[SOLVED] Please help identify BSOD cause

[punnjakiis]

Hello,

So I recently bought a new PC, and from the very first windows installation I have experienced constant BSOD's. The first time I took the PC back and they had switched out the RAM, this however did not stop the BSOD's. Second time I took it back, they updated the realtek audio drivers, from what I could tell, and that seemed to stop the BSOD's for about a day. However since yesterday night the BSOD's are back. They seem to happen whenever e.g gaming, browsing internet or just PC being idle.

BlueScreenView and Whocrashed both show different error codes and suspected drivers each time

the system is win 10 64bit
16gb ram
b450 gigabyte gaming MB
1660 gtx
Ryzen 3500x

Can anyone please help me identify what the issue could be before I return this back and try to get my money back for good.

Thank you, and let me know what more can I provide for identification

edit: a few more anomalies:

1. Yesterday when performing SFC the PC did 4 beeps and the screen turned black for a moment
2. Getting Aw Snap error in google chrome when just looking at a page
3. Sometimes PC just freezes without the BSOD

 

[Colif]

1. can you go to C:/windows/minidump
2. copy the files from here to another folder
3. upload copies from new folder to a file sharing website
4. show link here

where are all these 3500x coming from...

do you have latest bios on the motherboard?
F60C - https://www.gigabyte.com/Motherboard/B450M-GAMING-rev-10/support#support-dl-bios

what are full specs? what storage? what PSU?

The first time I took the PC back and they had switched out the RAM, this however did not stop the BSOD's. Second time I took it back, they updated the realtek audio drivers, from what I could tell, and that seemed to stop the BSOD's for about a day. However since yesterday night the BSOD's are back.

3 strikes they are out? Sounds like I would ask for another PC. They should hold onto it until it works.

 

[punnjakiis]

500gb kingston a2000 ssd
550w corsair bronze i think
ram is 8x2 gskill 3200mhz
bios is already on 60c

just ran memory diagnostics it also came back with no problems

 

[Colif]

i am not sure if this has any tests in it - https://www.kingston.com/en/support/technical/ssdmanager

the minidump files may tell us more if you can upload them. It will at least show me what drivers are running.

 

[punnjakiis]

the manager shoes all's healthy

minidump: https://1drv.ms/u/s!AhUtcCsiXZUAhDoEcrkx9ugijWbX?e=4UxBFG

 

[Colif]

I will ask someone to convert dumps although he is asleep now.

 

[punnjakiis]

thank you very much!

 

[johnbl]

seeing a rash (3 out of the last 5 memory dumps i looked at yesterday and today) of these bugchecks all from the same CPU series
AMD64 Family 23 Model 113 Stepping 0

You are the only one who had the most current bios patch. the bugcheck occured when a driver attempted to disable something too many times.
this ended in the count going to a -1 value which windows called a bugcheck for. You would have to provide a kernel memory dump in order to get a chance to see what was causing this problem. the debugger only shows what was running on the active core at the time of the bugcheck and you were running
WhoCrashedEx.exe
when the system crashed (made me laugh since it was so ironic)

for debugging set the memory dump type to kernel, reboot and wait for the next crash and provide the memory.dmp file
and I will see if i can find out what was going on with the other cpu cores at the time of the crash.

you might also try to avoid the crash by going into bios and turning off special functions of the cpu like some of the sleep functions.
(or go into control panel power management and set the machine to run in a high performance mode)
you might also go to the motherboard vendors website and update any custom drivers. They would contain "fixes" for known bugs in the chipset and various AMD cpu versions.

I will look at the drivers listed in the debugger for anything useful.
edit: looks like you have only the generic microsoft provided drivers. These will not have fixes for known problems with just your motherboard. (you would have to get the fixes from the motherboard vendors website)
-two other systems I looked at yesterday also only had the microsoft generic drivers installed.

note: I will look at your other bugchecks to see if one happened to catch a active core that caused the problem.
second bugcheck was due to a stack overflow in the graphics subsystem.
the debugger does not like some of your microsoft core system files.
you should start cmd.exe as an admin and run
DISM.exe /Online /Cleanup-Image /Restorehealth
DISM.exe /Online /Cleanup-Image /Restorehealth Explained (itechguides.com)
then reboot.

--------
third bugcheck was in windows winsock provider code (network code)
while you were running
qbittorrent.exe
generally you would look to update your network driver for this error:
most likely this driver:
\SystemRoot\System32\drivers\rt640x64.sys Mon Nov 18 01:14:08 2019
look for a update on your motherboard vendors website.
------------
forth bugcheck was in the windows desktop manager.
looks like a malware infection the code that was running outside of kernel drivers like it was injected and ran.
I would guess your system has malware on it.
you should run the dism.exe command, turn off virtual memory to delete your pagefile.sys, run a malware scan
and check your task scheduler for 3rd party tasks running (often every 15 minutes)
then reboot and turn your virtual memory back on to get a new clean pagefile.sys
-------
last bugcheck was in the system windows kernel driver while running
qbittorrent.exe
the system was up for only 32 seconds, you need to make sure this tool is not set to run on start up.
if you want to use it make sure it gets turned off after each use.
the debugger thinks your afd.sys is bogus. the dism.exe command should fix the binaries.
be sure to change the default settings on your app so it does not share files and make sure it does not start when the system starts.










2: kd> !SYSINFO machineid
Machine ID Information [From Smbios 3.3, DMIVersion 0, Size=2382]
BiosMajorRelease = 5
BiosMinorRelease = 17
BiosVendor = American Megatrends Inc.
BiosVersion = F60c
BiosReleaseDate = 10/29/2020
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = B450M GAMING
SystemFamily = Default string
SystemVersion = Default string
SystemSKU = Default string
BaseBoardManufacturer = Gigabyte Technology Co., Ltd.
BaseBoardProduct = B450M GAMING
BaseBoardVersion = x.x
2: kd> !SYSINFO cpuinfo
[CPU Information]
~MHz = REG_DWORD 3593
Component Information = REG_BINARY 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
Configuration Data = REG_FULL_RESOURCE_DESCRIPTOR ff,ff,ff,ff,ff,ff,ff,ff,0,0,0,0,0,0,0,0
Identifier = REG_SZ AMD64 Family 23 Model 113 Stepping 0
ProcessorNameString = REG_SZ AMD Ryzen 5 3500X 6-Core Processor
Update Status = REG_DWORD 1
VendorIdentifier = REG_SZ AuthenticAMD
2: kd> !sysinfo cpumicrocode
sysinfo: unknown error 80004005
2: kd> !sysinfo gbl
[ACPI Good Bios List]

[MCFG - 1195787085 bytes]
AcpiOemID="MCFG","MCFG<"
AcpiOemTableId="MCFG","MCFG<"
AcpiOemRevision=">=","MCFG",1195787085
AcpiRevision=">=","MCFG",77
AcpiCreatorRevision=">=","MCFG",1195787085

 

[punnjakiis]

1. Where can I find the kernel memory dump?
2. Do you think WhoCrashed might also contribute to the error?
3. (I assume this ties in to the first question) How do I switch the memory dump type to kernel.
4. I believe I already downloaded the chipset driver from the MB vendors website:

https://www.gigabyte.com/Motherboard/B450M-GAMING-rev-10/support#support-dl-driver-chipset

However i see two types the AMD APU and AMD Chipset, should I try both because I think I haven't tried the APU.

5. In CMD do I run both these commands subsequentialy (confused of the Explained (itechguides.com one)

 

[punnjakiis]

Okay the APU installation failed since there isn't an integrated gpu on the cpu, what other drivers should I try to download from that website?
Disregard my fifth question i realized it was just a link.

 

[johnbl]

1. Where can I find the kernel memory dump?
2. Do you think WhoCrashed might also contribute to the error?
3. (I assume this ties in to the first question) How do I switch the memory dump type to kernel.
4. I believe I already downloaded the chipset driver from the MB vendors website:

https://www.gigabyte.com/Motherboard/B450M-GAMING-rev-10/support#support-dl-driver-chipset

However i see two types the AMD APU and AMD Chipset, should I try both because I think I haven't tried the APU.

5. In CMD do I run both these commands subsequentialy (confused of the Explained (itechguides.com one)

kernel memory dumps are stored in a file at c:\windows\memory.dmp
you have to turn these on since they are normally set to minidumps by default.
best to google "how to enable windows kernel memory dump" to see a video or find instructions.

whocrashed.exe did not cause this problem, it was just bad luck that you were running it at the time of the crash.

from the sequence of memory dumps i would guess you got infected with malware/virus and with each crash of the system the malware was able to infect other components.

the exact order you run the various commands should not matter much.
the main point it to repair the files with a known good copy (dism.exe command)
delete the pagefile.sys since malware could hide in the pagefile.sys (windows virtual memory)
then hunt for what is installing the malware. often malware will run on start up (disable the torrent software that was starting at startup)
and often malware will put itself to run every 15 minutes in the windows task scheduler.

you will want to run a virus scan/malware scan

I would even reflash your bios with a new copy of the current bios just because some malware can hide in the bios.

I can look a kernel memory dump but if you have modified windows core files then the various commands in the debugger will refuse to run.
even if it does run you can not always trust the results.

 

[punnjakiis]

Hey so I did all the steps but no dice unfortunately. the DISM did not seem to fix anything or atleast give no indication.
https://1drv.ms/u/s!AhUtcCsiXZUAhDyVlSO6DD1gFLck?e=dOYoQY

I siwtched the memory dump type to kernel and here are the new files, if you could have another look I would be extremely thankful!

 

[johnbl]

Hey so I did all the steps but no dice unfortunately. the DISM did not seem to fix anything or atleast give no indication.
https://1drv.ms/u/s!AhUtcCsiXZUAhDyVlSO6DD1gFLck?e=dOYoQY

I siwtched the memory dump type to kernel and here are the new files, if you could have another look I would be extremely thankful!

the video tried to set up a task, and over ran a kernel stack and windows assumed it was an attack on the system and shut the system down.
the system was up for only 1 minute and 19 seconds.

overall i would suspect you have malware, several files have been modified and it looks like stuff is hiding from the debugger
( is paged out to the pagefile.sys)
looks like something is using a lot of the shared kernel memory
one is the windows event system is using a huge amount
another has a pool tag of NVRM maybe a nvidia driver.


you should start event viewer and see if the system is just dumping out a huge number of errors to the logs.

guess you have malware maybe a bitcoin miner software running on the video ?. have you made a new clean install already?
the system was up for such a short time. l will it boot in to safe mode?
I have to run for a few hours but will leave the memory dump in the debugger for when I get back.

 

[punnjakiis]

So the event viewer gives error logs regarding something called slui.exe. happens like 5x before the BSOD

License Activation (slui.exe) failed with the following error code:
hr=0x803F7001
Command-line arguments:
RuleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2b1f36bb-c1cd-4306-bf5c-a0367c2d97d8;NotificationInterval=1440;Trigger=NetworkAvailable


By running on the video you mean on the video card and by new clean install you mean new drivers?

 

[johnbl]

So the event viewer gives error logs regarding something called slui.exe. happens like 5x before the BSOD

License Activation (slui.exe) failed with the following error code:
hr=0x803F7001
Command-line arguments:
RuleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2b1f36bb-c1cd-4306-bf5c-a0367c2d97d8;NotificationInterval=1440;Trigger=NetworkAvailable


By running on the video you mean on the video card and by new clean install you mean new drivers?

Well one side effect of running the dism.exe /online command is that it repairs files with known good files.
this will remove a lot of the license activation hacks and then the process that checks to see if you have a proper activation will hit the microsoft servers and the servers will tell the software that the key is invalid.

your system has a lot of problems, it is running key activation program, something is loading into the GPU, the windows event system is eating up the windows driver kernel space, some windows core files are modified (less than before)

on another machine you should download a new copy of windows and set up a windows install drive and just reinstall windows on your machine. Download Windows 10 (microsoft.com) create windows 10 installation media and download the build and select that you will enter the key later. if you have a valid key associated with the actual machine windows should activate. if you have a valid key associated with your microsoft account, it should activate. if you have a pirate key then it will be rejected since the keys are sold over and over to different people, most do not find out they have a pirate key until a major windows update, often the system will block the updates so it can continue to fake activation.

overall, your best bet is to reinstall from a clean windows install image.
----------
from looking at the various dumps you provided it just looked like malware working deeper into your system with each bugcheck you provided. Now i just see it running code that is not associated with any file.
best to wipe and start over with a clean install from a known good source.

 

[johnbl]

Well one side effect of running the dism.exe /online command is that it repairs files with known good files.
this will remove a lot of the license activation hacks and then the process that checks to see if you have a proper activation will hit the microsoft servers and the servers will tell the software that the key is invalid.

your system has a lot of problems, it is running key activation program, something is loading into the GPU, the windows event system is eating up the windows driver kernel space, some windows core files are modified (less than before)

on another machine you should download a new copy of windows and set up a windows install drive and just reinstall windows on your machine. Download Windows 10 (microsoft.com) create windows 10 installation media and download the build and select that you will enter the key later. if you have a valid key associated with the actual machine windows should activate. if you have a valid key associated with your microsoft account, it should activate. if you have a pirate key then it will be rejected since the keys are sold over and over to different people, most do not find out they have a pirate key until a major windows update, often the system will block the updates so it can continue to fake activation.

overall, your best bet is to reinstall from a clean windows install image.
----------
from looking at the various dumps you provided it just looked like malware working deeper into your system with each bugcheck you provided. Now i just see it running code that is not associated with any file.
best to wipe and start over with a clean install from a known good source.

try installing this update directly from AMD if you are still having problems.
AMD Drivers and Support for Radeon, Radeon Pro, FirePro, APU, CPU, Ryzen, desktops, laptops
select your actual processor:
processors->AMD ryzen Processors->AMD ryzen 5 desktop Processor-> then select your cpu.