[SOLVED] PC Random BSODs

Page 3 - Seeking answers? Join the Tom's Hardware community: where nearly two million members share solutions and discuss the latest tech.

ThisIsPaul

Prominent
Oct 17, 2021
38
0
530
Good morning. Posted about my PC BSODs but was not given a reply, figured I would try again here with a shorter styled post. Here is the most recent BSOD I experienced early this morning.

***
  • *
  • Bugcheck Analysis *
  • *
***

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
BugCheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a portion of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: ffffb9000c299e70
Arg3: ffffb9000c293ed0
Arg4: fffff8004ae05b10

Debugging Details:
------------------


KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 2436

Key : Analysis.DebugAnalysisManager
Value: Create

Key : Analysis.Elapsed.mSec
Value: 2468

Key : Analysis.Init.CPU.mSec
Value: 890

Key : Analysis.Init.Elapsed.mSec
Value: 3016

Key : Analysis.Memory.CommitPeak.Mb
Value: 87

Key : Bugcheck.DumpVsMemoryMatch
Value: True

Key : WER.OS.Branch
Value: vb_release

Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key : WER.OS.Version
Value: 10.0.19041.1


FILE_IN_CAB: MEMORY.DMP

BUGCHECK_CODE: 7f

BUGCHECK_P1: 8

BUGCHECK_P2: ffffb9000c299e70

BUGCHECK_P3: ffffb9000c293ed0

BUGCHECK_P4: fffff8004ae05b10

TRAP_FRAME: ffffb9000c293ed0 -- (.trap 0xffffb9000c293ed0)
Unable to read trap frame at ffffb9000c293ed0 BLACKBOXBSD: 1 (!blackboxbsd) BLACKBOXNTFS: 1 (!blackboxntfs) BLACKBOXPNP: 1 (!blackboxpnp) BLACKBOXWINLOGON: 1 PROCESS_NAME: dwm.exe STACK_TEXT: ffffb9000c299d28 fffff8004ae09c69 : 000000000000007f 0000000000000008 ffffb9000c299e70 ffffb9000c293ed0 : nt!KeBugCheckEx ffffb9000c299d30 fffff8004ae04a83 : c38bba724c773bc6 e8cc3348374d8b48 249c8d4cffc8817c 285b8b4900000100 : nt!KiBugCheckDispatch+0x69 ffffb9000c299e70 fffff8004ae05b10 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiDoubleFaultAbort+0x2c3 ffffb9000c293ed0 fffff8004ae05dff : 83485340cccccccc 8825048b486520ec ff66d98b48000001 ffffb9000c294130 : nt!KiPageFault+0x10 ffffb9000c294060 fffff8004ae05dff : c08548d88b480007 44c88b48d2331c74 ffacb878e860428d ffffb9000c2942c0 : nt!KiPageFault+0x2ff ffffb9000c2941f0 fffff8004ae05dff : 5b78c085fffffce0 44407b8d4838438b 157404a83e4bb70f ffffb9000c294450 : nt!KiPageFault+0x2ff ffffb9000c294380 fffff8004ae05dff : c03345000002a08e 48ff95c921e8d233 8b4c000002608e8d ffffb9000c2945e0 : nt!KiPageFault+0x2ff ffffb9000c294510 fffff8004ae05dff : f74d8d4838246489 ffffbf3024748948 452824448948001f ffffb9000c294770 : nt!KiPageFault+0x2ff ffffb9000c2946a0 fffff8004ae05dff : 4b8d483c468b4500 0c8d4838568b411c 8b45000039e6e8cf ffffb9000c294900 : nt!KiPageFault+0x2ff ffffb9000c294830 fffff8004ae05dff : c748f1a5bffab8ff 4500001b1d302444 334024448948c033 ffffb9000c294a90 : nt!KiPageFault+0x2ff ffffb9000c2949c0 fffff8004ae05dff : 8548000720bae856 4800386383ce75f6 48b175df3b481b8b ffffb9000c294c20 : nt!KiPageFault+0x2ff ffffb9000c294b50 fffff8004ae05dff : 55e802498d410020 02f883f88bff9b88 e840fc4c8b48ca73 ffffb9000c294db0 : nt!KiPageFault+0x2ff ffffb9000c294ce0 fffff8004ae05dff : 8b4cda72df3b4902 3174df3b49782444 76f03b4902c68348 ffffb9000c294f40 : nt!KiPageFault+0x2ff ffffb9000c294e70 fffff8004ae05dff : 70214820247489f6 002d92d8258b4ca0 f5e8d78ba0408d4c ffffb9000c2950d0 : nt!KiPageFault+0x2ff ffffb9000c295000 fffff8004ae05dff : 4120247489000000 00c824ac8b4cc4ff 65fffffe98e90000 ffffb9000c295260 : nt!KiPageFault+0x2ff ffffb9000c295190 fffff8004ae05dff : ca8b49068b490375 2675c68440018b48 c88b481074c23b48 ffffb9000c2953f0 : nt!KiPageFault+0x2ff ffffb9000c295320 fffff8004ae05dff : ac998b564120247c 8b4cf18b48000002 ebc11fe183cb8b1a ffffb9000c295580 : nt!KiPageFault+0x2ff ffffb9000c2954b0 fffff8004ae05dff : 807f0ff3c0570fff 24bc8b48ffffff68 20478b4800000150 ffffb9000c295710 : nt!KiPageFault+0x2ff ffffb9000c295640 fffff8004ae05dff : c8460fc83b000002 000011b878244c89 00000298b78d4d00 ffffb9000c2958a0 : nt!KiPageFault+0x2ff ffffb9000c2957d0 fffff8004ae05dff : 58878b45000000a8 2874c08545000004 4800000318978d49 ffffb9000c295a30 : nt!KiPageFault+0x2ff ffffb9000c295960 fffff8004ae05dff : 250c8b4865ff90f4 a08f894900000188 60244c8b4c000002 ffffb9000c295bc0 : nt!KiPageFault+0x2ff ffffb9000c295af0 fffff8004ae05dff : 438b410853894dff 05e0c1411fe08304 3904438941c00b41 ffffb9000c295d50 : nt!KiPageFault+0x2ff ffffb9000c295c80 fffff8004ae05dff : 48000005e6e96024 4c0000015824bc8b 008024948d48c78b ffffb9000c295ee0 : nt!KiPageFault+0x2ff ffffb9000c295e10 fffff8004ae05dff : 01532484b60f25ca d16b48c803480000 0001542484b60f25 ffffb9000c296070 : nt!KiPageFault+0x2ff ffffb9000c295fa0 fffff8004ae05dff : 41660a728966c723 0010002842c7c003 c083660ce8c16600 ffffb9000c296200 : nt!KiPageFault+0x2ff ffffb9000c296130 fffff8004ae05dff : bb8bccffbb669be8 000032b9000000bc 3345fffffe3be900 ffffb9000c296390 : nt!KiPageFault+0x2ff ffffb9000c2962c0 fffff8004ae05dff : fffe81c6ff69730a f2ff1a860f05f5e0 0004b90c478d4cff ffffb9000c296520 : nt!KiPageFault+0x2ff ffffb9000c296450 fffff8004ae05dff : 90fff32d15e80c47 8d4cccfff2fe41e9 cf8b48fff8759b05 ffffb9000c2966b0 : nt!KiPageFault+0x2ff ffffb9000c2965e0 fffff8004ae05dff : dae9fe8b00000001 000022bd41fff304 7e8341ffce834800 ffffb9000c296840 : nt!KiPageFault+0x2ff ffffb9000c296770 fffff8004ae05dff : 05e8204b8d480156 753948f633ffb935 89fffffe5d840fe0 ffffb9000c2969d0 : nt!KiPageFault+0x2ff ffffb9000c296900 fffff8004ae05dff : 850f05f983097403 4903f98300000151 41084e8b4110768d ffffb9000c296b60 : nt!KiPageFault+0x2ff ffffb9000c296a90 fffff8004ae05dff : 000017b8fff30050 3948fff3041ee9c0 f30167850f582474 ffffb9000c296cf0 : nt!KiPageFault+0x2ff ffffb9000c296c20 fffff8004ae05dff : 48f88b4cfff32c50 49d08b482374c085 85ffb8cea9e8cd8b ffffb9000c296e80 : nt!KiPageFault+0x2ff ffffb9000c296db0 fffff8004ae05dff : e9c28b41fff323b8 48c08b44fff304de 04b9fff8f95a158d ffffb9000c297010 : nt!KiPageFault+0x2ff ffffb9000c296f40 fffff8004ae05dff : 8b482574003e8349 448d4c000004808b fd46e8d68b495024 ffffb9000c2971a0 : nt!KiPageFault+0x2ff ffffb9000c2970d0 fffff8004ae05dff : 4800000085880fc0 4865002d706a1d8b 480000018825048b ffffb9000c297330 : nt!KiPageFault+0x2ff ffffb9000c297260 fffff8004ae05dff : 4b8b4810468d4800 03b9077419394808 48894829cd000000 ffffb9000c2974c0 : nt!KiPageFault+0x2ff ffffb9000c2973f0 fffff8004ae05dff : c0570fe84d8b4827 d166fe8be045b70f 4b894878438966e8 ffffb9000c297650 : nt!KiPageFault+0x2ff ffffb9000c297580 fffff8004ae05dff : 4928478b4de43345 04fae8cf8b48d58b 8bd08b244f8b0000 ffffb9000c2977e0 : nt!KiPageFault+0x2ff ffffb9000c297710 fffff8004ae05dff : f366e8ce8b495677 8b50245c8b480006 8b486024748b48c6 ffffb9000c297970 : nt!KiPageFault+0x2ff ffffb9000c2978a0 fffff8004ae05dff : b848000000a024bc fffff78000000320 48f18b41ffcb8348 ffffb9000c297b00 : nt!KiPageFault+0x2ff ffffb9000c297a30 fffff8004ae05dff : 25e8ff91061ae8ce 02e0878d48ff90de b90e75e83b480000 ffffb9000c297c90 : nt!KiPageFault+0x2ff ffffb9000c297bc0 fffff8004ae05dff : 0000b48e0f386b39 458d60247c8b4800 00a88f0f40433b10 ffffb9000c297e20 : nt!KiPageFault+0x2ff ffffb9000c297d50 0000000000000000 : 0000000300000064 0000000000000000 0000000000000000 00000000`00000000 : nt!KiPageFault+0x2ff


SYMBOL_NAME: nt!KiDoubleFaultAbort+2c3

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

STACK_COMMAND: .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET: 2c3

FAILURE_BUCKET_ID: 0x7f_8_nt!KiDoubleFaultAbort

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {d1f8395a-8c58-45da-6ebf-e8bb4aad2fc5}

Followup: MachineOwner
 
Solution
if you are still having issues:
1) disconnect all un needed usb devices, then go into windows control panel device manager, find the menu item to show hidden devices. then look at the list and remove the software for any greyed out device.

  1. set your system to run in high performance mode
  2. set your memory dump type to kernel memory dump
  3. go into virtual memory setting and turn off the virtual memory
  4. boot into bios and update or reset the bios to defaults or just change any setting and change it back and save.
  5. boot and turn and turn virtual memory back on to create a new pagefile.sys
now at the next bugcheck provide the kernel memory dump
c:\windows\memory.dmp file

I looked at two memory dumps. one was a watchdog...
Amazing how talented you guys are at finding these issues out. You're like detectives following the clues. Upon this info you discovered coupled with Colif's link to the anticheat page, I uninstalled/reinstalled anticheat service, and did some research to finally figure out how to fix 2022-06 Cumulative Update for Windows 10 Version 21H2 for x64-based Systems (KB5014699) which always came back with an error and wouldnt update my windows (anticheat link and troubleshooting page listed an oudated window service as a possible cause to anticheat glitching out).

Unsettling to observe your distaste for the ongoing USB issues (appears to be quite an issue, judging by your statement). Hopefully some of the changes made will have some positive influence. I am just so grateful for your help. Also, I don't bitcoin mine (as per your statement about miner infection), but maybe there is some built in miner or bug I got from the anticheat, if that is even possible. I play apex at a high rank and play in some private tournaments, and my game crashes about 3 times a day, which is atypical of all players and streamers I play with, which leads me to believe my issue is somehow related to the anticheat issues we've found here, as I've troubleshooted and done every other repair offered from the apex team and public community.
I do like the speed of the usb system now that it run thru the pci/e bus
but there are a lot of bad drivers that can really mess things up.
look at your system 2 usb logging events averaged 3300 event logs per second over the boot time of your system something like 42 hours)
this caused the event recording system to be the # 6 top consumer of non paged pool in your system. non paged pool is a limited resource. It is memory shared and recycled to device drivers. it does work but it is a shared resource and why should your graphics card have to wait to use the bus because of a stupid usb driver.
 
  • Like
Reactions: ThisIsPaul

Colif

Win 11 Master
Moderator
I uninstalled/reinstalled anticheat service, and did some research to finally figure out how to fix 2022-06 Cumulative Update for Windows 10 Version 21H2 for x64-based Systems (KB5014699) which always came back with an error and wouldnt update my windows (anticheat link and troubleshooting page listed an oudated window service as a possible cause to anticheat glitching out).
Is update working now?
One way that could fix it is a repair install of windows. All it does is replaces windows files, doesn't touch anything else.
https://www.tenforums.com/tutorials/16397-repair-install-windows-10-place-upgrade.html
 

ThisIsPaul

Prominent
Oct 17, 2021
38
0
530
I do like the speed of the usb system now that it run thru the pci/e bus
but there are a lot of bad drivers that can really mess things up.
look at your system 2 usb logging events averaged 3300 event logs per second over the boot time of your system something like 42 hours)
this caused the event recording system to be the # 6 top consumer of non paged pool in your system. non paged pool is a limited resource. It is memory shared and recycled to device drivers. it does work but it is a shared resource and why should your graphics card have to wait to use the bus because of a stupid usb driver.

I guess what I don't get is why my set up specifically is having so many issues with usb/page memory you mentioned. I feel like I have a pretty generic set up/PC parts.
 
I guess what I don't get is why my set up specifically is having so many issues with usb/page memory you mentioned. I feel like I have a pretty generic set up/PC parts.
it is not just your machine, we start looking for the cause of a failure, we start looking at anything that does not look right or seems wrong as compared to other machines. There have been a lot of USB problems lately since microsoft has enabled more sleep states to save power. Various countries have made it a requirement to save energy on PC by making systems go into low power states.
 

ThisIsPaul

Prominent
Oct 17, 2021
38
0
530
it is not just your machine, we start looking for the cause of a failure, we start looking at anything that does not look right or seems wrong as compared to other machines. There have been a lot of USB problems lately since microsoft has enabled more sleep states to save power. Various countries have made it a requirement to save energy on PC by making systems go into low power states.

I guess I just got bad luck with this build then. Have a couple friends who recently built from cyberpower and they havent had a single bugcheck yet (I always ask them haha). Well it had been a week or a little more since the last bugcheck, so the changes we've made definitely seem to be helping. Less game crashes too, but I just got another bugcheck sometime early morning when I was asleep. Here it is:

https://www.dropbox.com/s/vr6m3kreielbqkl/kernel dump 7-15-2022.zip?dl=0
 
last kernel memory dump showed a 0x124 bugcheck called from a 32bit subsystem. the cpu reported a internal timer error (inside the cpu)

the kernel dump does not include the data for the subsystem you would have to have a full memory dump in this case. I did look at the address of the game and it did not match the address of the usermode call that ended with a non maskable interrupt. the debugger reported several modified files in the subsystem
including the subsystem kernel, the subsystem pci bus driver and the subsystem filesystem driver, and a base windows usermode core file.
it could just be some apps making changes to hook into the subsystem but I don't know why they would modify the filesystem driver.

in the dump something strange was going on with the main system process as it was using a lot of virtual memory. game was running and using 5.6gb memory.
funny that most of the system looked like it was idle. could just be that the processor got messed up and everything stopped running before the crash.

I guess I would remove all of the add on tools to see if your game still crashes. i would delete the pagefile.sys to get back into a clean state. If you do have malware working its way in thru the 32bit subsystem then each time you delete the pagefile.sys it has to start over worming its way into your system. you might google how to clear the windows pagefile on reboot and do it automatically.
 
Last edited:

ThisIsPaul

Prominent
Oct 17, 2021
38
0
530
last kernel memory dump showed a 0x124 bugcheck called from a 32bit subsystem. the cpu reported a internal timer error (inside the cpu)

the kernel dump does not include the data for the subsystem you would have to have a full memory dump in this case. I did look at the address of the game and it did not match the address of the usermode call that ended with a non maskable interrupt. the debugger reported several modified files in the subsystem
including the subsystem kernel, the subsystem pci bus driver and the subsystem filesystem driver, and a base windows usermode core file.
it could just be some apps making changes to hook into the subsystem but I don't know why they would modify the filesystem driver.

in the dump something strange was going on with the main system process as it was using a lot of virtual memory. game was running and using 5.6gb memory.
funny that most of the system looked like it was idle. could just be that the processor got messed up and everything stopped running before the crash.

I guess I would remove all of the add on tools to see if your game still crashes. i would delete the pagefile.sys to get back into a clean state. If you do have malware working its way in thru the 32bit subsystem then each time you delete the pagefile.sys it has to start over worming its way into your system. you might google how to clear the windows pagefile on reboot and do it automatically.

Thanks a lot. Guess I will have to delete pagefile.sys yet again. Do you think it could be Malware? I litearlly just did a clean wipe and re install a month or so back (EDIT: I chose the clean wipe of everything, except for saved passwords and pictures), and I never look at porn or any kind of weird websites on this PC. So strange that it seems a game is always running, but these last few bugchecks, my PC has been idle as you observed, and I never have any games open, just a couple streams on my Edge browsers, and of course Discord/Steam is always running. Also should I switch my kernel dumps over to full memory dumps then? I don't see full memory dump as a subset of options within kernel dumps.
 
Last edited:
Thanks a lot. Guess I will have to delete pagefile.sys yet again. Do you think it could be Malware? I litearlly just did a clean wipe and re install a month or so back (EDIT: I chose the clean wipe of everything, except for saved passwords and pictures), and I never look at porn or any kind of weird websites on this PC. So strange that it seems a game is always running, but these last few bugchecks, my PC has been idle as you observed, and I never have any games open, just a couple streams on my Edge browsers, and of course Discord/Steam is always running. Also should I switch my kernel dumps over to full memory dumps then? I don't see full memory dump as a subset of options within kernel dumps.
Thanks a lot. Guess I will have to delete pagefile.sys yet again. Do you think it could be Malware? I litearlly just did a clean wipe and re install a month or so back (EDIT: I chose the clean wipe of everything, except for saved passwords and pictures), and I never look at porn or any kind of weird websites on this PC. So strange that it seems a game is always running, but these last few bugchecks, my PC has been idle as you observed, and I never have any games open, just a couple streams on my Edge browsers, and of course Discord/Steam is always running. Also should I switch my kernel dumps over to full memory dumps then? I don't see full memory dump as a subset of options within kernel dumps.
I would look at the task list after you exit the game and see if it still indicates that the game is running.
if i remember each time I look it shows the game still using 5.6 GB ram when you indicated it was not running. I would be looking for some coin mining tool running or terminate the thread or use a tool to see what it is doing. Maybe it was just hung on clean up? or was it taking up actual cpu cycles processing something.
 

ThisIsPaul

Prominent
Oct 17, 2021
38
0
530
I would look at the task list after you exit the game and see if it still indicates that the game is running.
if i remember each time I look it shows the game still using 5.6 GB ram when you indicated it was not running. I would be looking for some coin mining tool running or terminate the thread or use a tool to see what it is doing. Maybe it was just hung on clean up? or was it taking up actual cpu cycles processing something.

I'll keep checking task to see if it persists. I've done that a few times before and never saw anything but maybe it just getshung up now and then. Also if there was a mining tool/worm mining I would see a noticeable usage in RAM/Processor/GPU usage that is abnormal right? I've been monitoring it all since Friday and haven't seen any anomalies so far.
 

ThisIsPaul

Prominent
Oct 17, 2021
38
0
530
I would look at the task list after you exit the game and see if it still indicates that the game is running.
if i remember each time I look it shows the game still using 5.6 GB ram when you indicated it was not running. I would be looking for some coin mining tool running or terminate the thread or use a tool to see what it is doing. Maybe it was just hung on clean up? or was it taking up actual cpu cycles processing something.

Was going strong for just over a month, and then in the last two days I got a couple freezes (not bugchecks, just like the hummmm/buzzzz sound from my speakers and I couldnt turn my monitor back on as it said a source couldnt be found). Had to force restart, and no bug check came up in dump or windbg. Then today I got a page fault in nonpaged area error. Since you last requested a full dump not just a minidump, I change dmy settings to include a full dump, so here is the link (please let me know if it is the dump you need):

https://www.dropbox.com/s/0e8rn3xs67mhdf2/8-27 1218am dump.zip?dl=0
 

ThisIsPaul

Prominent
Oct 17, 2021
38
0
530
you have actually uploaded a shortcut. the total size of the file is 1kb
Try uploading the actual dump :)

John may not be back, he is busy. I see what I can find in dump for you - once you upload it :)

Ahh hopefully he is doing well. He really went above and beyond with analysis. Very grateful for both of your help. Here is the link. Wow she's a biggun, almost 40gb:

https://www.dropbox.com/s/xpmktxhzlv36ssr/MEMORY.DMP?dl=0
 

Colif

Win 11 Master
Moderator
That will take me an hour to download, its 2.15am here... I will do it tomorrow once I wake up, unless you can manage to create a minidump instead.
I don't understand dumps as well as John does, but I do my best.

Unless you really lucky and John replies tonight,
Can you follow option one on the following link - here - and then do this step below: Small memory dumps - Have Windows Create a Small Memory Dump (Minidump) on BSOD - that creates a file in c windows/minidump after the next BSOD

40kb minidump so much easier to deal with compared to 40gb :)
 
Last edited:
  • Like
Reactions: ThisIsPaul

ThisIsPaul

Prominent
Oct 17, 2021
38
0
530
That will take me an hour to download, its 2.15am here... I will do it tomorrow once I wake up, unless you can manage to create a minidump instead.
I don't understand dumps as well as John does, but I do my best.

Unless you really lucky and John replies tonight,
Can you follow option one on the following link - here - and then do this step below: Small memory dumps - Have Windows Create a Small Memory Dump (Minidump) on BSOD - that creates a file in c windows/minidump after the next BSOD

40kb minidump so much easier to deal with compared to 40gb :)

Thank you again. I did a full dump because he said the part he needed to see couldn't be revealed in the minidump and said a full dump would show the issue. I can revert it back to a minidump for the next bugcheck though if that helps. Thank you again and get a nice night's sleep : )