Question PC Loading and Hanging Problems

[HammerU]

This actually started about several weeks ago and just suddenly stopped. However, it started doing it again this morning and I'm scratching my head in frustration.

When I turn on the computer it will load longer than normal on the ASROCK loading screen. After some time it's a hit or miss on the windows login screen. Sometime the login box won't show up and other times it will load but I can't click on it. When I can login it takes several minutes loading on that screen before my desktop loads up. Then other problems arise from freezing up when I open a browser or programs like Origin but then after some time it loads or opens fine. Sometimes when I click on a site it won't load for a brief time. Actually when I went to login in here it froze up for a bit.

A couple times I got the blue screen with the error Kernel Security Check Failure. Once after I went to restart my computer and the other when I was running sfc/scannow.

I ran the memory test from Windows 10 and everything showed up ok. I updated windows since I noticed it was completely updated. I eventually was able to complete sfc/scannow and it found errors but all was repaired. I'm at my wits end whether or not I should try a fresh install because I would lose a lot files. I didn't think that was the case and there was an option to keep personal files or keep personal files/w apps but when I tried with win 10 disc those two options were grayed out and I couldn't click on them and at the bottom it said I couldn't choose either; something about not compatible with new windows installation.


Windows 10
AMD FX 6300
Radeon RX 470
24 gigs ram
ASRock 970 Pro3
Thermaltake - SMART 650 W 80+ Bronze
1 SSD with windows 10 installed
1 TB Hard drive with games/media storage
1 SSD Installed various games

 

[PC Tailor]

What model RAMs are you using?

Do you have a dump file of the BSOD?
A fresh install would probably solve the issue if it's an OS issue.

Have you run a CHKDSK also?
Have you run virus / malware scans?
Have you run disk cleans / defrags / trims?

 

[HammerU]

Kingston - Black 8 GB (2 x 4 GB) DDR3-1600 Memory G.SKILL Ripjaws X Series 16GB (2 x 8GB) 240-Pin DDR3 SDRAM DDR3 1600 How do i access the dump file that's readable? Ran virus defragged awhile back on the hard drive. Haven't ran the chkdsk.

 

[PC Tailor]

Usually C:/Windows/Minidump
Or larger memory files can just be C:/Windows with a .dmp file.

Run the CHKDSK and see if that throws anything out first.

 

[HammerU]

Ran the chkdsk and didn't see any change.

Edit. On another glance I know it ran but I cannot fine any results in the window logs.

Here's the first dmp file.

Spoiler: DMP

Microsoft (R) Windows Debugger Version 10.0.14321.1024 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\051119-11718-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 17134 MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Machine Name:
Kernel base = 0xfffff8012f68d000 PsLoadedModuleList = 0xfffff8012fa3a2b0
Debug session time: Sat May 11 12:02:57.789 2019 (UTC - 4:00)
System Uptime: 0 days 2:32:11.612
Loading Kernel Symbols
...............................................................
................................................................
............................................................
Loading User Symbols
Loading unloaded module list
.......
***

• *
• Bugcheck Analysis *
• *

***

Use !analyze -v to get detailed debugging information.

BugCheck 139, {3, fffffd8ce56e5c30, fffffd8ce56e5b88, 0}

Probably caused by : ntkrnlmp.exe ( nt!KiFastFailDispatch+d0 )

Followup: MachineOwner
---------

0: kd> !analyze -v
***

• *
• Bugcheck Analysis *
• *

***

KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: fffffd8ce56e5c30, Address of the trap frame for the exception that caused the bugcheck
Arg3: fffffd8ce56e5b88, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------


DUMP_CLASS: 1

DUMP_QUALIFIER: 400

BUILD_VERSION_STRING: 10.0.17134.706 (WinBuild.160101.0800)

SYSTEM_PRODUCT_NAME: To Be Filled By O.E.M.

SYSTEM_SKU: To Be Filled By O.E.M.

SYSTEM_VERSION: To Be Filled By O.E.M.

BIOS_VENDOR: American Megatrends Inc.

BIOS_VERSION: P1.20

BIOS_DATE: 07/11/2013

BASEBOARD_MANUFACTURER: ASRock

BASEBOARD_PRODUCT: 970 Pro3 R2.0

BASEBOARD_VERSION:

DUMP_TYPE: 2

DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump

BUGCHECK_P1: 3

BUGCHECK_P2: fffffd8ce56e5c30

BUGCHECK_P3: fffffd8ce56e5b88

BUGCHECK_P4: 0

TRAP_FRAME: fffffd8ce56e5c30 -- (.trap 0xfffffd8ce56e5c30)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffd488775c0d30 rbx=0000000000000000 rcx=0000000000000003
rdx=0000000080000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8012f6be13e rsp=fffffd8ce56e5dc0 rbp=ffffd488775c0c60
r8=ffffd488775bf9b0 r9=ffffd488775c0c60 r10=fffff8012e3c4180
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po cy
nt!MiRemoveUnusedSubsection+0x82:
fffff8012f6be13e cd29 int 29h Resetting default scope EXCEPTION_RECORD: fffffd8ce56e5b88 -- (.exr 0xfffffd8ce56e5b88) ExceptionAddress: fffff8012f6be13e (nt!MiRemoveUnusedSubsection+0x0000000000000082) ExceptionCode: c0000409 (Security check failure or stack buffer overrun) ExceptionFlags: 00000001 NumberParameters: 1 Parameter[0]: 0000000000000003 Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY CPU_COUNT: 6 CPU_MHZ: da5 CPU_VENDOR: AuthenticAMD CPU_FAMILY: 15 CPU_MODEL: 2 CPU_STEPPING: 0 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: LIST_ENTRY_CORRUPT BUGCHECK_STR: 0x139 PROCESS_NAME: MsMpEng.exe CURRENT_IRQL: 2 ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application. EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application. EXCEPTION_CODE_STR: c0000409 EXCEPTION_PARAMETER1: 0000000000000003 ANALYSIS_SESSION_HOST: KRYPTON ANALYSIS_SESSION_TIME: 05-11-2019 20:30:29.0666 ANALYSIS_VERSION: 10.0.14321.1024 x86fre LAST_CONTROL_TRANSFER: from fffff8012f847c69 to fffff8012f8370a0 STACK_TEXT: fffffd8ce56e5908 fffff8012f847c69 : 0000000000000139 0000000000000003 fffffd8ce56e5c30 fffffd8ce56e5b88 : nt!KeBugCheckEx fffffd8ce56e5910 fffff8012f848010 : 0000000000010011 fffff80100000000 fffffcc784529508 0000000000000000 : nt!KiBugCheckDispatch+0x69 fffffd8ce56e5a50 fffff8012f84661f : ffff8f08a52a0990 fffff801c48f7771 ffffb10b721b49e8 ffffd4887a990918 : nt!KiFastFailDispatch+0xd0 fffffd8ce56e5c30 fffff8012f6be13e : ffff8f089ddfb180 fffffd8c00000000 fffffd8ce56e5f60 fffff801c48f6eff : nt!KiRaiseSecurityCheckFailure+0x2df fffffd8ce56e5dc0 fffff8012f6bf5fd : ffffd488775c0ce0 000000000ecbb000 fffffd8ce56e6010 ffffd48800000008 : nt!MiRemoveUnusedSubsection+0x82 fffffd8ce56e5df0 fffff8012f6bf3c9 : ffffd488775c0c60 0000000000000000 ffffd488775c0ce0 ffffd488775c0ce0 : nt!MiReferenceSubsection+0x75 fffffd8ce56e5e20 fffff8012f6b9ab6 : fffffd8ce56e5f30 fffffd8ce56e5f00 0000000000000000 0000000000000000 : nt!MiComputeDataFlushRange+0xd9 fffffd8ce56e5e70 fffff8012f6b9932 : fffffd8ce56e6198 0000000000000000 ffff8f089ddfb1b0 ffffd4887a990918 : nt!MiComputeFlushRange+0x56 fffffd8ce56e5ec0 fffff8012f6b79c1 : 0000000000000000 0000000000000001 0000000000000000 0000000000000000 : nt!MmFlushSection+0x52 fffffd8ce56e5f70 fffff8012f7a82c4 : ffffd488775c21c8 0000000000000000 ffffd48800000000 0000000000000000 : nt!CcFlushCachePriv+0x651 fffffd8ce56e60c0 fffff801c482b95a : ffffb10b721b4b30 fffffd8ce56e6700 ffffb10b721b4901 ffffd4887a990918 : nt!CcCoherencyFlushAndPurgeCache+0x64 fffffd8ce56e6110 fffff801c48eadcb : ffffb10b721b4b30 fffffd8ce56e6340 0000000000000000 ffffd4887a990918 : Ntfs!NtfsCoherencyFlushAndPurgeCache+0x2e fffffd8ce56e6150 fffff801c4822395 : ffffd4887a990918 ffffb10b721b4b30 ffffd4887a990918 ffffb10b721b49e0 : Ntfs!NtfsFlushUserStream+0x93 fffffd8ce56e61e0 fffff801c48d429c : ffffd4887a990918 ffffd48872e69180 ffffb10b721b49e0 fffffd8ce56e6340 : Ntfs!NtfsFlushVolumeFlushSingleFcb+0x295 fffffd8ce56e6310 fffff801c4846889 : 00000000c0000000 ffffd4887bed3510 00000000c0000000 ffffd4887bed3510 : Ntfs!NtfsFlushVolume+0x270 fffffd8ce56e6430 fffff801c4836f4e : ffffd4887a990918 ffffd4887bed3510 ffffd48873b51a70 0000000000000001 : Ntfs!NtfsVolumeDasdIo+0x1d9 fffffd8ce56e64e0 fffff801c4836378 : ffffd4887a990918 ffffd4887bed3510 0000000000000000 0000000011000000 : Ntfs!NtfsCommonRead+0x9de fffffd8ce56e66d0 fffff8012f725e69 : ffffd4887c031b70 ffffd4887bed3510 ffffd4887bed3510 ffffd48873b34a90 : Ntfs!NtfsFsdRead+0x1d8 fffffd8ce56e6790 fffff801c3b27207 : fffffd8ce56e6860 fffff801c3b253b4 0000000000000000 0000000000000003 : nt!IofCallDriver+0x59 fffffd8ce56e67d0 fffff801c3b251c6 : fffffd8ce56e6860 ffffd4887bb69520 fffffd8ce56e68c0 fffff80100000000 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x157 fffffd8ce56e6840 fffff8012f725e69 : ffffd4887bed3510 fffff8012f726135 0000000000000000 0000000000000000 : FLTMGR!FltpDispatch+0xb6 fffffd8ce56e68a0 fffff8012fb88fab : fffffd8ce56e6b80 ffffd4887bb69520 0000000000000000 0000001f5cffc6c8 : nt!IofCallDriver+0x59 fffffd8ce56e68e0 fffff8012fb9fe62 : ffffd48800000000 ffffd4887bb69520 0000000000000000 fffffd8ce56e6b80 : nt!IopSynchronousServiceTail+0x1ab fffffd8ce56e6990 fffff8012f847743 : 00000000000009ec 0000000000000000 0000000000000000 0000000000000000 : nt!NtReadFile+0x692 fffffd8ce56e6a90 00007fff4eb5aa64 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiSystemServiceCopyEnd+0x13 0000001f5cffc6a8 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x00007fff4eb5aa64


STACK_COMMAND: kb

THREAD_SHA1_HASH_MOD_FUNC: b5fc35a7b686d5f327c4dc842be431e4dc21ea06

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 96593989a6b98a8ba5be5fafc2ce53e8d205f248

THREAD_SHA1_HASH_MOD: 3e3752b3f59a10eecc1775417bc92a4429ad7723

FOLLOWUP_IP:
nt!KiFastFailDispatch+d0
fffff8012f848010 c644242000 mov byte ptr [rsp+20h],0 FAULT_INSTR_CODE: 202444c6 SYMBOL_STACK_INDEX: 2 SYMBOL_NAME: nt!KiFastFailDispatch+d0 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe DEBUG_FLR_IMAGE_TIMESTAMP: 5ca31432 IMAGE_VERSION: 10.0.17134.706 BUCKET_ID_FUNC_OFFSET: d0 FAILURE_BUCKET_ID: 0x139_3_nt!KiFastFailDispatch BUCKET_ID: 0x139_3_nt!KiFastFailDispatch PRIMARY_PROBLEM_CLASS: 0x139_3_nt!KiFastFailDispatch TARGET_TIME: 2019-05-11T16:02:57.000Z OSBUILD: 17134 OSSERVICEPACK: 706 SERVICEPACK_NUMBER: 0 OS_REVISION: 0 SUITE_MASK: 784 PRODUCT_TYPE: 1 OSPLATFORM_TYPE: x64 OSNAME: Windows 10 OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS Personal OS_LOCALE: USER_LCID: 0 OSBUILD_TIMESTAMP: 2019-04-02 03:50:10 BUILDDATESTAMP_STR: 160101.0800 BUILDLAB_STR: WinBuild BUILDOSVER_STR: 10.0.17134.706 ANALYSIS_SESSION_ELAPSED_TIME: b84 ANALYSIS_SOURCE: KM FAILURE_ID_HASH_STRING: km:0x139_3_nt!kifastfaildispatch FAILURE_ID_HASH: {36173680-6f08-995f-065a-3d368c996911} [/spoiler] Second to last. [spoiler] Microsoft (R) Windows Debugger Version 10.0.14321.1024 X86 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Windows\Minidump\051119-9265-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: srv* Executable search path is: Windows 10 Kernel Version 17134 MP (6 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Machine Name: Kernel base = 0xfffff8024909f000 PsLoadedModuleList = 0xfffff8024944c2b0 Debug session time: Sat May 11 16:45:21.247 2019 (UTC - 4:00) System Uptime: 0 days 0:08:27.071 Loading Kernel Symbols ............................................................... ................................................................ ........................................................... Loading User Symbols Loading unloaded module list ............ ******************************************************************************* [LIST] [*]* [*]Bugcheck Analysis * [*]* [/LIST] ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 139, {3, ffff948d5ae7ce30, ffff948d5ae7cd88, 0} Probably caused by : ntkrnlmp.exe ( nt!KiFastFailDispatch+d0 ) Followup: MachineOwner --------- 5: kd> !analyze -v ******************************************************************************* [LIST] [*]* [*]Bugcheck Analysis * [*]* [/LIST] ******************************************************************************* KERNEL_SECURITY_CHECK_FAILURE (139) A kernel component has corrupted a critical data structure. The corruption could potentially allow a malicious user to gain control of this machine. Arguments: Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove). Arg2: ffff948d5ae7ce30, Address of the trap frame for the exception that caused the bugcheck Arg3: ffff948d5ae7cd88, Address of the exception record for the exception that caused the bugcheck Arg4: 0000000000000000, Reserved Debugging Details: ------------------ DUMP_CLASS: 1 DUMP_QUALIFIER: 400 BUILD_VERSION_STRING: 10.0.17134.706 (WinBuild.160101.0800) SYSTEM_PRODUCT_NAME: To Be Filled By O.E.M. SYSTEM_SKU: To Be Filled By O.E.M. SYSTEM_VERSION: To Be Filled By O.E.M. BIOS_VENDOR: American Megatrends Inc. BIOS_VERSION: P1.20 BIOS_DATE: 07/11/2013 BASEBOARD_MANUFACTURER: ASRock BASEBOARD_PRODUCT: 970 Pro3 R2.0 BASEBOARD_VERSION: DUMP_TYPE: 2 DUMP_FILE_ATTRIBUTES: 0x8 Kernel Generated Triage Dump BUGCHECK_P1: 3 BUGCHECK_P2: ffff948d5ae7ce30 BUGCHECK_P3: ffff948d5ae7cd88 BUGCHECK_P4: 0 TRAP_FRAME: ffff948d5ae7ce30 -- (.trap 0xffff948d5ae7ce30) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=ffffcd8936085f28 rbx=0000000000000000 rcx=0000000000000003 rdx=ffffcd8936085f88 rsi=0000000000000000 rdi=0000000000000000 rip=fffff802490d6efc rsp=ffff948d5ae7cfc0 rbp=ffff948d5ae7d0c0 r8=ffff948d5ae7cfc8 r9=0000000000000000 r10=0000000000000fff r11=0000000000000050 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl nz na po nc nt!MiDeleteVad+0x18dc: fffff802490d6efc cd29 int 29h
Resetting default scope

EXCEPTION_RECORD: ffff948d5ae7cd88 -- (.exr 0xffff948d5ae7cd88)
ExceptionAddress: fffff802490d6efc (nt!MiDeleteVad+0x00000000000018dc)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY

CPU_COUNT: 6

CPU_MHZ: da5

CPU_VENDOR: AuthenticAMD

CPU_FAMILY: 15

CPU_MODEL: 2

CPU_STEPPING: 0

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: LIST_ENTRY_CORRUPT

BUGCHECK_STR: 0x139

PROCESS_NAME: ShellExperienc

CURRENT_IRQL: 0

ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE_STR: c0000409

EXCEPTION_PARAMETER1: 0000000000000003

ANALYSIS_SESSION_HOST: KRYPTON

ANALYSIS_SESSION_TIME: 05-11-2019 20:25:57.0355

ANALYSIS_VERSION: 10.0.14321.1024 x86fre

LAST_CONTROL_TRANSFER: from fffff80249259c69 to fffff802492490a0

STACK_TEXT:
ffff948d5ae7cb08 fffff80249259c69 : 0000000000000139 0000000000000003 ffff948d5ae7ce30 ffff948d5ae7cd88 : nt!KeBugCheckEx
ffff948d5ae7cb10 fffff8024925a010 : 0a00000607f4e867 0000000000000000 0000000000000010 ffffcd8935a1f880 : nt!KiBugCheckDispatch+0x69
ffff948d5ae7cc50 fffff8024925861f : ffff8080bd2b9180 0000000000000001 ffff948d5ae7d1a0 0000000000000030 : nt!KiFastFailDispatch+0xd0
ffff948d5ae7ce30 fffff802490d6efc : 0000000000000008 0000000000000000 ffffcd8900000002 ffffcd8936085f20 : nt!KiRaiseSecurityCheckFailure+0x2df
ffff948d5ae7cfc0 fffff8024955b223 : ffffcd8900000000 ffffcd8935b5b080 ffffcd8936c422f0 0000000000000000 : nt!MiDeleteVad+0x18dc
ffff948d5ae7d2f0 fffff80249558ef0 : ffffcd8936c422f0 0000000000000000 000001a5ef5d0000 0000000000000000 : nt!MiUnmapVad+0xa7
ffff948d5ae7d320 fffff802495e6d47 : ffffad0a00000000 ffffad0a50e21c70 ffffad0a50e21c70 ffffad0a50e21c70 : nt!MiUnmapViewOfSection+0x120
ffff948d5ae7d400 fffff80249580289 : ffffad0a50e21c60 ffffad0a50e21c70 ffffad0a50e21c70 ffffcd89353cd1c0 : nt!AlpcViewDestroyProcedure+0xe7
ffff948d5ae7d470 fffff802495e7cc0 : ffffcd89353cd1c0 ffffcd89353cd1b8 ffffcd89353cd1c0 ffffcd89353cd1c0 : nt!AlpcpDereferenceBlobEx+0x59
ffff948d5ae7d4b0 fffff802495e7b5f : ffffffffffffffff 0000000000000001 ffffcd89353cd1d0 ffffcd89353cd1d0 : nt!AlpcpFlushResourcesPort+0xd8
ffff948d5ae7d4e0 fffff802495e7a9a : ffffcd89353cd070 ffffcd8930f545d0 ffffcd89353cd040 0000000000000001 : nt!AlpcpDoPortCleanup+0x97
ffff948d5ae7d520 fffff80249592562 : ffffcd8930f545d0 ffffcd8900000000 ffffcd8900000000 ffffcd89353cd040 : nt!AlpcpClosePort+0x4a
ffff948d5ae7d550 fffff802496251c5 : 0000000001418abc ffffcd8933f8b0c0 0000000000000001 0000000000000080 : nt!ObCloseHandleTableEntry+0x212
ffff948d5ae7d690 fffff802495f18a9 : 0000000000000000 0000000000000001 ffffcd8935a1f678 ffffffffffffff01 : nt!ExSweepHandleTable+0xc5
ffff948d5ae7d740 fffff80249545341 : ffffffffffffffff ffffcd8935a1f380 ffffffff00000000 ffffcd8900000000 : nt!ObKillProcess+0x35
ffff948d5ae7d770 fffff80249553d9c : ffffcd8935a1f380 ffffad0a4d317060 ffff948d5ae7d988 0000000000000000 : nt!PspRundownSingleProcess+0x121
ffff948d5ae7d7f0 fffff80249638813 : ffffcd8900000001 fffff80249132c01 0000005f6d877000 ffffffffffffffff : nt!PspExitThread+0x5ac
ffff948d5ae7d8f0 fffff80249139370 : ffffcd8933d02398 ffffffff00000006 ffffcd8933571000 ffffad0a4d4af600 : nt!KiSchedulerApcTerminate+0x33
ffff948d5ae7d930 fffff8024924d150 : 0000000000000000 ffff948d5ae7d9c0 97e3d71bde381700 0000000000000000 : nt!KiDeliverApc+0x3a0
ffff948d5ae7d9c0 fffff802492597ea : ffffcd8935b5b080 0000000000000000 0000000000000000 000001a5e4c82910 : nt!KiInitiateUserApc+0x70
ffff948d5ae7db00 00007ffd40685b24 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiSystemServiceExit+0x9f
0000005f6eaff9b8 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x00007ffd40685b24 STACK_COMMAND: kb THREAD_SHA1_HASH_MOD_FUNC: 77cfa9fd5e60f3f23ccda67a4477190eb5a21268 THREAD_SHA1_HASH_MOD_FUNC_OFFSET: ca913a6dfe881375866a2114d6afb46a4a321b0a THREAD_SHA1_HASH_MOD: 7c2b727fe0ab8515945a4d96a0f6fa917ccf2d6e FOLLOWUP_IP: nt!KiFastFailDispatch+d0 fffff8024925a010 c644242000 mov byte ptr [rsp+20h],0

FAULT_INSTR_CODE: 202444c6

SYMBOL_STACK_INDEX: 2

SYMBOL_NAME: nt!KiFastFailDispatch+d0

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 5ca31432

IMAGE_VERSION: 10.0.17134.706

BUCKET_ID_FUNC_OFFSET: d0

FAILURE_BUCKET_ID: 0x139_3_nt!KiFastFailDispatch

BUCKET_ID: 0x139_3_nt!KiFastFailDispatch

PRIMARY_PROBLEM_CLASS: 0x139_3_nt!KiFastFailDispatch

TARGET_TIME: 2019-05-11T20:45:21.000Z

OSBUILD: 17134

OSSERVICEPACK: 706

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 784

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS Personal

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2019-04-02 03:50:10

BUILDDATESTAMP_STR: 160101.0800

BUILDLAB_STR: WinBuild

BUILDOSVER_STR: 10.0.17134.706

ANALYSIS_SESSION_ELAPSED_TIME: a7e

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0x139_3_nt!kifastfaildispatch

FAILURE_ID_HASH: {36173680-6f08-995f-065a-3d368c996911}

I can't open the last one, keeps popping I don't have permission.

 

[PC Tailor]

Can you post a link to the original dump files my friend?

 

[HammerU]

It's strange. This is the only dump file left in the folder. Yesterday there was five.

Spoiler

Microsoft (R) Windows Debugger Version 10.0.14321.1024 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\051119-9265-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 17134 MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Machine Name:
Kernel base = 0xfffff8024909f000 PsLoadedModuleList = 0xfffff8024944c2b0
Debug session time: Sat May 11 16:45:21.247 2019 (UTC - 4:00)
System Uptime: 0 days 0:08:27.071
Loading Kernel Symbols
...............................................................
................................................................
...........................................................
Loading User Symbols
Loading unloaded module list
............
***

• *
• Bugcheck Analysis *
• *

***

Use !analyze -v to get detailed debugging information.

BugCheck 139, {3, ffff948d5ae7ce30, ffff948d5ae7cd88, 0}

Probably caused by : ntkrnlmp.exe ( nt!KiFastFailDispatch+d0 )

Followup: MachineOwner
---------

5: kd> !analyze -v
***

• *
• Bugcheck Analysis *
• *

***

KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffff948d5ae7ce30, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffff948d5ae7cd88, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------


DUMP_CLASS: 1

DUMP_QUALIFIER: 400

BUILD_VERSION_STRING: 10.0.17134.706 (WinBuild.160101.0800)

SYSTEM_PRODUCT_NAME: To Be Filled By O.E.M.

SYSTEM_SKU: To Be Filled By O.E.M.

SYSTEM_VERSION: To Be Filled By O.E.M.

BIOS_VENDOR: American Megatrends Inc.

BIOS_VERSION: P1.20

BIOS_DATE: 07/11/2013

BASEBOARD_MANUFACTURER: ASRock

BASEBOARD_PRODUCT: 970 Pro3 R2.0

BASEBOARD_VERSION:

DUMP_TYPE: 2

DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump

BUGCHECK_P1: 3

BUGCHECK_P2: ffff948d5ae7ce30

BUGCHECK_P3: ffff948d5ae7cd88

BUGCHECK_P4: 0

TRAP_FRAME: ffff948d5ae7ce30 -- (.trap 0xffff948d5ae7ce30)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffcd8936085f28 rbx=0000000000000000 rcx=0000000000000003
rdx=ffffcd8936085f88 rsi=0000000000000000 rdi=0000000000000000
rip=fffff802490d6efc rsp=ffff948d5ae7cfc0 rbp=ffff948d5ae7d0c0
r8=ffff948d5ae7cfc8 r9=0000000000000000 r10=0000000000000fff
r11=0000000000000050 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
nt!MiDeleteVad+0x18dc:
fffff802490d6efc cd29 int 29h Resetting default scope EXCEPTION_RECORD: ffff948d5ae7cd88 -- (.exr 0xffff948d5ae7cd88) ExceptionAddress: fffff802490d6efc (nt!MiDeleteVad+0x00000000000018dc) ExceptionCode: c0000409 (Security check failure or stack buffer overrun) ExceptionFlags: 00000001 NumberParameters: 1 Parameter[0]: 0000000000000003 Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY CPU_COUNT: 6 CPU_MHZ: da5 CPU_VENDOR: AuthenticAMD CPU_FAMILY: 15 CPU_MODEL: 2 CPU_STEPPING: 0 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: LIST_ENTRY_CORRUPT BUGCHECK_STR: 0x139 PROCESS_NAME: ShellExperienc CURRENT_IRQL: 0 ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application. EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application. EXCEPTION_CODE_STR: c0000409 EXCEPTION_PARAMETER1: 0000000000000003 ANALYSIS_SESSION_HOST: KRYPTON ANALYSIS_SESSION_TIME: 05-12-2019 10:57:08.0541 ANALYSIS_VERSION: 10.0.14321.1024 x86fre LAST_CONTROL_TRANSFER: from fffff80249259c69 to fffff802492490a0 STACK_TEXT: ffff948d5ae7cb08 fffff80249259c69 : 0000000000000139 0000000000000003 ffff948d5ae7ce30 ffff948d5ae7cd88 : nt!KeBugCheckEx ffff948d5ae7cb10 fffff8024925a010 : 0a00000607f4e867 0000000000000000 0000000000000010 ffffcd8935a1f880 : nt!KiBugCheckDispatch+0x69 ffff948d5ae7cc50 fffff8024925861f : ffff8080bd2b9180 0000000000000001 ffff948d5ae7d1a0 0000000000000030 : nt!KiFastFailDispatch+0xd0 ffff948d5ae7ce30 fffff802490d6efc : 0000000000000008 0000000000000000 ffffcd8900000002 ffffcd8936085f20 : nt!KiRaiseSecurityCheckFailure+0x2df ffff948d5ae7cfc0 fffff8024955b223 : ffffcd8900000000 ffffcd8935b5b080 ffffcd8936c422f0 0000000000000000 : nt!MiDeleteVad+0x18dc ffff948d5ae7d2f0 fffff80249558ef0 : ffffcd8936c422f0 0000000000000000 000001a5ef5d0000 0000000000000000 : nt!MiUnmapVad+0xa7 ffff948d5ae7d320 fffff802495e6d47 : ffffad0a00000000 ffffad0a50e21c70 ffffad0a50e21c70 ffffad0a50e21c70 : nt!MiUnmapViewOfSection+0x120 ffff948d5ae7d400 fffff80249580289 : ffffad0a50e21c60 ffffad0a50e21c70 ffffad0a50e21c70 ffffcd89353cd1c0 : nt!AlpcViewDestroyProcedure+0xe7 ffff948d5ae7d470 fffff802495e7cc0 : ffffcd89353cd1c0 ffffcd89353cd1b8 ffffcd89353cd1c0 ffffcd89353cd1c0 : nt!AlpcpDereferenceBlobEx+0x59 ffff948d5ae7d4b0 fffff802495e7b5f : ffffffffffffffff 0000000000000001 ffffcd89353cd1d0 ffffcd89353cd1d0 : nt!AlpcpFlushResourcesPort+0xd8 ffff948d5ae7d4e0 fffff802495e7a9a : ffffcd89353cd070 ffffcd8930f545d0 ffffcd89353cd040 0000000000000001 : nt!AlpcpDoPortCleanup+0x97 ffff948d5ae7d520 fffff80249592562 : ffffcd8930f545d0 ffffcd8900000000 ffffcd8900000000 ffffcd89353cd040 : nt!AlpcpClosePort+0x4a ffff948d5ae7d550 fffff802496251c5 : 0000000001418abc ffffcd8933f8b0c0 0000000000000001 0000000000000080 : nt!ObCloseHandleTableEntry+0x212 ffff948d5ae7d690 fffff802495f18a9 : 0000000000000000 0000000000000001 ffffcd8935a1f678 ffffffffffffff01 : nt!ExSweepHandleTable+0xc5 ffff948d5ae7d740 fffff80249545341 : ffffffffffffffff ffffcd8935a1f380 ffffffff00000000 ffffcd8900000000 : nt!ObKillProcess+0x35 ffff948d5ae7d770 fffff80249553d9c : ffffcd8935a1f380 ffffad0a4d317060 ffff948d5ae7d988 0000000000000000 : nt!PspRundownSingleProcess+0x121 ffff948d5ae7d7f0 fffff80249638813 : ffffcd8900000001 fffff80249132c01 0000005f6d877000 ffffffffffffffff : nt!PspExitThread+0x5ac ffff948d5ae7d8f0 fffff80249139370 : ffffcd8933d02398 ffffffff00000006 ffffcd8933571000 ffffad0a4d4af600 : nt!KiSchedulerApcTerminate+0x33 ffff948d5ae7d930 fffff8024924d150 : 0000000000000000 ffff948d5ae7d9c0 97e3d71bde381700 0000000000000000 : nt!KiDeliverApc+0x3a0 ffff948d5ae7d9c0 fffff802492597ea : ffffcd8935b5b080 0000000000000000 0000000000000000 000001a5e4c82910 : nt!KiInitiateUserApc+0x70 ffff948d5ae7db00 00007ffd40685b24 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiSystemServiceExit+0x9f 0000005f6eaff9b8 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x00007ffd40685b24


STACK_COMMAND: kb

THREAD_SHA1_HASH_MOD_FUNC: 77cfa9fd5e60f3f23ccda67a4477190eb5a21268

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: ca913a6dfe881375866a2114d6afb46a4a321b0a

THREAD_SHA1_HASH_MOD: 7c2b727fe0ab8515945a4d96a0f6fa917ccf2d6e

FOLLOWUP_IP:
nt!KiFastFailDispatch+d0
fffff802`4925a010 c644242000 mov byte ptr [rsp+20h],0

FAULT_INSTR_CODE: 202444c6

SYMBOL_STACK_INDEX: 2

SYMBOL_NAME: nt!KiFastFailDispatch+d0

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 5ca31432

IMAGE_VERSION: 10.0.17134.706

BUCKET_ID_FUNC_OFFSET: d0

FAILURE_BUCKET_ID: 0x139_3_nt!KiFastFailDispatch

BUCKET_ID: 0x139_3_nt!KiFastFailDispatch

PRIMARY_PROBLEM_CLASS: 0x139_3_nt!KiFastFailDispatch

TARGET_TIME: 2019-05-11T20:45:21.000Z

OSBUILD: 17134

OSSERVICEPACK: 706

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 784

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS Personal

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2019-04-02 03:50:10

BUILDDATESTAMP_STR: 160101.0800

BUILDLAB_STR: WinBuild

BUILDOSVER_STR: 10.0.17134.706

ANALYSIS_SESSION_ELAPSED_TIME: ac6

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0x139_3_nt!kifastfaildispatch

FAILURE_ID_HASH: {36173680-6f08-995f-065a-3d368c996911}

 

[PC Tailor]

As in can you upload any raw dump files onto a file sharing site and post the link?

 

[HammerU]

Here's the one from above. https://www10.zippyshare.com/v/CbApeiBw/file.html

 

[PC Tailor]

Unfortunately getting a 403 forbidden on that one!

 

[HammerU]

Hmm, not sure why the other dmp files disappeared?

I previously had a Nvidia card and thought there might be some problems with the drivers since the other day i deleted some older updates trying to clean C drive up. So last night I ran DDU and cleaned up everything. I let the computer run all night and it was fine. Rebooted it later and met with the no login box plus wasn't able to click the power options in the bottom right. Restarted and it loaded up and was able to login.

However, some of the desktop shortcuts wouldn't fully load and it froze up for about 2 minutes. The first time I got a amdrsserv.exe system error opencl.dll pop-up and everything loading in fine after clicking to close it out. Searched and read that the AMDRSServ.exe file was causing the problems. Their solution was to delete it. Did that and played around some without any problems for some time. Rebooted again and was able to login with no problems but was met with the same some white shortcuts and the freezing for two minute schtick minus the pop-up from earlier. After that no problem. Was even able to play some BF. Just a real pain on what to do next short of reformatting.

 

[PC Tailor]

Just upload the original dump file onto google drive or mega or something then give public access then I can run through it. I can't access it through the link you provided previously.

Does the issue occur in safe mode?
Do you have latest BIOS installed?

 

[HammerU]

Ok see if this will work. https://drive.google.com/open?id=1LY-ke5zJEBwbpNjMv8bOyFoxwI9hsz5B

I'm pretty sure I didn't have any problems in safe mode.

Honestly, I haven't a clue on that one.

Edit. Ok checked and my version is P1.20 7/11/2013 and this is ASRock's latest version. https://www.asrock.com/mb/AMD/970 Pro3/#BIOS

 

[PC Tailor]

Install latest BIOS first. If it doesn't occur in safe mode, it is more likely software, not hardware.

I've got the DMP file now, I'll post back once I've analysed it.

 

[PC Tailor]

So I've ran a debug and come to the following

On Sat 11/05/2019 21:45:21 your computer crashed or a problem was reported crash dump file: 51119-9265-01.dmp uptime: 00:08:27 This was probably caused by the following module: ntkrnlmp.exe (nt!KiBugCheckDispatch+0x69) Bugcheck code: 0x139 (0x3, 0xFFFF948D5AE7CE30, 0xFFFF948D5AE7CD88, 0x0) Error: KERNEL_SECURITY_CHECK_FAILURE Bug check description: The kernel has detected the corruption of a critical data structure. The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time. One crash dump has been found and analyzed. No offending third party drivers have been found.

You can view the analysis here including third party drivers running at the time of the crash: https://pste.eu/p/fZ2R.html

So some key steps:

• Ensure your BIOS is up to date ASRock 970 Pro3 BIOS list
• Ensure all drivers are up to date
• Ensure all Windows Updates have been installed
• Run a CHKDSK command and SFC to eliminate OS corruption.
• A clean install would potentially be useful and eliminate a lot of troubleshooting steps - assuming you don't redownload the same drivers and keep an outdated BIOS.

I've also pulled out a list of modules loaded to see if I can find any potential causing drivers in the list. But please perform the steps above and feedback.
There is a possibility that this is memory related, but this is usually just a driver.

UPDATE:

You can view the full report above -
The Tages Protection modules concern me slightly, is this a software you're aware of? It's copy protection software, but wondering if this is something you have actively downloaded

Do you have any overclock on?

 

[Deleted member 14196]

Clean windows install. If it happens after that you have hardware problems

 

[HammerU]

Haven't had much time at home but I was able to run sfc /scannow and it came up clean. However going down your to do list I checked if I needed any window updates (Feature update to Windows 10, version 1809 x64 2019-04). I did and when it went to install it it froze up at 75% and had to reset it. Going to try again when I can get some free time but it's not looking too good.

Oh I did swap out my memory sticks and check each pair and they both had the same effect i.e didn't help the problem.

 

[PC Tailor]

I've updated my original post with a better report which you can also see here: https://pste.eu/p/fZ2R.html

This includes all third party drivers running at the time of the crash.
I've also noticed that your BIOS is 1.2 - there is currently 2.8 available: https://www.asrock.com/mb/AMD/970 Pro3 R2.0/#BIOS

So I'd recommend first:

• Potentially removing tages software if you do not use it.
• Updating your BIOS - drivers and hardware working with an out of date BIOS can cause this.
• Run a Virus / Malware scan to eliminate malicious software causing the slow downs and corruption.
• Ensure your GPU drivers are up to date - GPU drivers are known to cause this.
• Update your Windows
• Run HardDiskSentinel or CrystalDiskInfo to check your storage drives integrity
• Monitor temperatures of your CPU just to ensure you're not encountering thermal issues under load (these can cause slow downs and shutdowns)

 

[Satan-IR]

I ran the 051119-9265-01.dmp too and it shows a 139 bugcheck. You did a "CHKDSK" and "SFC /scannow" as PC Tailor said and it's OK.

I'd say follow his other suggestions too.

Also check if the volume is dirty or not.

The debugger shows "Address regions for 'AtihdWT6' and 'amdkmafd.sys' overlap". I think those (or one of them) is the AMD graphics driver or related to the graphics card.

It might help if you update the graphics driver or if you have the latest version uninstall it and do a clean install again. Maybe you can use DDU to remove the previous installation.

 

[HammerU]

Ok, been busy so haven't been able to tackle it much. Last night I updated the bios like suggested. However, I still couldn't update windows completely and froze at 75% every time. Still was a hit or miss whether the login screen box was there, or was able to click on the text box to put password in or not, or I could login with no problems. It still would hang after the desktop showed up with some some shortcuts remaining white. Normally would take about 2 to 3 minutes for things to unfreeze ect ect. The some visiting webpages hang up for a about a minute happened as well every so often but not much to be a pain.

Today I downloaded the Windows 10 Update Assistant to give that a whirl and it still froze up at 75%. Read your post PC with the driver list and after being absentminded for a stretch I recalled having problems with my anti-virus, Avira lately. So I thought maybe I'd try a different one and uninstalled it. Restarted and boom login screen showed up np, all the icons showed up and no hang-up at all. Tried to update again and boom went through past the 75% on pins and needles ready to hit the reset button again but it wasn't needed. Installed that troublesome one and a few others I needed without a hiccup.

I did noticed after all the updates were installed my desktop shortcuts were useless. Clicked on them and nothing. Going to actual folders had no problem that way. I did this to solve that problem in case anyone else runs into it. run cmd and dism /online /cleanup-image /restorehealth and ran sfc /scannnow after but it came up clean. All the shortcuts worked fine after that.

Everything runs like a champ now, faster than ever. I did what Satan suggested and uninstalled and reinstalled my AMD driver as well. Checked my drives with the Crucial Storage Executive app and they all checked out fine.

A couple questions. What PC mentioned about the Tages Protection drivers. Had no clue they were there and I can't seem to find a way to get rid of them. Also should I look for an alternative anti-virus other than having Windows Defender?

I'll give the final test with powering it off for the night. I needed it the past couple of nights so I just let it run all night since it seemed first thing in the morning powering it on and getting it to the desktop was the biggest headache.

 

[PC Tailor]

Fantastic news that it does seem to have overcome a huge chunk - and glad that the debug report helped. Antivirus software can very commonly cause a lot of issues when something underlying goes wrong.

I'll be honest, Avira is still a pretty high end antivirus package, it's more likely that something has become corrupt or gone a bit awry. So regardless I would completely uninstall Avira, then it's up to you of what you prefer - personally I've tried multiple ones over different years and I've always settled and been a long serving customer of Bitdefender - I use a paid version but their free version is excellent (you do still need an account).

I suspect the Tages drivers have either come alongside another program download or if your computer was off the shelf, is something that was inbuilt prior to purchase. It may be worth going through your control panel programs and see if anything comes up - I have heard reports the Tages stuff can cause issues. But if you seem to have resolved your issue for now, don't worry about it.

Have you ever run more than 1 antivirus at the same time per chance? Antivirus works through heuristic testing, and in effect when something unwanted is occuring in the background, this form of testing can cause the antivirus to attack files that should be left alone, which can lead to it corrupting itself, or your OS. Equally your Antivirus could lead to the LIST ENTRY BSOD.

 

[HammerU]

Ok, I'll look into the Tages driver more since I put this computer together and haven't the faintest idea where I picked it up.

I really do appreciate the time the others and you took out to lend me a hand. If it sails smoothly from here on out that'll be great but if it starts acting up again I'll probably do a fresh install. Thanks again and take care.