujrtbfr15vyz214&st=6zbcnxg6&dl=0
 
Last edited:
Sort by date Sort by votes
@ilfrit

Take a look at the installed drivers using Windows Powershell and the Get-WindowsDriver cmdlet.

FYI:

https://windowsloop.com/get-installed-drivers-list/

The cmdlet may take a few seconds to run but will serve as a means to see the installed drivers as Windows "sees them".

Compare the results to what you expect to see.

Any drivers that do not match your expectations/installs are potential culprits.
 
Upvote 0 Downvote
@johnbl - Interesting, it isn't on the driver list. There are a number of drivers with file not found warnings, assume its ok to remove those?

@Ralston18 - I have a very large list now saved to notepad, but not sure what I'm looking for to be honest.
 
Last edited:
Upvote 0 Downvote
see if Blitz.exe is malware.

bugcheck shows it running, control passed to a bogus memory location then to the video scheduler.

I would guess it is malware

can not really trace the problem with a minidump, would need a kernel dump. You have several suspect drivers installed.

memory location was 0xfffffff this could be a bad spot in RAM
or a error code (-1) but it should not have been executed.
when I google for blitz.exe I see this: (cryptocurrency mining malware)

Blitz malware is a dangerous threat that can steal information, run hidden code, and plant other malware intended to mine cryptocurrency. It stays hidden by injecting itself into normal system processes. Removing Blitz promptly is crucial to protect user privacy, system performance, and security.
 
Last edited:
Upvote 0 Downvote
ilfrit said:
@johnbl - Interesting, it isn't on the driver list. There are a number of drivers with file not found warnings, assume its ok to remove those?

@Ralston18 - I have a very large list now saved to notepad, but not sure what I'm looking for to be honest.
Click to expand...
generally you should not remove the entries with file not found without looking them up. many of them are part the wow subsystem I think the system uses a junction point to remap the locations and reduce the number of duplicate files. it is safe to ignore in autoruns.
www.winhelponline.com

Autoruns: KnownDlls wow64cpu, wowarmhw, xtajit, wow64, wow64win Missing

The Sysinternals Autoruns utility may highlight some entries in yellow, indicating to the user that some files (referenced in the registry key) are missing from the system. The file names are below…
www.winhelponline.com www.winhelponline.com
 
Upvote 0 Downvote
to change the memory dump type to kernel look at something like this:
https://mcci.com/support/guides/enable-kernel-memory-dumps/#:~:text=Windows 10 1 Press the Windows key. 2,to close “System Properties”. 8 Reboot your system.

what monitor resolution do you have? and the refresh rate?
you might consider installing a stable gpu driver rather than a gaming gpu driver or lowering the refresh rate of the monitor.
(assuming you are running at 4k)
(to account for excess power to the pci that does not trigger a reset to the motherboard)
 
Last edited:
Upvote 0 Downvote
As for "what you are looking for" is that you are looking for differences between "working" or "not-working".

More specifically any sofware that is (or maybe is not) running when the intermittent BSOD's occur.

Agree: google and research installed apps, utilities, drivers, etc. along with any associated configuration settings. As has been post by @johnbl - look them up.

Especially those processes that appear to be running in the logs or conversely do not appear to have stopped running. Or you do not recognize the process.

Objective being to discover some relevant condition: "If X then BSODs."

= = = =

As for intermittent that also suggests something loose.

Power down, unplug, open the case.

Clean out dust and debris.

Verify by sight and feel that all connectors, cards, RAM, jumpers, and case connections are fully and firmly in place.

Use a bright flashlight to inspect everywhere for signs of damage: bare conductor showing, melted insulation, pinched or kinked wires, corrosion, cracks, loose or missing screws, browned or blackened areas, moisture, swollen components, etc..

Check the motherboard's User Guide/Manual to double check all installed components and configuration settings.

For example: some motherboards require that the first installed RAM be placed in a specific slot. Failing to do so can result in problems. Details matter.
 
Upvote 0 Downvote
I didn't mean to offend. You asked me to run a command and spot if anything was out of place. Its 260k characters long and doesn't specify if something is working or not-working which is why I asked for a hint as what to look for.

I have looked into the reports and the apps causing the issue. There is no pattern, to me it seems like its just a random app running on the machine that crashes and all errors lead to "Could be drivers, could be hardware". I appreciate we are trying to diagnose any driver issues and I've setup the kernel level logging which can hopefully help.

I have reseated everything on the mobo, there doesn't seem to be any sign of damage. The RAM is correctly slotted into the 2nd and 4th slots.
 
Upvote 0 Downvote
Notwithstanding the excellent help your getting from @johnbl, I'm still not convinced that this isn't hardware. If you can I'd like you to try starting Windows in Safe Mode. In Safe Mode a stripped-down Windows system is loaded, with only critical services and drivers loaded. Typically no third-party drivers are loaded. This does mean that you won't be able to do any useful work in Safe Mode, or play games, and many of your devices may not work properly (or at all) because their drivers have not been loaded. Your display will be low resolution for example, because you'll be using only the Windows basic display driver.

The usefulness of Safe Mode is that because it's a stripped-down system consisting only of Microsoft services and drivers it's very stable, so if you get BSODs or crashes in Safe Mode you have a hardware problem. On the other hand, if it's stable in Safe Mode then your problem is with a third-party driver or service that wasn't loaded in Safe Mode. There is another technique we can use in that case to locate the problem service or driver.
 
Upvote 0 Downvote
Thanks for replying. The problem is it doesn't blue screen all the time. For example the last blue screen was on Sunday and I worked/played all day yesterday with no issues. So if I were to boot in Safe Mode and just browse the internet or something it seems unlikely that anything will happen.
 
Upvote 0 Downvote
johnbl said:
you have a driver called
Image name: driver-x64.sys
Timestamp: Mon Jul 20 04:45:05 2020
this looks like it is eva low level graphics driver for your eva 3080ti
you might see if you can get a driver update here:

EVGA - Download Center

EVGA North America's #1 NVIDIA partner.
www.evga.com www.evga.com
Click to expand...
the hope is that this driver gets updated:
driver-x64.sys (or removed)

I would also google how to make windows delete the pagefile.sys on each reboot. then make the registry changes and reboot.

you might consider turning off streaming, or reduce the monitor refresh rate and see how that effects the problem.
 
Upvote 0 Downvote
Thanks for another reply. I no longer have the driver-x64.sys on my system having run various search commands. Still haven't had a BSOD since enabling the kernel memory dump. If I receive another then I will reduce the monitor refresh rate as requested.
 
Upvote 0 Downvote
ilfrit said:
2 BSODs (PAGE_FAULT_IN_NONPAGED_AREA) recently but are failing to get past 0% on uploading the report which is a shame. I guess this is to do with enabling Kernel Level Dumps.

I did get another BSOD (DRIVER_IRQL_NOT_LESS_OR_EQUAL) ACPI.sys on loading into windows which captured and then I had to clear the CMOS again to get the mobo to POST.

https://www.dropbox.com/scl/fi/vuq6...ey=zrt6zb9l2giyv9jllqvfovsyx&st=vat8mqzq&dl=0
Click to expand...
looks like LeagueClientUx was running,
a window was being destroyed and the program called
this function:
win32kbase!LogicalCursorPosFromDpiAwarenessContext
and caused a bugcheck.

https://learn.microsoft.com/en-us/w...tting-the-default-dpi-awareness-for-a-process

looks like it is a call for setting a mouse cursor position maybe on a multi monitor system or high res monitor.
Maybe a special mouse? Maybe change DPI on mouse monitor setting? not sure

her is the stack (read from the bottom up)
00 nt!KeBugCheckEx
01 nt!KiBugCheckDispatch
02 nt!KiPageFault
03 nt!VslpEnterIumSecureMode
04 nt!HvlPrepareForRootCrashdump
05 nt!KeBugCheck2
06 nt!KeBugCheckEx
07 nt!MiSystemFault
08 nt!MmAccessFault
09 nt!KiPageFault
0a win32kbase!LogicalCursorPosFromDpiAwarenessContext
0b win32kfull!StoreQMessage
0c win32kfull!_PostTransformableMessageExtended
0d win32kfull!PostMessageExtended
0e win32kfull!_PostShellHookMsgWorker
0f win32kfull!PostShellHookMessagesEx
10 win32kfull!xxxDestroyWindow_Phase1
11 win32kfull!xxxDestroyWindow
12 win32kfull!NtUserDestroyWindow
13 win32k!NtUserDestroyWindow
14 nt!KiSystemServiceCopyEnd

line 0a made the call, and it caused a page fault (not in memory)
this cause the memory manager to fault, then a internal memory manager fault
and a series of problems leading to the final bugcheck.

debugger check sums are ok for win32k.sys , win32kfull.sys ,win32kbase.sys
(so they are not modified)

just kind of looks like a bug (maybe changing screen resolution or reducing mouse dpi might help ???)

note: ACPI.sys
is a component is Advanced Configuration Power interface
(basically, it will allow windows to tell hardware to go into lower power modes, these functions have been updated this year and may mess up old drivers. You might go into windows control panel and tell your system to run in high performance mode to avoid certain problems with old bios, firmware, and drivers.

kd> !sysinfo machineid
sysinfo: could not find necessary interfaces.
sysinfo: note that mssmbios.sys must be loaded (XPSP2+).
(generally, when I can not read the bios info, there is something wrong with the bios installed and you would reset it to defaults or update it)
it usually happens when there is a specification change for the interface and the bios version does not match the driver versions installed in windows. Generally, you would want to update the bios to the current version and install the motherboard drivers that match the bios.
(if you reverted to a older bios you have to revert to older windows drivers)
 
Last edited:
Upvote 0 Downvote
This motherboard?

Asu Strix Z690 User Manual

(Do verify that I found the applicable User Manual.)

The motherboard appears to have the requirement that the first physically installed RAM be placed in a specific slot.

Typically DIMM_A2 as indicated on Page 1-5. Not obvious - note the small "1st" notations.

Installation order is important - the system may work but have problems if the indicated installation order is not followed.
 
Upvote 0 Downvote
This motherboard:

Asus Strix Z690-F User Manual

The two ram sticks are in the slots indicated.

I am fortunate to have a friend live local who has bought the same system as me. I have switched RAM and Power Supply to rule out hardware faults on those components.

Funny thing is he's never updated drivers since having the machine and no issues that I'm getting. I know that means nothing really, but it is annoying.

I am personally feeling it is motherboard at this point hence this little test. We have gone a long way with drivers but I don't believe its the mouse DPI or Monitor resolution that is affecting it, I'm using the Monitors Native resolution and have gone through a number of different mice since having the computer.

I do appreciate the help johnbl
 
Upvote 0 Downvote
Apologies for butting in, but in that latest dump the failure occurs during a graphics operation. It appears to be an attempt to read the cursor position...
Rich (BB code): 
22: kd> .trap ffffce0d01c3f3f0;knL
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff80a2da280d0 rbx=0000000000000000 rcx=ffffa98732a179c0
rdx=000000073364be01 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8022d818c4a rsp=ffffce0d01c3f580 rbp=0000000000000000
 r8=0000000000000001  r9=0000000000000000 r10=fffff8027c01d520
r11=ffffce0d01c3f660 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
win32kbase!LogicalCursorPosFromDpiAwarenessContext+0x2a:
fffff802`2d818c4a 488b4008        mov     rax,qword ptr [rax+8] ds:fffff80a`2da280d8=????????????????
  *** Stack trace for last set context - .thread/.cxr resets it
I can also see in that dump that your running the Riot Vanguard anti-cheat driver vgk.sys and it's very new...
Rich (BB code): 
22: kd> lmDvmvgk
Browse full module list
start             end                 module name
fffff802`24570000 fffff802`25b9b000   vgk        (deferred)             
    Image path: vgk.sys
    Image name: vgk.sys
    Browse all global symbols  functions  data  Symbol Reload
    Timestamp:        Fri Jul 11 00:07:48 2025 (68702BA4)
    CheckSum:         0165430E
    ImageSize:        0162B000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:
The Riot Vanguard anti-cheat tool is a very well-known cause of BSODs and whilst there are no indications in the dump that vgk.sys is involved it might be wise to uninstall Vanguard - which will mean some Riot games will be unplayable - reboot (to unload vgk.sys) and then see whether you can make it BSOD. If you can then this is a red herring. It's worth checking however, Vanguard is a VERY well known cause of BSODs.
 
Upvote 0 Downvote
Thanks for the reply. Yes unfortunately well aware with how invasive and crap Vanguard is. I will wait for the next BSOD to confirm if the PSU/RAM is not the cause of fault and then uninstall League of Legends and Vanguard. I have a few other games I am playing at the moment that a BSOD has occurred during so should still be able to provide a fair test afterwards.
 
  • Like
Reactions: ubuysa
Upvote 0 Downvote
You must log in or register to reply here.

TRENDING THREADS

Latest posts

Moderators online

Share this page

COMPANY
RESOURCES
FOLLOW
Top Bottom