[SOLVED] ntoskrnl.exe+3f7dd0 (plus) Shut Down - Help needed please!

Jul 10, 2022
16
1
15
Greetings,

I have been chasing a regular restart on my desktop for a while now and am running out of ideas. I would greatly appreciate ANY help.

It occurs when I am not at the computer. I suspected iDrive backup but removed it. It has been an IRQL or DRIVER_IRQL but this latest time (after I did some more tweaks) the Bug Check String is blank. It WAS consistently ntoskrnl.exe+3f7dd0, but now it is happening every day and I am seeing:

DRIVER_IROL_NOT_LESS_OR EQUAL
KMODE_EXCEPTION_NOT_HANDLED
SYSTEM_SERVICE_EXCEPTION
ATTEMPTED_WRITE_TO_READONLY

AMD Ryzen 5 3600 6-Core processor
Radeon Pro WX 4100 video card

I have run:

- SFC /SCANNOW (No issues)
-DISM /Online /Cleanup Image / Restorehealth (No issues)
  • Memory test (No issues)
  • Ran a clean install of video card to eliminate NDVIDA drivers
  • Uninstalled Ableton Live 11
  • I ran the freebee version of RESTORO. The majority of the issues have been with idriveservice and Microsoft-windows-defrag.
Link to OneDrive folder with dump and system file. https://1drv.ms/u/s!AgH9F0Y2dii12GC8xcPN6o7sBdS2?e=EdPJg4

Again, any help or ideas are greatly appreciated. Thank you very much in advance!

Note: I do not use this computer daily.

David

Addendum: I reran SFC /SCANNOW and came up with some files that were corrupted. These were repaired.
 
Last edited:
Solution
John probably won't see your reply, as he comes and goes. I see what I can find - I don't know them as well as he does.
Conversion of dumps

report - Click run as fiddle to see report


File: MEMORY 22-Sep-22.DMP (Sep 23 2022 - 13:10:24)
BugCheck: [IRQL_NOT_LESS_OR_EQUAL (A)]
Probably caused by: memory_corruption (Process: System)
Uptime: 9 Day(s), 4 Hour(s), 15 Min(s), and 23 Sec(s)

You seem to be lacking drivers - I have same motherboard so i can tell.
try updating chipset drivers - https://www.amd.com/en/support/chipsets/amd-socket-am4/x570
could update bios, only 9 behind - https://www.gigabyte.com/au/Motherboard/X570-AORUS-ELITE-WIFI-rev-1x/support#support-dl-bios - I only updated to latest...
bugcheck was called due to some issue with
id_service.exe
looks like part of idrive cloud backup

the code must be running from the 32 bit subsystem. kernel dumps do not have the info for this, you would have to do a full memory dump. (very large file)

this actual bugcheck involves how threads are scheduled to prevent a low priority thread from blocking a higher priority thread.

I will try to take a closer look at this in the morning. (if i can find the date in the dump)
 
Last edited:
ok, took another look at the memory dump
the problem is caused by id_tray.exe holding a lock to an exclusive resource and not releasing it. the id_service.exe was trying to use the resource and tried to access it
50 million times before the bugcheck.

in this case windows runs a process that attempts to increase the priority of the process over and over but id_service.exe could never get the lock so was blocked from running. I would see if you can get a update to id_tray.exe. looks like a bug in that app. (looks like id_tray.exe spawns a bunch of threads/apps so it would be a bug in one of those threads (18 threads))

I can see that windows attempted to raise the priority on two of the i_tray.exe threads but did not gain any progress in getting them to run. One thread looked like it was paged out kernel code. This could mean one of the apple drivers might need to be updated. I think you had 3 drivers from 2020. It could also give a hint on how to prevent this bugcheck. (if you can not find a update) I will think about it and look when I get back, real life calls)

old driver installed:

elvidcap.sys from 2014 old game capture driver, I would remove if not using anymore
use microsoft autoruns64.exe to delete the driver entry.
Autoruns for Windows - Windows Sysinternals | Microsoft Docs
 
Last edited:
Jul 10, 2022
16
1
15
JOHNBL: Thank you VERY MUCH for digging into this!!!!. YOU ROCK! My sincere apologies for the delay in getting back to you.

I completely deleted the iDrive back up service back in July and the only thing I can find when searching for it is an old installation log.

When I used the Autoruns for Windows (thank you for the link) it shows the elvidcap.sys file as (Verified) Cosair Memory, Inc and the time stamp is Wed Jan 12 2022. Should I still delete it?

There are a lot of of dll files from Cakewalk from 2011 2016.

The bottom line is that I am still having the same reboots. I have updated the dump files in the share folder and included the event log:

https://1drv.ms/u/s!AgH9F0Y2dii12GC8xcPN6o7sBdS2?e=EdPJg4 (same link as above)

If you would be so kind as to take another look as your schedule permits.

Update: Actually, I see TotalMixFX.exe in the Memory.DMP file, so I am going to update that now. Will post results.
 

Colif

Win 11 Master
Moderator
John probably won't see your reply, as he comes and goes. I see what I can find - I don't know them as well as he does.
Conversion of dumps

report - Click run as fiddle to see report


File: MEMORY 22-Sep-22.DMP (Sep 23 2022 - 13:10:24)
BugCheck: [IRQL_NOT_LESS_OR_EQUAL (A)]
Probably caused by: memory_corruption (Process: System)
Uptime: 9 Day(s), 4 Hour(s), 15 Min(s), and 23 Sec(s)

You seem to be lacking drivers - I have same motherboard so i can tell.
try updating chipset drivers - https://www.amd.com/en/support/chipsets/amd-socket-am4/x570
could update bios, only 9 behind - https://www.gigabyte.com/au/Motherboard/X570-AORUS-ELITE-WIFI-rev-1x/support#support-dl-bios - I only updated to latest bios when I got win 11 so may not need it.

is that one set of ram or 2? its really hard to tell with Crucial as I can see same sticks by themselves, as 16gb & as 32gb

Not sure you need this unless you actually use it
Oct 03 2020AppleKmdfFilter.sysApple Mobile Device USB Device driver
I have to guess PC is using the Microsoft drivers for lan & WIFI since they not showing.
 
Solution
Jul 10, 2022
16
1
15
Colif,

Thank you very much for the quick response and for stepping in!!

  • Thank you for the fiddle report. That is A LOT of info! I will get the chipset drivers updated as well as the bios. I will post updates once I have done that.
  • I had the computer built by a friend of mine. The RAM is actually four sticks of Ballistix. It may have been a cheaper option.
  • I have 128 GB iPod full of music, so I have Apple crap on the machine. Annoying. I actually have plans to put the PC into a rack mount case and add a 4TB drive so I can rip my CDs to FLAC.

Thank you again for the help!

David
 

Colif

Win 11 Master
Moderator
RAM sticks are sold in sets for a reason, the sticks are tested to work with the others in set. Individual sticks aren't tested so could be reason for BSOD.
How long you been using all 4?
if a long time, it could be okay. If only recently, it could be a cause.

We see how drivers go.

I need to edit the file that creates that fiddle, its showing info you don't really need.
 
Jul 10, 2022
16
1
15
Thank you again! I have had the PC for a few years. I think I got in in Nov 2020. I have been battling (on and off) since Nov 2021, so it worked well for at least a little while, before I started adding stuff to it. I don't use it very often.

I recall a memory test I ran on my laptop when I tried to upgrade the memory and was running into issues. I recall it showing that those were bad. Would you have a link to a mem test or one you recommend?

Is this it?

MemTest86 - Official Site of the x86 and ARM Memory Testing Tool
 

Colif

Win 11 Master
Moderator
Jul 10, 2022
16
1
15
Greetings, I did not intend to mark this solved, but meant to indicate my appreciation. My apologies for being a newby at this. Unfortunately, my issue remains. I have just uploaded the last two dump files here (they may still be syncing):

https://1drv.ms/u/s!AgH9F0Y2dii12GC8xcPN6o7sBdS2?e=CbICdP

I would GREATLY appreciate if someone could take another look.

  1. I ran the MemTest on the individual memory sticks (4) and there were no issues reported.
  2. I did a clean install of WIndows 10 Pro. There are quite a few programs that I have not reinstalled.
  3. I scanned both drives and nothing came up (before the latest restart)
  4. I am not on the computer when it restarts.

Thank you in advance.

David
 

Colif

Win 11 Master
Moderator
I started downloading them just to notice size of files, so i just downloaded twoof them for now, might look at others but I don't get any more info out of 1 1gb file as I do out of a minidump which are way smaller

John is around so he might look at them. I have bad weather again and might not be on tomorrow.

Can you follow option one on the following link - here - and then do this step below: Small memory dumps - Have Windows Create a Small Memory Dump (Minidump) on BSOD - that creates a file in c windows/minidump after the next BSOD

  1. Open Windows File Explore
  2. Navigate to C:\Windows\Minidump
  3. Copy the mini-dump files out onto your Desktop
  4. Do not use Winzip, use the built in facility in Windows
  5. Select those files on your Desktop, right click them and choose 'Send to' - Compressed (zipped) folder
  6. Upload the zip file to the Cloud (OneDrive, DropBox . . . etc.)
  7. Then post a link here to the zip file, so we can take a look for you . . .

Conversion of dumps

report - Click run as fiddle to see report

File: MEMORY.DMP (Nov 13 2022 - 09:21:53)
BugCheck: [BAD_POOL_HEADER (19)]
Probably caused by: memory_corruption (Process: svchost.exe)
Uptime: 0 Day(s), 2 Hour(s), 36 Min(s), and 02 Sec(s)

report

File: MEMORY 12-Nov-22.DMP (Nov 13 2022 - 06:45:19)
BugCheck: [KERNEL_SECURITY_CHECK_FAILURE (139)]
Probably caused by: memory_corruption (Process: msedge.exe)
Uptime: 0 Day(s), 0 Hour(s), 28 Min(s), and 06 Sec(s)

neither dump is showing any drivers which makes it difficult to point a finger at any. I was going to download more but I am not sure they show me anything besides the codes.
 
Jul 10, 2022
16
1
15
Thank you very much for quick reply!! The minidumps are in the same folder.

https://1drv.ms/u/s!AgH9F0Y2dii12GC8xcPN6o7sBdS2?e=CbICdP

I am running in safe mode since I kept getting the BSOD. Previous I was using driver tool (forgot name) to double check the driver list and uncheck any drivers I wasn't sure about. I came across an NVIDIA driver which I don't think I would need. DIdn't remove it, but unchecked it. I will dig back into this some more later tonight.

Thank you again!

David
 

Colif

Win 11 Master
Moderator
it only works in safe mode?

Conversion of dumps

report - Click run as fiddle to see report


File: 111222-10734-01.dmp (Nov 13 2022 - 06:11:01)
BugCheck: [DRIVER_IRQL_NOT_LESS_OR_EQUAL (D1)]
Probably caused by: memory_corruption (Process: System)
Uptime: 0 Day(s), 0 Hour(s), 41 Min(s), and 47 Sec(s)

File: 111222-10718-01.dmp (Nov 13 2022 - 06:45:19)
BugCheck: [KERNEL_SECURITY_CHECK_FAILURE (139)]
Probably caused by: memory_corruption (Process: msedge.exe)
Uptime: 0 Day(s), 0 Hour(s), 28 Min(s), and 06 Sec(s)

File: 111222-10562-01.dmp (Nov 13 2022 - 09:21:53)
BugCheck: [BAD_POOL_HEADER (19)]
Probably caused by: memory_corruption (Process: svchost.exe)
Uptime: 0 Day(s), 2 Hour(s), 36 Min(s), and 02 Sec(s)

File: 111022-10734-01.dmp (Nov 11 2022 - 13:42:18)
BugCheck: [DPC_WATCHDOG_VIOLATION (133)]
Probably caused by: memory_corruption (Process: System)
Uptime: 1 Day(s), 1 Hour(s), 51 Min(s), and 29 Sec(s)

File: 111222-10734-02.dmp (Nov 13 2022 - 06:16:45)
BugCheck: [APC_INDEX_MISMATCH (1)]
Probably caused by: memory_corruption (Process: msedge.exe)
Uptime: 0 Day(s), 0 Hour(s), 05 Min(s), and 16 Sec(s)

Curious if you bsod if you start windows without wifi or Ethernet attached.
top one mentions USB, as does 4th. 2 crashed Edge, so could be internet.
Sep 03 2019Netwtw04.sysIntel Wireless Wifi Link driver https://downloadcenter.intel.com/
Wifi, even when onboard, uses USB connections
Jun 15 2020e1r68x64.sysIntel(R) Gigabit Adapter driver https://downloadcenter.intel.com/
aren't much newer.
 
Jul 10, 2022
16
1
15
Colif,

Thank you again for your help. I really appreciate it.

I haven't tried starting without wifi or Internet. I am still in safe mode with ethernet and it hasn't rebooted at all. Granted, its only a day+, but its a start.

I ran the AutoRun again and turned off the Intel and USB drivers.

Is there anything I should look for with the (Not Verified) drivers? They are all Microsoft Corporation.

What about the "File Not Found" drivers? Are they listed because something is looking for them?

I'll reboot it and then take it out of safe mode. Thank you again!

David
 
Jul 10, 2022
16
1
15
I took it out of safe mode last night and it was still running this evening. I updated two drivers listed above. Will let it run with the network driver and then will try the WiFi driver tomorrow. Thank you again!
 

Colif

Win 11 Master
Moderator
safe mode wouldn't have used either of the network drivers

What USB drivers did you disable? when i said USB I should have explained. I think WIFI uses USB for some of its actions, so its possible of the 2 Intel drivers, it might use them

I always do things backwards, I should have asked if you use WIFI or Ethernet normally
 
Jul 10, 2022
16
1
15
Hey there, no problem. I appreciate the suggestions and sometimes working backwards is more efficient.

So after the updates on Tuesday I got another BSOD/Restart when I checked last night. I put the minidump file 16-Nov-2022) in the same DUMP FILE folder (links above).

With the updates I did it installed an MpKslf71e1c4d which was checked in AutoRun but was also file not found. I unchecked it. (It's actually gone now)

It also installed a iqvsw64e.sys file which is an Intel Network Adapter Diagnostic Driver. I unchecked that.

I unchecked both of those as well as the Intel PROSet Monitoring Service that it installed. Restarted it. Came back this evening and it didn't give me a BSOD/restart.

I saved the AutoRuns file to the same Dump File folder so you can look at the drivers that are still running., although that may be in the mini dump (duh!).

I don't know that there are issues with the files I mentioned above, or if it is something that is still running that seems to cause problems with other stuff.

If you would, take a look at the drivers and let me know your thoughts.

Is there anything I should do about the NOT VERIFIED drivers?

What about the file(s) not found? Do those need to be removed from the MSCONFIG?

Again, thank you very much for your help! I am traveling in a few days for the holiday, so no hurry on a reply. I'll check again before I leave if there is any other info you would like me to share. Thank you again!

David
 
Jul 10, 2022
16
1
15
I used the JSDFiddle and saw all the memory corruption issues.

SFC /scannow found corrupt files.

No problems from chkdsk

And since I don't know what I am doing, I also ran: DISM /Online /Cleanup-Image /RestoreHealth

Is one or all of those something that I should run after every BSOD/restart just to clear up any carnage?

Thank you again!
 

Colif

Win 11 Master
Moderator
chkdsk could help
I used the JSDFiddle and saw all the memory corruption issues.
I tend to see corruption in a lot of bsod, it can just mean bad drivers. fixes files won't hurt though
Is one or all of those something that I should run after every BSOD/restart just to clear up any carnage?
they shouldn't be needed after every crash

Conversion of Dumps

report


File: 111722-7718-01.dmp (Nov 18 2022 - 09:19:01)
BugCheck: [VIDEO_SCHEDULER_INTERNAL_ERROR (119)]
*** WARNING: Unable to verify timestamp for amdkmdag.sys
Probably caused by: dxgmms2.sys (Process: System)
Uptime: 1 Day(s), 0 Hour(s), 36 Min(s), and 38 Sec(s)

File: 111622-7609-01.dmp (Nov 16 2022 - 18:02:34)
BugCheck: [KMODE_EXCEPTION_NOT_HANDLED (1E)]
Probably caused by: memory_corruption (Process: System)
Uptime: 0 Day(s), 6 Hour(s), 43 Min(s), and 20 Sec(s)

top one is the AMD GPU drivers
Sep 08 2021amdkmdag.sysAMD Graphics driver
try running DDU in safe mode, uninstall AMD gpu drivers, boot back into normal mode and reinstall new drivers - https://forums.tomshardware.com/thr...n-install-of-your-video-card-drivers.2402269/

2nd I am not so sure about.
 
Jul 10, 2022
16
1
15
Colif,

Thank you again! I really appreciate it.

**I got as far as typing the above line and I got another BSOD. I did everything you suggested above. I copied the minidump to the same folder again. I will take another look at Autoruns to see what was added, uncheck anything new, reboot and see what happens.

Again, thank you very much!! I will be gone for a week, so take your time on a reply. Have a wonderful Thanksgiving!

David
 
Jul 10, 2022
16
1
15
Got another BSOD after the post Autoruns restart. The last two BSOD have been when I was using MS Edge, so maybe it is network related. Same routine for the minidump.

Its 725am here and I am ready for a beer already. ;)

Thank you again!
 

Colif

Win 11 Master
Moderator
Conversion of dump

report - Click run as fiddle to see report


File: 111822-6984-01.dmp (Nov 19 2022 - 00:06:15)
BugCheck: [APC_INDEX_MISMATCH (1)]
Probably caused by: ntkrnlmp.exe (Process: System)
Uptime: 0 Day(s), 0 Hour(s), 02 Min(s), and 09 Sec(s)

if its a driver, only drivers running were made by intel (lan drivers), Elgato or AMD (everything else)

and i just noticed you have same motherboard as I do again.

I know ram checks out but can you try using 1 stick for a while and see if you still get BSOD. If you had an intel cpu, using 4 individual sticks can work, with AMD its not so certain. It might not be problem but way error keeps moving around makes me wonder.

7am a little early for a beer (and that is coming from an Australian)
 
Jul 10, 2022
16
1
15
Colif,

Thank you again! Hope you are close to Philip Island. World Superbike is there this weekend (I believe). I have been suspicious of the memory as well. The guy that built it for me is good, but some time economics outweigh quality. My next question, if I should choose to replace the memory, what would you recommend? Would two sticks be reasonable, or should I keep it all on one? 2 x 32GB is not going to break me. Since you have the same MOBO I figure you'll know the appropriate specs.

I pulled three of the memory sticks and will leave it running for the day and see what happens.

Thank you again! Enjoy the sun, its cold today, and I'm in Texas.

David
 
  • Like
Reactions: Colif