[SOLVED] PC Random BSODs

[ThisIsPaul]

if you are still having issues:
1) disconnect all un needed usb devices, then go into windows control panel device manager, find the menu item to show hidden devices. then look at the list and remove the software for any greyed out device.

1. set your system to run in high performance mode
2. set your memory dump type to kernel memory dump
3. go into virtual memory setting and turn off the virtual memory
4. boot into bios and update or reset the bios to defaults or just change any setting and change it back and save.
5. boot and turn and turn virtual memory back on to create a new pagefile.sys

now at the next bugcheck provide the kernel memory dump
c:\windows\memory.dmp file

I looked at two memory dumps. one was a watchdog issue on cpu core 9
I could see the stacks but could not read the proper info since it was a minidump. The timeout value was typical of a USB device.
(so remove hidden usb device driver in control panel, kernel dumps can read usb states and read the devices logs on the other cpu cores)

the second bugcheck was an invalid page file entry, so you delete the pagefile.sys to try and make another one since you do not know when it was corrupted.

putting your computer in high performance mode turns off sleep states that can cause corruption of pagefile.sys and can stop various USB devices from hitting sleep related bugs. Just to reduce the potential list of causes of various problems.

see if the system runs better and if you can still get any bugchecks.

the very first bug check description was a double fault. That means you had a fault and then the fault handler faulted. Normally that only happens with a overheated CPU or electrical issues.
best to update to the current drivers and motherboard drivers since it will be the most common fix for any problem we might find other than broken hardware.

be sure to check for a updated motherboard sound driver
rtkvhd64.sys aug 28 2018 is installed

Dang, thought we were out of the woods. Had a crash for the first time in what would have been two weeks on tuesday. Whea uncorrectable error bsod. I didn't get a response to the last message I posted to you, but I changed the minidump info on it as you asked but was unable to locate the exact directory you listed for the minidump (not sure ifthat matters). The directory was c\windows\minidump I dont see one for c\windows\memory.dmp file. Here is the link to the minidump:

https://www.dropbox.com/s/hjsqfp46x4kocfo/Minidump 6-18-2022 546pm.zip?dl=0

I had a gpu update from a couple days ago I just did, and there is a windows update but it won't go through (tried it a few times). Not sure if that matters at all just figured I'd lay all details out. It gives me this error:

"Some update files are missing or have problems. We'll try to download the update again later. Error code: (0x80073712)"

 

[johnbl]

Dang, thought we were out of the woods. Had a crash for the first time in what would have been two weeks on tuesday. Whea uncorrectable error bsod. I didn't get a response to the last message I posted to you, but I changed the minidump info on it as you asked but was unable to locate the exact directory you listed for the minidump (not sure ifthat matters). The directory was c\windows\minidump I dont see one for c\windows\memory.dmp file. Here is the link to the minidump:

https://www.dropbox.com/s/hjsqfp46x4kocfo/Minidump 6-18-2022 546pm.zip?dl=0

I had a gpu update from a couple days ago I just did, and there is a windows update but it won't go through (tried it a few times). Not sure if that matters at all just figured I'd lay all details out. It gives me this error:

"Some update files are missing or have problems. We'll try to download the update again later. Error code: (0x80073712)"

cpu reported a unknown error.
Error : Unknown (Proc 0 Bank 0)
Status : 0x0000000000000000

system was running for almost 4 days.

only thing that looks wrong:
looks like EasyAntiChea was having some type of problem
(anticheat game driver)

-------
no corrupted files, cpu speed was underclocked by 4 Mhz (should be fine)

there was a status code 30005. I will see if I can find it in the intel cpu docs.

1: kd> !sysinfo cpumicrocode
Initial Microcode Version: 000000e2:00000000
Cached Microcode Version: 000000e2:00000000
Processor Family: 06
Processor Model: a5
Processor Stepping: 05
1: kd> !sysinfo cpuinfo
[CPU Information]
~MHz = REG_DWORD 3696
Component Information = REG_BINARY 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
Configuration Data = REG_FULL_RESOURCE_DESCRIPTOR ff,ff,ff,ff,ff,ff,ff,ff,0,0,0,0,0,0,0,0
Identifier = REG_SZ Intel64 Family 6 Model 165 Stepping 5
ProcessorNameString = REG_SZ Intel(R) Core(TM) i9-10900K CPU @ 3.70GHz
Update Status = REG_DWORD 2
VendorIdentifier = REG_SZ GenuineIntel
MSR8B = REG_QWORD e200000000
Arg3: 00000000b2000000, High order 32-bits of the MCi_STATUS value.
Arg4: 0000000000030005, Low order 32-bits of the MCi_STATUS value.

I looked up the various status values and the bit fields just indicate what is supported in your machine. for example one of the bits indicates that your machine supports firmware processing of some of these errors.
the 5 is a counter, the 3 is another counter.
nothing that would be useful to indicate what the actual error is.
it could just be a thermal zone is too high and the firmware called the bugcheck. just can not tell.

just fyi: thermals looked ok: (assuming the numbers are not bogus)
301k = 82 F
1: kd> !tz
0 - ThermalZone @ 0xffff8b84fd494370
State: Read Flags: 0x00000002 Initialized
Mode: Active PendingMode: Active
ActivePoint: 0x00000005 PendingActivePoint: 0x00000005
Throttle: 0x00000064 PendingThrottle: 0x00000064
SampleRate: 0x00000000 ThrottleReasons: 0
OverThrottled: 0 ThermalStandby: 0
LastTime: 0x0000000000000000 LastTemp: 0x00000000 (0.0K)
PassiveTimer: 0xffff8b84fd494370
PassiveDpc: 0xffff8b84fd494370
Irp: 0xffff8b84fecff220
Device: 0xffff8b8500913ce0
Thermal Info: 0xffff8b84fd4943e0
1: kd> !tzinfo 0xffff8b84fd4943e0
ThermalInfo @ 0xffff8b84fd4943e0
Stamp: 0x00000006 Constant1: 0x00000000 Constant2: 0x00000000
Period: 0x00000000 ActiveCnt: 0x00000005 MinThrottle: 0x00000000
OverThrottle: 0x00000000
Current Temperature: 0x00000bc2 (301.0K)
Passive TripPoint Temperature: 0x00000000 (0.0K)
Active TripPoint Temperature 0: 0x00000d72 (344.2K)
Active TripPoint Temperature 1: 0x00000cd2 (328.2K)
Active TripPoint Temperature 2: 0x00000ca0 (323.2K)
Active TripPoint Temperature 3: 0x00000c6e (318.2K)
Active TripPoint Temperature 4: 0x00000c3c (313.2K)
ThermalStandby TripPoint Temperature: 0x00000000 (0.0K)
Hibernate TripPoint Temperature: 0x00000000 (0.0K)
Critical TripPoint Temperature: 0x00000f52 (392.2K)

 

[ThisIsPaul]

cpu reported a unknown error.
Error : Unknown (Proc 0 Bank 0)
Status : 0x0000000000000000

system was running for almost 4 days.

only thing that looks wrong:
looks like EasyAntiChea was having some type of problem
(anticheat game driver)

-------
no corrupted files, cpu speed was underclocked by 4 Mhz (should be fine)

there was a status code 30005. I will see if I can find it in the intel cpu docs.

1: kd> !sysinfo cpumicrocode
Initial Microcode Version: 000000e2:00000000
Cached Microcode Version: 000000e2:00000000
Processor Family: 06
Processor Model: a5
Processor Stepping: 05
1: kd> !sysinfo cpuinfo
[CPU Information]
~MHz = REG_DWORD 3696
Component Information = REG_BINARY 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
Configuration Data = REG_FULL_RESOURCE_DESCRIPTOR ff,ff,ff,ff,ff,ff,ff,ff,0,0,0,0,0,0,0,0
Identifier = REG_SZ Intel64 Family 6 Model 165 Stepping 5
ProcessorNameString = REG_SZ Intel(R) Core(TM) i9-10900K CPU @ 3.70GHz
Update Status = REG_DWORD 2
VendorIdentifier = REG_SZ GenuineIntel
MSR8B = REG_QWORD e200000000
Arg3: 00000000b2000000, High order 32-bits of the MCi_STATUS value.
Arg4: 0000000000030005, Low order 32-bits of the MCi_STATUS value.

I looked up the various status values and the bit fields just indicate what is supported in your machine. for example one of the bits indicates that your machine supports firmware processing of some of these errors.
the 5 is a counter, the 3 is another counter.
nothing that would be useful to indicate what the actual error is.
it could just be a thermal zone is too high and the firmware called the bugcheck. just can not tell.

just fyi: thermals looked ok: (assuming the numbers are not bogus)
301k = 82 F
1: kd> !tz
0 - ThermalZone @ 0xffff8b84fd494370
State: Read Flags: 0x00000002 Initialized
Mode: Active PendingMode: Active
ActivePoint: 0x00000005 PendingActivePoint: 0x00000005
Throttle: 0x00000064 PendingThrottle: 0x00000064
SampleRate: 0x00000000 ThrottleReasons: 0
OverThrottled: 0 ThermalStandby: 0
LastTime: 0x0000000000000000 LastTemp: 0x00000000 (0.0K)
PassiveTimer: 0xffff8b84fd494370
PassiveDpc: 0xffff8b84fd494370
Irp: 0xffff8b84fecff220
Device: 0xffff8b8500913ce0
Thermal Info: 0xffff8b84fd4943e0
1: kd> !tzinfo 0xffff8b84fd4943e0
ThermalInfo @ 0xffff8b84fd4943e0
Stamp: 0x00000006 Constant1: 0x00000000 Constant2: 0x00000000
Period: 0x00000000 ActiveCnt: 0x00000005 MinThrottle: 0x00000000
OverThrottle: 0x00000000
Current Temperature: 0x00000bc2 (301.0K)
Passive TripPoint Temperature: 0x00000000 (0.0K)
Active TripPoint Temperature 0: 0x00000d72 (344.2K)
Active TripPoint Temperature 1: 0x00000cd2 (328.2K)
Active TripPoint Temperature 2: 0x00000ca0 (323.2K)
Active TripPoint Temperature 3: 0x00000c6e (318.2K)
Active TripPoint Temperature 4: 0x00000c3c (313.2K)
ThermalStandby TripPoint Temperature: 0x00000000 (0.0K)
Hibernate TripPoint Temperature: 0x00000000 (0.0K)
Critical TripPoint Temperature: 0x00000f52 (392.2K)

Ok, great, so just usual apex legends errors then? I didn't know a bsod could occur from having the PC on for that long. There are some twitch gambling channels I farm for points over night lol. Thank you again so much. Havent had a bsod since that one so I think you still nailed the issue right on the head. Amazing so many problems were able to be fixed so quickly. Thank you again John.

 

[johnbl]

Ok, great, so just usual apex legends errors then? I didn't know a bsod could occur from having the PC on for that long. There are some twitch gambling channels I farm for points over night lol. Thank you again so much. Havent had a bsod since that one so I think you still nailed the issue right on the head. Amazing so many problems were able to be fixed so quickly. Thank you again John.

normally a game would not cause a bugcheck, but game driver can. the game driver was having some problem only since I can see how its memory allocations were growing and becoming fragmented. I would guess that there are programming mistakes in the game anticheat driver that only show up over a lot of sleep wake cycles. You may find that if you reboot your machine once a day that you can delay the problem until the driver is fixed with a update.

also, no evidence that this bugcheck was caused by the game driver. It used to be this bugcheck was only called by the CPU, then the GPU figured out how to call the bugcheck, now any device connected to the pci/e bus can call it, the firmware, bios, special functions in the cpu.
it makes it really hard to tell the source of the bugcheck. Right now, the only real tool I see is to look at a kernel dump, then dump the logs and look at the PCI tree and see what parts continue to work. What I often see is some branch of the hardware stops working and it generally is one of the hardware items on that branch that causes the problem. Kind of a poor way of figuring out the problem.

 

[ThisIsPaul]

normally a game would not cause a bugcheck, but game driver can. the game driver was having some problem only since I can see how its memory allocations were growing and becoming fragmented. I would guess that there are programming mistakes in the game anticheat driver that only show up over a lot of sleep wake cycles. You may find that if you reboot your machine once a day that you can delay the problem until the driver is fixed with a update.

also, no evidence that this bugcheck was caused by the game driver. It used to be this bugcheck was only called by the CPU, then the GPU figured out how to call the bugcheck, now any device connected to the pci/e bus can call it, the firmware, bios, special functions in the cpu.
it makes it really hard to tell the source of the bugcheck. Right now, the only real tool I see is to look at a kernel dump, then dump the logs and look at the PCI tree and see what parts continue to work. What I often see is some branch of the hardware stops working and it generally is one of the hardware items on that branch that causes the problem. Kind of a poor way of figuring out the problem.

I provided the kernel dump to you right? I changed the minidump directory settings over to kernel dump. Just making sure I'm doing everything I can to facilitate your expertise. Cant thank you enough. I can donate to you via an app as well grateful for your time.

 

[johnbl]

I provided the kernel dump to you right? I changed the minidump directory settings over to kernel dump. Just making sure I'm doing everything I can to facilitate your expertise. Cant thank you enough. I can donate to you via an app as well grateful for your time.

i did not see any kernel dumps. only minidumps

 

[ThisIsPaul]

i did not see any kernel dumps. only minidumps

Just to confirm, this setting (kernel memory dump) under the "write debugging information" is all thats needed for a kernel dump to be sent to directory upon bsod crash right? I did set this but somehow it was reset to minidump. Had another crash (double fault) but I'll wait for the next bsod since this one didnt save as a kernel dump unfortunately. Posted picture below of my kernel memory dump setting:

https://www.dropbox.com/s/nxuxg6po40d53mi/Kernel Memory Dump setting.png?dl=0

 

[ThisIsPaul]

i did not see any kernel dumps. only minidumps

Ok finally got the kernel dump on tonights bsod (I believe). Thing is huge like 5gb is that normal? Here is the link. Another whea uncorrectable error:

https://www.dropbox.com/s/03yxgxsabzslstl/Memory Kernel DMP 6-27-2022 1111pm.zip?dl=0

 

[johnbl]

timer was corrupted on cpu 3.
looks like you were running a 32 bit game.

thermal zone info looks bogus so I can not see if the cpu is overheated.
I would recommend removing nvidia share.exe if you are not actively using it.
(I think nvidia share.exe is a root cause of the bugcheck, remove and see if you still get a bugcheck)
you might go into bios and turn off intel turbo mode (for case of overheating)

CORSAIR Commander PRO
the hub got suspended. this device has 112 million usb entries in its log. usb very busy, many devices got suspended.

 

[ThisIsPaul]

timer was corrupted on cpu 3.
looks like you were running a 32 bit game.

thermal zone info looks bogus so I can not see if the cpu is overheated.
I would recommend removing nvidia share.exe if you are not actively using it.
(I think nvidia share.exe is a root cause of the bugcheck, remove and see if you still get a bugcheck)
you might go into bios and turn off intel turbo mode (for case of overheating)

CORSAIR Commander PRO
the hub got suspended. this device has 112 million usb entries in its log. usb very busy, many devices got suspended.

Thank you again. Disabled nvidia share.exe. If I never see CPU heating on hwmonitor would it be safe to rule out cpu overheating? As per corsair commander pro; I'm unaware if that is a built in rgb feature of my mid tower/fans; are you saying I should disable or alter that in some way or that it could also be a culprit in the bug check?

 

[johnbl]

Thank you again. Disabled nvidia share.exe. If I never see CPU heating on hwmonitor would it be safe to rule out cpu overheating? As per corsair commander pro; I'm unaware if that is a built in rgb feature of my mid tower/fans; are you saying I should disable or alter that in some way or that it could also be a culprit in the bug check?

it is just strange to see suspended usb devices and such a large number of usb transactions. Looks like each change in the led colors is getting a log entry.

 

[ThisIsPaul]

it is just strange to see suspended usb devices and such a large number of usb transactions. Looks like each change in the led colors is getting a log entry.

Apparently there is some known issue with corsair commander pro suspending and doesnt seem to be any fix lol. Well here is another kernel dump. I disabled nvidia share as far as I know, but here it is:

https://www.dropbox.com/s/qkd1lzof8l6f3ct/kernel memory dump 7-3.zip?dl=0

 

[johnbl]

interesting bugcheck.
the bugcheck indicated a double fault. Generally this indicates overheating or power problems for the cpu.

the thermal zone indicate that the cpu was only 86 degrees F
which is most likely bogus (too low of a value)

you were running a game but 6 of your usb devices report that they were suspended and waiting for wakeup. (strange)

one usb hub indicated it was suspended other two were running.
(i would go to device manager and right mouse click on all hubs and make sure windows can not turn them off to save power (power management tab))


the bluetooth/wireless device was really confused.
maybe see if there is a update driver.
Intel® Wi-Fi 6 AX201

running a debugger script that takes 15 minutes, will check the results and get back
---------------
Intel(R) Wi-Fi 6 AX201 160MHz reported that the media was disconnected and all packets diverted. dirver version reported as version 0.5
bluetooth and network are both reporting disconnected for this device. fully powered and not sleeping.
I think this is the installed driver for this device:
\SystemRoot\System32\drivers\Netwtw10.sys Tue Mar 15 07:09:41 2022

windows wifi is also reporting as disconnected

are you using bluetooth devices?

 

[ThisIsPaul]

interesting bugcheck.
the bugcheck indicated a double fault. Generally this indicates overheating or power problems for the cpu.

the thermal zone indicate that the cpu was only 86 degrees F
which is most likely bogus (too low of a value)

you were running a game but 6 of your usb devices report that they were suspended and waiting for wakeup. (strange)

one usb hub indicated it was suspended other two were running.
(i would go to device manager and right mouse click on all hubs and make sure windows can not turn them off to save power (power management tab))


the bluetooth/wireless device was really confused.
maybe see if there is a update driver.
Intel® Wi-Fi 6 AX201

running a debugger script that takes 15 minutes, will check the results and get back
---------------
Intel(R) Wi-Fi 6 AX201 160MHz reported that the media was disconnected and all packets diverted. dirver version reported as version 0.5
bluetooth and network are both reporting disconnected for this device. fully powered and not sleeping.
I think this is the installed driver for this device:
\SystemRoot\System32\drivers\Netwtw10.sys Tue Mar 15 07:09:41 2022

windows wifi is also reporting as disconnected

are you using bluetooth devices?

So I went back into power settings. What I found was although I did previously edit this under your advice, there was a particular setting to suspend or power save on some USB devices, which I now turned off. There is a setting to turn or power down the hard drive, but I cannot turn that off at all, it only allows me to adjust the minutes until it powers down. Every other setting that can enable any sleep or hibernation has already been off as well.

Moving onto the bluetooth/wireless devices it gets weird. Under network and internet settings and then under the wifi tab, I have the "wifi" and the "use random hardware" options have been turned off for some time as someone recommended that to me as a fix in the past. The last selectable option under network and internet settings is Online hotspot 2.0, which I had left "on" which I now just turned off for good measure, but what is weird, is my marantz receiver connected to my living room tv, my tv firestick, and my xbox connected to the same tv in living room is all showing up under the multimedia devices under devices and printer tab (leads me to believe bluetooth is still somehow being used although my settings say otherwise?). Not sure, but there is an option to "remove device" which I'm going to go ahead and do now, but I swear I've removed my marantz receiver device before and it seems to have re appeared as far as I recall. Not sure if any of this could be a culprit since you already reported that wifi etc is disabled/disconnected; just reporting all observations to you as per usual. Also, not sure if this matters, but my keyboard, mouse, huge rocccat FPS glowing mousepad, my realtek desktop speakers, and my astro headset charger is all connected to various usb ports on my PC (i always power down my headset when I'm done gaming, but the hub to recharge it is always plugged in).

Apart from the aforementioned, the only other thing connected via bluetooth/wireless on my PC is the printer.

Also one last bit of info that sticks out in my mind, is the last two kernel checks you've mentioned I was playing a game, but in every instance of the bugcheck, it's been after hours while I've been away from my PC or I'm sleeping, with no game running. Discord is always up (I noticed this bugcheck it said discord.exe was related to the double fault), which I believe is a 32 bit program, but I never have any games running when I'm not at my PC, just often times a twitch stream on microsoft edge.

I will update the wifi device now. Confused how bluetooth could be working since all wifi is turned off, and Really curious about the overheating/power issue. I've had a lot of stuff running and some games I run max settings with 4 streams up, discord calls, etc, and I've never seen any high temperatures (I've used HWmonitor many times to observe temperatures), PC has never abruptly turned off, no framerate dips, etc; simply put, when the PC is stressed I've never witnessed any temp or power issues (for whatever this info is worth).

 

[Colif]

So is it still getting WHEA errors? I can't tell without reading between lines at what John says.

Problem could be the motherboard itself if its doing weird things with USB

bt/wifi both use same chip, but I can guess if you disable one of its features, its still working.

just offering assistance.

 

[johnbl]

looked like the game that was running was
r5apex.exe looks like part of ApexLegends
3 processes and lot and lots of theads (about 100 on the first process)
used a lot of memory also:
Pid ImageName Commit SharedCommit Debt
33ec r5apex.exe 5407096 Kb 42216 Kb 0 Kb


bugcheck was
UNEXPECTED_KERNEL_MODE_TRAP (7f)
: 0000000000000008, EXCEPTION_DOUBLE_FAULT
STACKPTR_ERROR_nt!KiDoubleFaultAbort

strange thing:
Image: csrss.exe
has ownership of a critical section and
msedge.exe
has attempted access 95 million times

lots of msedge.exe copies running.
OmenCommandCenterBackground.exe
running: listed as a hp tool. your motherboard is asus
PRIME Z490-V

 

[Colif]

i almost suggested a clean install last post, but deleted it as whea errors normally survive those.

Something strange going on with windows there. csrss.exe is the client for the user, right?
what time period is the 95 million times?

realises he isn't helping.

 

[ThisIsPaul]

looked like the game that was running was
r5apex.exe looks like part of ApexLegends
3 processes and lot and lots of theads (about 100 on the first process)
used a lot of memory also:
Pid ImageName Commit SharedCommit Debt
33ec r5apex.exe 5407096 Kb 42216 Kb 0 Kb


bugcheck was
UNEXPECTED_KERNEL_MODE_TRAP (7f)
: 0000000000000008, EXCEPTION_DOUBLE_FAULT
STACKPTR_ERROR_nt!KiDoubleFaultAbort

strange thing:
Image: csrss.exe
has ownership of a critical section and
msedge.exe
has attempted access 95 million times

lots of msedge.exe copies running.
OmenCommandCenterBackground.exe
running: listed as a hp tool. your motherboard is asus
PRIME Z490-V

Not sure why apex processes would still be running. Maybe some residual background anti cheat thing the game runs? I always close the game after I'm done. Omen command center background should be my hp omen monitor. Are you saying my monitor can be incompatible with a mobo? When I leave or sleep if I'm farming points on casino streams I turn my monitor off that's about it. Not sure why multiple msedge copies are running or what that means. I only have 1 browser open with typically 4-7 tabs, 2 maximum being twitch streams.

 

[Colif]

what does the omen program do? I know its for monitor, but is it necessary for any functions you use?
is this it? https://www.omen.com/us/en/omen-gaming-hub.html
i think its more for their other omen gear, like their PC and laptops.

john just reporting what he sees

 

[ThisIsPaul]

what does the omen program do? I know its for monitor, but is it necessary for any functions you use?
is this it? https://www.omen.com/us/en/omen-gaming-hub.html
i think its more for their other omen gear, like their PC and laptops.

john just reporting what he sees

thanks for your help Colif. yes your link appears to be the app. I've never used it, but I opened the app for the first time on my PC and it appears to have overclocking functions, network priority functions for gaming, and other performance related purposes for gaming. It says online you can uninstall it, so if this is causing errors I will uninstall this now if it's contributing to the bugchecks. Sorry if I misinterpreted any responses from you, just wasn't sure what actions I was supposed to take or if that was at all related to the msedge and usb related issues. So go ahead and uninstall the gaming hub then?

 

[Colif]

I was just reacting to John's clues. I don't know if it cause but if you don't use it, it appears it runs in background anyway so might as well remove it.

 

[johnbl]

I was thinking about this bughceck 7f
here is what caused it:
game runs for extended period for what ever reason (infected with bitcoin miner?)
easyanticheat driver continues to check for cheating but has a bug in it.
this driver is a filter driver and all of the kernel allocations are from the filter driver system rather than from the driver. the leak causes the entire system to run out of kernel paged pool until the system bugchecks. you get a double fault because there is no page pool left and the fault handler bugchecks.

this would mean basically, there is nothing wrong with your hardware.
fix would for easysanticheat driver to be fixed.
work around would be to find out why the game appears to still be running and stop it.
second workaround would be to reboot so all of the non paged pool used by the filter driver is released. (it might get released when all three threads of the game are terminated.

game was using over 5 gb memory allocations on one process. I did not check the others. filter was using 1.2 gb non paged pool (the most of any driver in the system)

filter driver does not have to leak if game is infected with a mining software. parts of the memory dump were paged out. some of the raw stack showed faults in floating point code.

Since you also had a very high number of msedge threads running, you might look for a extension that is installed running something that you do not want to run.

event logging was using a lot of nonpaged pool.
I see a lot of messages coming out of the usb subsytem.
2 logs with about 250 million messages each.
I hate to see that. but I would work on the other problems first.

 

[johnbl]

System Uptime: 1 days 8:48:12.478


here is the debug info on the nonpaged pool used: (part of it)
KSfi is the pooltag for the filter manager>
(looked here to find the pool tag and look up the component
PoolMonX/pooltag.txt at master · zodiacon/PoolMonX · GitHub )

!poolused 2 -t 10
(this command shows the top 10 nonpaged poolused)

NonPaged Paged
Tag Allocs Used Allocs Used

File 385853 154281872 0 0 File objects
KSfi 167800 136924800 0 0 UNKNOWN pooltag 'KSfi', please update pooltag.txt
ConT 1103 105934848 0 0 UNKNOWN pooltag 'ConT', please update pooltag.txt
KSpf 167800 61750400 2 352 UNKNOWN pooltag 'KSpf', please update pooltag.txt
KSoh 335708 53713280 0 0 object header
EtwB 856 45250176 16 417792 Etw Buffer , Binary: nt!etw

--------
here are your loaded filters:
EasyAntiCheat looks like the only non microsoft filter so it gets the blame.
(still could be one of the other filters, I don't know)
1: kd> !fltkd.filters

Filter List: ffffe287e33360c0 "Frame 0"
FLT_FILTER: ffffe287f46dd010 "bindflt" "409800"
FLT_INSTANCE: ffffe287f8468010 "bindflt Instance" "409800"
FLT_FILTER: ffffe287e9832a20 "WdFilter" "328010"
FLT_INSTANCE: ffffe287ebc288a0 "WdFilter Instance" "328010"
FLT_INSTANCE: ffffe287ebce3840 "WdFilter Instance" "328010"
FLT_INSTANCE: ffffe287ec6655e0 "WdFilter Instance" "328010"
FLT_INSTANCE: ffffe287e99b08a0 "WdFilter Instance" "328010"
FLT_INSTANCE: ffffe287e99a68a0 "WdFilter Instance" "328010"
FLT_INSTANCE: ffffe287f9306520 "WdFilter Instance" "328010"
FLT_INSTANCE: ffffe287f653ea20 "WdFilter Instance" "328010"
FLT_FILTER: ffffe2880a4766d0 "EasyAntiCheatSys" "327530"
FLT_INSTANCE: ffffe287fa0fad60 "EasyAntiCheat" "327530"
FLT_INSTANCE: ffffe2881a1aad60 "EasyAntiCheat" "327530"
FLT_INSTANCE: ffffe2881c5d4d60 "EasyAntiCheat" "327530"
FLT_INSTANCE: ffffe2880bad4d60 "EasyAntiCheat" "327530"
FLT_INSTANCE: ffffe2881d052d60 "EasyAntiCheat" "327530"
FLT_INSTANCE: ffffe288275f5d60 "EasyAntiCheat" "327530"
FLT_INSTANCE: ffffe2880c1d0d40 "EasyAntiCheat" "327530"
FLT_FILTER: ffffe287f479e010 "storqosflt" "244000"
FLT_FILTER: ffffe287f2a7d010 "wcifs" "189900"
FLT_FILTER: ffffe287f58178a0 "gameflt" "189850"
FLT_INSTANCE: ffffe287f8aeda60 "gameflt Instance" "189850"
FLT_INSTANCE: ffffe287f6d03010 "gameflt Instance" "189850"
FLT_INSTANCE: ffffe287f7b495d0 "gameflt Instance" "189850"
FLT_FILTER: ffffe287f4711a20 "CldFlt" "180451"
FLT_INSTANCE: ffffe287f4799010 "CldFlt" "180451"
FLT_INSTANCE: ffffe287fa248010 "CldFlt" "180451"
FLT_INSTANCE: ffffe287fb5f3a20 "CldFlt" "180451"
FLT_FILTER: ffffe287ecdc9c20 "FileCrypt" "141100"
FLT_FILTER: ffffe287f477c010 "luafv" "135000"
FLT_INSTANCE: ffffe287f477e010 "luafv" "135000"
FLT_FILTER: ffffe287ec671570 "npsvctrig" "46000"
FLT_INSTANCE: ffffe287ecd59b40 "npsvctrig" "46000"
FLT_FILTER: ffffe287e9802820 "Wof" "40700"
FLT_INSTANCE: ffffe287ec6db8e0 "Wof Instance" "40700"
FLT_INSTANCE: ffffe287f17bdab0 "Wof Instance" "40700"
FLT_INSTANCE: ffffe287f17bcab0 "Wof Instance" "40700"
FLT_INSTANCE: ffffe287f462a520 "Wof Instance" "40700"
FLT_INSTANCE: ffffe287fa21ab10 "Wof Instance" "40700"
FLT_FILTER: ffffe287e9831420 "FileInfo" "40500"
FLT_INSTANCE: ffffe287ebd95910 "FileInfo" "40500"
FLT_INSTANCE: ffffe287e99e58a0 "FileInfo" "40500"
FLT_INSTANCE: ffffe287ec66d060 "FileInfo" "40500"
FLT_INSTANCE: ffffe287f17efa20 "FileInfo" "40500"
FLT_INSTANCE: ffffe287f1827a20 "FileInfo" "40500"
FLT_INSTANCE: ffffe287f946aa20 "FileInfo" "40500"
FLT_INSTANCE: ffffe2881a16ca20 "FileInfo" "40500"

 

[Colif]

https://www.easy.ac/en-us/support/game/guides/service/ << how to update Easy Anti cheat. At least it doesn't have ring 0 access, unlike vgk.sys.

 

[ThisIsPaul]

System Uptime: 1 days 8:48:12.478


here is the debug info on the nonpaged pool used: (part of it)
KSfi is the pooltag for the filter manager>
(looked here to find the pool tag and look up the component
PoolMonX/pooltag.txt at master · zodiacon/PoolMonX · GitHub )

!poolused 2 -t 10
(this command shows the top 10 nonpaged poolused)

NonPaged Paged
Tag Allocs Used Allocs Used

File 385853 154281872 0 0 File objects
KSfi 167800 136924800 0 0 UNKNOWN pooltag 'KSfi', please update pooltag.txt
ConT 1103 105934848 0 0 UNKNOWN pooltag 'ConT', please update pooltag.txt
KSpf 167800 61750400 2 352 UNKNOWN pooltag 'KSpf', please update pooltag.txt
KSoh 335708 53713280 0 0 object header
EtwB 856 45250176 16 417792 Etw Buffer , Binary: nt!etw

--------
here are your loaded filters:
EasyAntiCheat looks like the only non microsoft filter so it gets the blame.
(still could be one of the other filters, I don't know)
1: kd> !fltkd.filters

Filter List: ffffe287e33360c0 "Frame 0"
FLT_FILTER: ffffe287f46dd010 "bindflt" "409800"
FLT_INSTANCE: ffffe287f8468010 "bindflt Instance" "409800"
FLT_FILTER: ffffe287e9832a20 "WdFilter" "328010"
FLT_INSTANCE: ffffe287ebc288a0 "WdFilter Instance" "328010"
FLT_INSTANCE: ffffe287ebce3840 "WdFilter Instance" "328010"
FLT_INSTANCE: ffffe287ec6655e0 "WdFilter Instance" "328010"
FLT_INSTANCE: ffffe287e99b08a0 "WdFilter Instance" "328010"
FLT_INSTANCE: ffffe287e99a68a0 "WdFilter Instance" "328010"
FLT_INSTANCE: ffffe287f9306520 "WdFilter Instance" "328010"
FLT_INSTANCE: ffffe287f653ea20 "WdFilter Instance" "328010"
FLT_FILTER: ffffe2880a4766d0 "EasyAntiCheatSys" "327530"
FLT_INSTANCE: ffffe287fa0fad60 "EasyAntiCheat" "327530"
FLT_INSTANCE: ffffe2881a1aad60 "EasyAntiCheat" "327530"
FLT_INSTANCE: ffffe2881c5d4d60 "EasyAntiCheat" "327530"
FLT_INSTANCE: ffffe2880bad4d60 "EasyAntiCheat" "327530"
FLT_INSTANCE: ffffe2881d052d60 "EasyAntiCheat" "327530"
FLT_INSTANCE: ffffe288275f5d60 "EasyAntiCheat" "327530"
FLT_INSTANCE: ffffe2880c1d0d40 "EasyAntiCheat" "327530"
FLT_FILTER: ffffe287f479e010 "storqosflt" "244000"
FLT_FILTER: ffffe287f2a7d010 "wcifs" "189900"
FLT_FILTER: ffffe287f58178a0 "gameflt" "189850"
FLT_INSTANCE: ffffe287f8aeda60 "gameflt Instance" "189850"
FLT_INSTANCE: ffffe287f6d03010 "gameflt Instance" "189850"
FLT_INSTANCE: ffffe287f7b495d0 "gameflt Instance" "189850"
FLT_FILTER: ffffe287f4711a20 "CldFlt" "180451"
FLT_INSTANCE: ffffe287f4799010 "CldFlt" "180451"
FLT_INSTANCE: ffffe287fa248010 "CldFlt" "180451"
FLT_INSTANCE: ffffe287fb5f3a20 "CldFlt" "180451"
FLT_FILTER: ffffe287ecdc9c20 "FileCrypt" "141100"
FLT_FILTER: ffffe287f477c010 "luafv" "135000"
FLT_INSTANCE: ffffe287f477e010 "luafv" "135000"
FLT_FILTER: ffffe287ec671570 "npsvctrig" "46000"
FLT_INSTANCE: ffffe287ecd59b40 "npsvctrig" "46000"
FLT_FILTER: ffffe287e9802820 "Wof" "40700"
FLT_INSTANCE: ffffe287ec6db8e0 "Wof Instance" "40700"
FLT_INSTANCE: ffffe287f17bdab0 "Wof Instance" "40700"
FLT_INSTANCE: ffffe287f17bcab0 "Wof Instance" "40700"
FLT_INSTANCE: ffffe287f462a520 "Wof Instance" "40700"
FLT_INSTANCE: ffffe287fa21ab10 "Wof Instance" "40700"
FLT_FILTER: ffffe287e9831420 "FileInfo" "40500"
FLT_INSTANCE: ffffe287ebd95910 "FileInfo" "40500"
FLT_INSTANCE: ffffe287e99e58a0 "FileInfo" "40500"
FLT_INSTANCE: ffffe287ec66d060 "FileInfo" "40500"
FLT_INSTANCE: ffffe287f17efa20 "FileInfo" "40500"
FLT_INSTANCE: ffffe287f1827a20 "FileInfo" "40500"
FLT_INSTANCE: ffffe287f946aa20 "FileInfo" "40500"
FLT_INSTANCE: ffffe2881a16ca20 "FileInfo" "40500"

Amazing how talented you guys are at finding these issues out. You're like detectives following the clues. Upon this info you discovered coupled with Colif's link to the anticheat page, I uninstalled/reinstalled anticheat service, and did some research to finally figure out how to fix 2022-06 Cumulative Update for Windows 10 Version 21H2 for x64-based Systems (KB5014699) which always came back with an error and wouldnt update my windows (anticheat link and troubleshooting page listed an oudated window service as a possible cause to anticheat glitching out).

Unsettling to observe your distaste for the ongoing USB issues (appears to be quite an issue, judging by your statement). Hopefully some of the changes made will have some positive influence. I am just so grateful for your help. Also, I don't bitcoin mine (as per your statement about miner infection), but maybe there is some built in miner or bug I got from the anticheat, if that is even possible. I play apex at a high rank and play in some private tournaments, and my game crashes about 3 times a day, which is atypical of all players and streamers I play with, which leads me to believe my issue is somehow related to the anticheat issues we've found here, as I've troubleshooted and done every other repair offered from the apex team and public community.