Question PC crashing while playing intensive games ?

[zoberwarth]

If you didn't see my last post my pc has been having intermittent crashing issues. I tried reinstalling windows last night which resolved most of the errors however one still persists. Event viewer now spits out "Dump file creation failed due to error during dump creation" Before the system reboots. No bsod and little to no info. Leaving me with "Bug Check code 292" and some sadness. If anyone has any ideas let me know. Alot of internet searching leads me to believe its a hardware issue however I dont know what else to check.



I have now done:

-Windows reinstall

-latest drivers

-latest stable bios

-latest chipset driver

-Installed WD software all drives Healthy



The best way to get the error to happen is to play MW2 2022. Most of the time I get a crash within an hour. Under regular stress tests the pc runs fine so its not a temperature problem.

Full system
5800x

B550 mobo

32gb Kingston ram (New)

6900xt watercooled

 

[zoberwarth]

I expect that the ryzen driver is accessed by the ryzen service which would be accessed by a ryzen app to provide overclocking control and setting access.
You would have to run some uninstaller to get it all removed correctly.

a clean install of windows would also work.

https://drive.google.com/file/d/1M6_LNihiSnnAnx8pI7HA2CRzUMApsbt4/view?usp=sharing
Here is the Kernel version of the forced crash. where would that driver come from in the first place? To get the correct gpu driver It may auto install ryzen master

 

[zoberwarth]

Interestingly enough I checked the driver program and in the tuning section the cpu tuning stuff is missing entirely (Guess that makes sense because I removed the driver that allows that to function)

 

[johnbl]

Interestingly enough I checked the driver program and in the tuning section the cpu tuning stuff is missing entirely (Guess that makes sense because I removed the driver that allows that to function)

the file was a minidump, kernel dumps are stored in a different directory and have the name memory.dmp by default.

I can see the ryzemaster main driver is gone (stops any overclocking)
I see that 3 windows files are still modified:
System32\win32k.sys unavailable (00000000)
System32\win32kbase.sys unavailable (00000000)
System32\win32kfull.sys unavailable (00000000)
the zeros mean something removed the build checksum in the memory image.
(assumption is that the files have been modified)
dism.exe command is used to fix the files on disk, deleting the pagefile forces the files to be reloaded from disk into the memory image.

I would need the kernel dump c:\windows\memory.dmp
to look at the log files and the hardware info.

Note: you might be able to run the amd current ryzemaster and chipset update from amd website to get the proper amd updated files.
(ie to copy new files over the old ones still installed)
(ryzenmaster driver and support files)
they have a autodetect installer here:
AMD Drivers and Support | AMD

note: here is what one of the modified files looks like in the debugger. checksum/timestamp removed
this was ok for older versions of windows but now it is assumed to be malware. It could still be some game anti cheat program making the change in the memory image on disk.


1: kd> lmDvmwin32k
Browse full module list
start end module name
ffffc34f47db0000 ffffc34f47e4c000 win32k T (no symbols)
Loaded symbol image file: win32k.sys
Image path: \SystemRoot\System32\win32k.sys
Image name: win32k.sys
Browse all global symbols functions data
Timestamp: unavailable (00000000)
CheckSum: 00000000
ImageSize: 0009C000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Information from resource tables:

 

[zoberwarth]

the file was a minidump, kernel dumps are stored in a different directory and have the name memory.dmp by default.

I can see the ryzemaster main driver is gone (stops any overclocking)
I see that 3 windows files are still modified:
System32\win32k.sys unavailable (00000000)
System32\win32kbase.sys unavailable (00000000)
System32\win32kfull.sys unavailable (00000000)
the zeros mean something removed the build checksum in the memory image.
(assumption is that the files have been modified)
dism.exe command is used to fix the files on disk, deleting the pagefile forces the files to be reloaded from disk into the memory image.

I would need the kernel dump c:\windows\memory.dmp
to look at the log files and the hardware info.

Note: you might be able to run the amd current ryzemaster and chipset update from amd website to get the proper amd updated files.
(ie to copy new files over the old ones still installed)
(ryzenmaster driver and support files)
they have a autodetect installer here:
AMD Drivers and Support | AMD

note: here is what one of the modified files looks like in the debugger. checksum/timestamp removed
this was ok for older versions of windows but now it is assumed to be malware. It could still be some game anti cheat program making the change in the memory image on disk.


1: kd> lmDvmwin32k
Browse full module list
start end module name
ffffc34f47db0000 ffffc34f47e4c000 win32k T (no symbols)
Loaded symbol image file: win32k.sys
Image path: \SystemRoot\System32\win32k.sys
Image name: win32k.sys
Browse all global symbols functions data
Timestamp: unavailable (00000000)
CheckSum: 00000000
ImageSize: 0009C000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Information from resource tables:

Sorry about that. Im uploading the kernel dump to drive now. Had another crash today while not even doing too much game wise. It was a bsod but once again it didnt create a dump file for it.

 

[zoberwarth]

the file was a minidump, kernel dumps are stored in a different directory and have the name memory.dmp by default.

I can see the ryzemaster main driver is gone (stops any overclocking)
I see that 3 windows files are still modified:
System32\win32k.sys unavailable (00000000)
System32\win32kbase.sys unavailable (00000000)
System32\win32kfull.sys unavailable (00000000)
the zeros mean something removed the build checksum in the memory image.
(assumption is that the files have been modified)
dism.exe command is used to fix the files on disk, deleting the pagefile forces the files to be reloaded from disk into the memory image.

I would need the kernel dump c:\windows\memory.dmp
to look at the log files and the hardware info.

Note: you might be able to run the amd current ryzemaster and chipset update from amd website to get the proper amd updated files.
(ie to copy new files over the old ones still installed)
(ryzenmaster driver and support files)
they have a autodetect installer here:
AMD Drivers and Support | AMD

note: here is what one of the modified files looks like in the debugger. checksum/timestamp removed
this was ok for older versions of windows but now it is assumed to be malware. It could still be some game anti cheat program making the change in the memory image on disk.


1: kd> lmDvmwin32k
Browse full module list
start end module name
ffffc34f47db0000 ffffc34f47e4c000 win32k T (no symbols)
Loaded symbol image file: win32k.sys
Image path: \SystemRoot\System32\win32k.sys
Image name: win32k.sys
Browse all global symbols functions data
Timestamp: unavailable (00000000)
CheckSum: 00000000
ImageSize: 0009C000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Information from resource tables:

Right here is the Kernel dump. https://drive.google.com/file/d/1DAcHGh2qmXH_S5rKlQ4PDLOWTGbP5tJe/view?usp=sharing

 

[zoberwarth]

another addition when I was changing a game from TAA to FXAA and back it caused a full pc crash. Ill look into downgrading my gpu drivers to see if that helps

 

[zoberwarth]

the file was a minidump, kernel dumps are stored in a different directory and have the name memory.dmp by default.

I can see the ryzemaster main driver is gone (stops any overclocking)
I see that 3 windows files are still modified:
System32\win32k.sys unavailable (00000000)
System32\win32kbase.sys unavailable (00000000)
System32\win32kfull.sys unavailable (00000000)
the zeros mean something removed the build checksum in the memory image.
(assumption is that the files have been modified)
dism.exe command is used to fix the files on disk, deleting the pagefile forces the files to be reloaded from disk into the memory image.

I would need the kernel dump c:\windows\memory.dmp
to look at the log files and the hardware info.

Note: you might be able to run the amd current ryzemaster and chipset update from amd website to get the proper amd updated files.
(ie to copy new files over the old ones still installed)
(ryzenmaster driver and support files)
they have a autodetect installer here:
AMD Drivers and Support | AMD

note: here is what one of the modified files looks like in the debugger. checksum/timestamp removed
this was ok for older versions of windows but now it is assumed to be malware. It could still be some game anti cheat program making the change in the memory image on disk.


1: kd> lmDvmwin32k
Browse full module list
start end module name
ffffc34f47db0000 ffffc34f47e4c000 win32k T (no symbols)
Loaded symbol image file: win32k.sys
Image path: \SystemRoot\System32\win32k.sys
Image name: win32k.sys
Browse all global symbols functions data
Timestamp: unavailable (00000000)
CheckSum: 00000000
ImageSize: 0009C000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Information from resource tables:

Well now I cant even play more normal games.................... ill wait for you to hopefully reply with info about the kernel dump. Im ready to reinstall windows again but ill wait for your verdict to see if mabey its a hardware problem.

 

[zoberwarth]

the file was a minidump, kernel dumps are stored in a different directory and have the name memory.dmp by default.

I can see the ryzemaster main driver is gone (stops any overclocking)
I see that 3 windows files are still modified:
System32\win32k.sys unavailable (00000000)
System32\win32kbase.sys unavailable (00000000)
System32\win32kfull.sys unavailable (00000000)
the zeros mean something removed the build checksum in the memory image.
(assumption is that the files have been modified)
dism.exe command is used to fix the files on disk, deleting the pagefile forces the files to be reloaded from disk into the memory image.

I would need the kernel dump c:\windows\memory.dmp
to look at the log files and the hardware info.

Note: you might be able to run the amd current ryzemaster and chipset update from amd website to get the proper amd updated files.
(ie to copy new files over the old ones still installed)
(ryzenmaster driver and support files)
they have a autodetect installer here:
AMD Drivers and Support | AMD

note: here is what one of the modified files looks like in the debugger. checksum/timestamp removed
this was ok for older versions of windows but now it is assumed to be malware. It could still be some game anti cheat program making the change in the memory image on disk.


1: kd> lmDvmwin32k
Browse full module list
start end module name
ffffc34f47db0000 ffffc34f47e4c000 win32k T (no symbols)
Loaded symbol image file: win32k.sys
Image path: \SystemRoot\System32\win32k.sys
Image name: win32k.sys
Browse all global symbols functions data
Timestamp: unavailable (00000000)
CheckSum: 00000000
ImageSize: 0009C000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Information from resource tables:

I'm at the point where I'm wondering if I should just do a full wipe of all my drives and make a super clean windows install

 

[johnbl]

I'm at the point where I'm wondering if I should just do a full wipe of all my drives and make a super clean windows install

yes at some point it is just faster to wipe and reinstall and only deal with the problem if it pops up again.

looking at the kernel dump now. It is a strange kernel dump for a dump on a normal running system. It looks like a lot of the things running are hiding from the debugger.
I have see dumps like this when the running processes were in the 32 bit subsystem.
problem is to look at them it would have to be a full dump.

I will take a look at some of the logs

strange, you system has been running
System Uptime: 0 days 0:04:34.483
4.5 seconds but many of your usb devices are asleep.

bunch of threads with unknown owner.
looking at one it looks like file system on a USB
are you using a USB storage device?
queue up request to read registry (waiting queue is 70)

all are being blocked since a disk driver is not responding.
looking for the id of the disk driver

looks like you have something called bootstrapper.exe running
is it this (bitcoin mining malware ?)
Bootstrapper.exe Virus ⛏ (Coin Miner Trojan) Removal (howtofix.guide)

i will try to see where it is running from.
process running on cpu cores 0, 2,4,6, 10 and 12
when i try to dump the location it was loaded from i get a invalid location.

keep debugging but keep finding that the info is paged out to disk and is not in the kernel dump. I think you have malware hiding in the pagefile.sys

I tried another approach and looked at what was using all of your memory resources
I looked at the allocations and found their pool tags.
problem is none of them are in the pooltag list
DAL3 (know idea)
KLOG ( guess would be for logging)
MINI ( guess would be mini port driver)
normally I would look up the known tag and find the driver that owned it.
(no luck)

you might start cmd as an admin then run
findstr /s /m /l DAL3 *.sys
and see if it returns a file name

 

[zoberwarth]

yes at some point it is just faster to wipe and reinstall and only deal with the problem if it pops up again.

looking at the kernel dump now. It is a strange kernel dump for a dump on a normal running system. It looks like a lot of the things running are hiding from the debugger.
I have see dumps like this when the running processes were in the 32 bit subsystem.
problem is to look at them it would have to be a full dump.

I will take a look at some of the logs

strange, you system has been running
System Uptime: 0 days 0:04:34.483
4.5 seconds but many of your usb devices are asleep.

bunch of threads with unknown owner.
looking at one it looks like file system on a USB
are you using a USB storage device?
queue up request to read registry (waiting queue is 70)

all are being blocked since a disk driver is not responding.
looking for the id of the disk driver

looks like you have something called bootstrapper.exe running
is it this (bitcoin mining malware ?)
Bootstrapper.exe Virus ⛏ (Coin Miner Trojan) Removal (howtofix.guide)

i will try to see where it is running from.
process running on cpu cores 0, 2,4,6, 10 and 12
when i try to dump the location it was loaded from i get a invalid location.

Weird. I did go ahead and reinstall windows however the bootstrapped should be steam. Pretty sure one of the programs it runs is called that. Anyway we will see if it fixed it or not soon.

 

[johnbl]

Weird. I did go ahead and reinstall windows however the bootstrapped should be steam. Pretty sure one of the programs it runs is called that. Anyway we will see if it fixed it or not soon.

steam would make sense, also being paged out if it is 32 bit would also make sense.

 

[zoberwarth]

steam would make sense, also being paged out if it is 32 bit would also make sense.

New install of windows and Booted up a fresh install of the game crashed almost immediately. (same event viewer info as before) Not sure if it was because I was trying to open the steam overlay or just alt+tabbing to check a background process. Would you like another kernel? This is so <Mod Edit> stupid

 

[zoberwarth]

yes at some point it is just faster to wipe and reinstall and only deal with the problem if it pops up again.

looking at the kernel dump now. It is a strange kernel dump for a dump on a normal running system. It looks like a lot of the things running are hiding from the debugger.
I have see dumps like this when the running processes were in the 32 bit subsystem.
problem is to look at them it would have to be a full dump.

I will take a look at some of the logs

strange, you system has been running
System Uptime: 0 days 0:04:34.483
4.5 seconds but many of your usb devices are asleep.

bunch of threads with unknown owner.
looking at one it looks like file system on a USB
are you using a USB storage device?
queue up request to read registry (waiting queue is 70)

all are being blocked since a disk driver is not responding.
looking for the id of the disk driver

looks like you have something called bootstrapper.exe running
is it this (bitcoin mining malware ?)
Bootstrapper.exe Virus ⛏ (Coin Miner Trojan) Removal (howtofix.guide)

i will try to see where it is running from.
process running on cpu cores 0, 2,4,6, 10 and 12
when i try to dump the location it was loaded from i get a invalid location.

keep debugging but keep finding that the info is paged out to disk and is not in the kernel dump. I think you have malware hiding in the pagefile.sys

I tried another approach and looked at what was using all of your memory resources
I looked at the allocations and found their pool tags.
problem is none of them are in the pooltag list
DAL3 (know idea)
KLOG ( guess would be for logging)
MINI ( guess would be mini port driver)
normally I would look up the known tag and find the driver that owned it.
(no luck)

you might start cmd as an admin then run
findstr /s /m /l DAL3 *.sys
and see if it returns a file name

Just ran that command on the new windows install here is what it returned


DriverStore\FileRepository\u0384804.inf_amd64_41ca4ca6939f5e56\B384763\amdkmdag.sys
DriverStore\FileRepository\u0388646.inf_amd64_cec79a959dad0433\B388577\amdkmdag.sys

 

[johnbl]

Just ran that command on the new windows install here is what it returned


DriverStore\FileRepository\u0384804.inf_amd64_41ca4ca6939f5e56\B384763\amdkmdag.sys
DriverStore\FileRepository\u0388646.inf_amd64_cec79a959dad0433\B388577\amdkmdag.sys

that makes sense, basically it was a pooltag that was using a lot of kernel memory.
if it was the GPU kernel mode driver it would be expected. If you were running a game at the time.

it is getting installed from the driver store a hidden driver location. You should install the current version but without any overclocking drivers.

I would install not install any software that was not required. IE just install the basic gpu drivers and run the game. no overlay software, no discord, no monitor software, no overclock, keep it as simple as you can and see if you bugcheck if you do not bugcheck you can add software one at a time.

Otherwise, you would want to run verifier and see what it complains about.

note: you might want to describe how your monitor is connected and what mode you are using. IE what refresh rate, type of interface. if you can try lower resolution.

 

[zoberwarth]

that makes sense, basically it was a pooltag that was using a lot of kernel memory.
if it was the GPU kernel mode driver it would be expected. If you were running a game at the time.

it is getting installed from the driver store a hidden driver location. You should install the current version but without any overclocking drivers.

I would install not install any software that was not required. IE just install the basic gpu drivers and run the game. no overlay software, no discord, no monitor software, no overclock, keep it as simple as you can and see if you bugcheck if you do not bugcheck you can add software one at a time.

Otherwise, you would want to run verifier and see what it complains about.

I basically did that. Only installing the main gpu driver and the chipset driver. ill run the game without overlays or background apps. Main issue with your overclocking hypothesis is that the amd gpu driver comes with it. I dont believe there is a way to install without it. What do you mean by verifier? Is it a windows program? I tried runing nothing but the game and got a crash within the first 5 minutes. The problem has been getting worse somehow. Same error as before 0x124 0x10

 

[zoberwarth]

that makes sense, basically it was a pooltag that was using a lot of kernel memory.
if it was the GPU kernel mode driver it would be expected. If you were running a game at the time.

it is getting installed from the driver store a hidden driver location. You should install the current version but without any overclocking drivers.

I would install not install any software that was not required. IE just install the basic gpu drivers and run the game. no overlay software, no discord, no monitor software, no overclock, keep it as simple as you can and see if you bugcheck if you do not bugcheck you can add software one at a time.

Otherwise, you would want to run verifier and see what it complains about.

note: you might want to describe how your monitor is connected and what mode you are using. IE what refresh rate, type of interface. if you can try lower resolution.

I am running two monitors a 1440p 165hz and a mini 720x480 @ 59hz

 

[johnbl]

I basically did that. Only installing the main gpu driver and the chipset driver. ill run the game without overlays or background apps. Main issue with your overclocking hypothesis is that the amd gpu driver comes with it. I dont believe there is a way to install without it. What do you mean by verifier? Is it a windows program? I tried runing nothing but the game and got a crash within the first 5 minutes. The problem has been getting worse somehow. Same error as before 0x124 0x10

the card might have saved overclock parameters in its vbios. can you save a lower speed in vbios? lower vram max speed would take less power.

any chance you got a dump of that bugcheck? maybe I can see what driver called it.
(i assume it is the gpu driver)

 

[zoberwarth]

the card might have saved overclock parameters in its vbios.

Just unplugged the mini monitor and went to the tuning part of the bios and clicked the reset in there. ill test again now

 

[zoberwarth]

the card might have saved overclock parameters in its vbios.

any chance you got a dump of that bugcheck? maybe I can see what driver called it.
(i assume it is the gpu driver)

No I still have the previous issue where windows refuses to create a mini dump and is creating that same "Dump file creation failed due to error during dump creation" error

 

[johnbl]

under clock your GPU and retest.
also tell me about the watercooling of this card, IE it has a pump. what powers the pump.
USB ? many of the ports and hubs were asleep after the system booted in the kernel dump.

disconnect the extra monitors, lower the resolution and retest.
check for bug in firmware for 165hz monitor and gpu

---
take a look at this:
How I fixed my AMD Driver Timeout Issues and retained 8/10 Bits per Color (evanshortiss.com)

 

[zoberwarth]

under clock your GPU and retest.
also tell me about the watercooling of this card, IE it has a pump. what powers the pump.
USB ? many of the ports and hubs were asleep after the system booted in the kernel dump.

disconnect the extra monitors, lower the resolution and retest.
check for bug in firmware for 165hz monitor and gpu

Im going to keep testing. I underclocked it by 30% and just played a whole game. Its pump is powered by molex and controlled by pwm. I did disconnect the other monitor for now. Not sure what you mean by bug in firmware

 

[johnbl]

Im going to keep testing. I underclocked it by 30% and just played a whole game. Its pump is powered by molex and controlled by pwm. I did disconnect the other monitor for now. Not sure what you mean by bug in firmware

good, water cooled not via USB
people had problems when they went to 144hz
I might expect more problems at 165Hz

 

[zoberwarth]

good, water cooled not via USB
people had problems when they went to 144hz
I might expect more problems at 165Hz

Just played a second game without crash. That underclock is starting to seem like a good step. Is there something I can try? Mabey a gpu bios update or somthing?
Not sure how it started happening even after two windows installs

 

[zoberwarth]

good, water cooled not via USB
people had problems when they went to 144hz
I might expect more problems at 165Hz

Im going to try downgrading my gpu driver and see what happens

 

[zoberwarth]

The gpu driver almost looked like it did the trick but it then crashed at the end of the first game. Is it possible my gpu is on the way out? Is there any good way to rule it out as dying? I dont want to but if I have to buy a new card I will.