[SOLVED] Random BSOD on Windows 10

[Rohtash]

My Laptop crashes randomly with BSOD.

I have installed Fresh copy of Windows 10 and also formatted my second drive.

Have Lenovo Legion Y520-15IKBN Laptop
8 GB inbuilt RAM and have recently ( 15 days) installed 16GB additional RAM.
128 GB SSD + 2 TB SATA drive.

Just a little history, the power button of my laptop was broken hence my motherboard got replaced and since then having this BSOD ( its been more than 5 months now)
Sometimes it doesn't crash for hours or couple of days and sometimes it crashes multiple times within 3-4 hours of use.


Ran cystaldiskinfo : Both drives shows as 100% healthy
Ran Autoruns : No older file
have updated the windows with latest patches.

Bluescreenview for mini dump shows 3 different errors for each BSOD

1. Critical Process Died: ntoskrnl.exe - most recent one
2. Bad_Pool_ Caller: iaStorAVC.sys --- For this I have installed IRST latest driver after google
3. Bad_Pool_caller : storport.sys -

Below is the Complete memory dump :
FAULT_INSTR_CODE: 871c8b44
SYMBOL_STACK_INDEX: a
SYMBOL_NAME: ntdll!RtlLookupFunctionEntry+82
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ntdll
IMAGE_NAME: ntdll.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 0
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 82
FAILURE_BUCKET_ID: 0xEF_svchost.exe_BUGCHECK_CRITICAL_PROCESS_d99c1080_ntdll!RtlLookupFunctionEntry
BUCKET_ID: 0xEF_svchost.exe_BUGCHECK_CRITICAL_PROCESS_d99c1080_ntdll!RtlLookupFunctionEntry
PRIMARY_PROBLEM_CLASS: 0xEF_svchost.exe_BUGCHECK_CRITICAL_PROCESS_d99c1080_ntdll!RtlLookupFunctionEntry
TARGET_TIME: 2019-09-07T16:12:32.000Z
OSBUILD: 18362
OSSERVICEPACK: 0
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 784
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS Personal
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1998-05-31 02:42:57
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: f1a3
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0xef_svchost.exe_bugcheck_critical_process_d99c1080_ntdll!rtllookupfunctionentry
FAILURE_ID_HASH: {ca541670-3ad3-464e-ebc4-f7460d4b3d63}

Any suggestions should I do next .

 

[Rohtash]

I also have a little confusion with driver version.
The drivers available on Lenovo website are of Microsoft and of the year 2017 & 2018.
I ran drivereasy tool and it showed that 19 drivers ( microsoft, Intel) are outdated and they are for the year 2019.

SO unable to decide whether to install those drivers or install whatever have on Lenovo website.

 

[Colif]

Can you follow option one on the following link - here - and then do this step below: Small memory dumps - Have Windows Create a Small Memory Dump (Minidump) on BSOD - that creates a file in c windows/minidump after the next BSOD

copy that file to documents

upload the copy from documents to a file sharing web site, and share the link in your thread so we can help fix the problem

Don't use driver easy

 

[Rohtash]

Can you follow option one on the following link - here - and then do this step below: Small memory dumps - Have Windows Create a Small Memory Dump (Minidump) on BSOD - that creates a file in c windows/minidump after the next BSOD

copy that file to documents

upload the copy from documents to a file sharing web site, and share the link in your thread so we can help fix the problem

Don't use driver easy

Here is the minidump content:


Microsoft (R) Windows Debugger Version 10.0.18362.1 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\minidump\091419-266843-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

* Path validation summary **
Response Time (ms) Location
Deferred srv*https://msdl.microsoft.com/download/symbols
Symbol search path is: srv*https://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 10 Kernel Version 18362 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 18362.1.amd64fre.19h1_release.190318-1202
Machine Name:
Kernel base = 0xfffff80426e00000 PsLoadedModuleList = 0xfffff804272475b0
Debug session time: Sat Sep 14 23:47:35.463 2019 (UTC + 5:30)
System Uptime: 0 days 0:16:14.312
Loading Kernel Symbols
.
Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.
..............................................................
................................................................
................................................................
..................
Loading User Symbols
Loading unloaded module list
.........
For analysis of this file, run !analyze -v
1: kd> !analyze -v
***

• *
• Bugcheck Analysis *
• *

***
CRITICAL_PROCESS_DIED (ef)
A critical system process died
Arguments:
Arg1: ffff9a84a4d47080, Process object or thread object
Arg2: 0000000000000000, If this is 0, a process died. If this is 1, a thread died.
Arg3: 0000000000000000
Arg4: 0000000000000000
Debugging Details:
------------------

KEY_VALUES_STRING: 1

PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1

DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
SYSTEM_MANUFACTURER: LENOVO
SYSTEM_PRODUCT_NAME: 80WK
SYSTEM_SKU: LENOVO_MT_80WK_BU_idea_FM_
SYSTEM_VERSION: Lenovo Y520-15IKBN
BIOS_VENDOR: LENOVO
BIOS_VERSION: 4KCN45WW
BIOS_DATE: 01/11/2019
BASEBOARD_MANUFACTURER: LENOVO
BASEBOARD_PRODUCT: Provence-5R1
BASEBOARD_VERSION: SDK0J40688 WIN
DUMP_TYPE: 2
BUGCHECK_P1: ffff9a84a4d47080
BUGCHECK_P2: 0
BUGCHECK_P3: 0
BUGCHECK_P4: 0
PROCESS_NAME: svchost.exe
CRITICAL_PROCESS: svchost.exe
EXCEPTION_CODE: (HRESULT) 0xa50c3080 (2769039488) - <Unable to get error code text>
ERROR_CODE: (NTSTATUS) 0xa50c3080 - <Unable to get error code text>
CPU_COUNT: 4
CPU_MHZ: 9c0
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 9e
CPU_STEPPING: 9
CPU_MICROCODE: 6,9e,9,0 (F,M,S,R) SIG: 8E'00000000 (cache) 8E'00000000 (init)
BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0xEF
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: ROHTASH
ANALYSIS_SESSION_TIME: 09-18-2019 00:08:01.0654
ANALYSIS_VERSION: 10.0.18362.1 x86fre
LAST_CONTROL_TRANSFER: from fffff804276ca0e9 to fffff80426fc10a0
STACK_TEXT:
ffff8380446c1838 fffff804276ca0e9 : 00000000000000ef ffff9a84a4d47080 0000000000000000 0000000000000000 : nt!KeBugCheckEx
ffff8380446c1840 fffff804275c5547 : ffff9a84a4d47080 fffff80426e9c8f9 ffff9a84a4d47080 fffff80426e9ca50 : nt!PspCatchCriticalBreak+0x115
ffff8380446c18e0 fffff804274380f0 : ffff9a8400000000 0000000000000000 ffff9a84a4d47080 ffff9a84a4d47080 : nt!PspTerminateAllThreads+0x1755e3
ffff8380446c1950 fffff80427437ed9 : ffffffffffffffff ffff8380446c1a80 ffff9a84a4d47080 000001ef4c9a0001 : nt!PspTerminateProcess+0xe0
ffff8380446c1990 fffff80426fd2915 : ffff9a8400000240 ffff9a84a50c3080 ffff9a84a4d47080 00000072985ff53c : nt!NtTerminateProcess+0xa9
ffff8380446c1a00 00007ff96781c654 : 00007ff96788fc5f 00007ff9678bf980 00000072985ff500 0000000000000005 : nt!KiSystemServiceCopyEnd+0x25
00000072985fbbe8 00007ff96788fc5f : 00007ff9678bf980 00000072985ff500 0000000000000005 000001ef4e21c950 : 0x00007ff96781c654 00000072985fbbf0 00007ff9678bf980 : 00000072985ff500 0000000000000005 000001ef4e21c950 0000000000000004 : 0x00007ff96788fc5f
00000072985fbbf8 00000072985ff500 : 0000000000000005 000001ef4e21c950 0000000000000004 00007ff967823cdd : 0x00007ff9678bf980 00000072985fbc00 0000000000000005 : 000001ef4e21c950 0000000000000004 00007ff967823cdd 00007ff9678bf980 : 0x00000072985ff500
00000072985fbc08 000001ef4e21c950 : 0000000000000004 00007ff967823cdd 00007ff9678bf980 0000000000000008 : 0x5
00000072985fbc10 0000000000000004 : 00007ff967823cdd 00007ff9678bf980 0000000000000008 0000000008000000 : 0x000001ef4e21c950 00000072985fbc18 00007ff967823cdd : 00007ff9678bf980 0000000000000008 0000000008000000 0000000000000000 : 0x4 00000072985fbc20 00007ff9678bf980 : 0000000000000008 0000000008000000 0000000000000000 000001ef4c960100 : 0x00007ff967823cdd
00000072985fbc28 0000000000000008 : 0000000008000000 0000000000000000 000001ef4c960100 000001ef4da01640 : 0x00007ff9678bf980 00000072985fbc30 0000000008000000 : 0000000000000000 000001ef4c960100 000001ef4da01640 00000000000341c2 : 0x8 00000072985fbc38 0000000000000000 : 000001ef4c960100 000001ef4da01640 00000000000341c2 00007ff96780c6e6 : 0x8000000 THREAD_SHA1_HASH_MOD_FUNC: 042a2b51772309c39e12d732cc93cacf0af3064e THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 809303cb96541219c07d973d10f33ae73e7db422 THREAD_SHA1_HASH_MOD: ee8fcf1fb60cb6e3e2f60ddbed2ec02b5748a693 FOLLOWUP_IP: nt!PspCatchCriticalBreak+115 fffff804276ca0e9 cc int 3
FAULT_INSTR_CODE: ed8440cc
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!PspCatchCriticalBreak+115
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 0
IMAGE_VERSION: 10.0.18362.356
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 115
FAILURE_BUCKET_ID: 0xEF_svchost.exe_BUGCHECK_CRITICAL_PROCESS_a50c3080_nt!PspCatchCriticalBreak
BUCKET_ID: 0xEF_svchost.exe_BUGCHECK_CRITICAL_PROCESS_a50c3080_nt!PspCatchCriticalBreak
PRIMARY_PROBLEM_CLASS: 0xEF_svchost.exe_BUGCHECK_CRITICAL_PROCESS_a50c3080_nt!PspCatchCriticalBreak
TARGET_TIME: 2019-09-14T18:17:35.000Z
OSBUILD: 18362
OSSERVICEPACK: 356
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 784
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS Personal
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: unknown_date
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 4c16
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0xef_svchost.exe_bugcheck_critical_process_a50c3080_nt!pspcatchcriticalbreak
FAILURE_ID_HASH: {bf6ee0e1-b76b-67f5-62e8-7aa1b868cf63}
Followup: MachineOwner
---------

 

[Colif]

if you can upload the minidump to a file sharing website, I will get a friend to look at it. The dumps can show more than what you are currently seeing, even though both conversions use the windows debugger. I can see what drivers were running at time

I can't say I have seen service host crash before,,ALthough it is going to be fun working out which process as every process has a service host of its own.

Try running this
right click start button
choose powershell (admin)
type SFC /scannow and press enter
once its completed, copy/paste this command into same window:
Repair-WindowsImage -Online -RestoreHealth and press enter
SFC fixes system files, second command cleans image files, re run SFC if it failed to fix all files and restart PC

 

[Rohtash]

if you can upload the minidump to a file sharing website, I will get a friend to look at it. The dumps can show more than what you are currently seeing, even though both conversions use the windows debugger. I can see what drivers were running at time

I can't say I have seen service host crash before,,ALthough it is going to be fun working out which process as every process has a service host of its own.

Try running this
right click start button
choose powershell (admin)
type SFC /scannow and press enter
once its completed, copy/paste this command into same window:
Repair-WindowsImage -Online -RestoreHealth and press enter
SFC fixes system files, second command cleans image files, re run SFC if it failed to fix all files and restart PC

Thanks Colif.

You can find the mini dump at below location

https://drive.google.com/open?id=1McUHU44A0PLK2vP-M2tfBe8tAk48GOiy

It has 2 dump files from different occurrences.

And I will try the steps what you have provided. SFC scan I have already done couple of times.

 

[gardenman]

Hi, I ran the dump files through the debugger and got the following information: https://pste.eu/p/YXzy.html

File information:	090719-229906-01.dmp (Sep 7 2019 - 12:12:32)
Bugcheck:	CRITICAL_PROCESS_DIED (EF)
Probably caused by:	memory_corruption (Process: svchost.exe)
Uptime:	0 Day(s), 0 Hour(s), 09 Min(s), and 19 Sec(s)

File information:	091419-266843-01.dmp (Sep 14 2019 - 14:17:35)
Bugcheck:	CRITICAL_PROCESS_DIED (EF)
Probably caused by:	ntkrnlmp.exe (Process: svchost.exe)
Uptime:	0 Day(s), 0 Hour(s), 16 Min(s), and 14 Sec(s)

Comment: 2 or more types of RAM are installed.

Possible System Support Page: https://pcsupport.lenovo.com/us/en/...-series/legion-y520-15ikbn/downloads/ds121057

This information can be used by others to help you. I can't help you with this. Someone else will post with more information. Please wait for additional answers. Good luck.

 

[Colif]

ram change was last 15 days, BSOD happened before it so it shouldn't be cause... did you make sure memory matched laptop before buying?

have you gone here and clicked Automatic driver update? https://pcsupport.lenovo.com/au/en/...y520-15ikbn/downloads/automatic-driver-update

as your chipset drivers are older than your bios and could be reason for errors. It helps if this is around same age

Jul 18 2017

TeeDriverW8x64.sys

Intel Management Engine Interface driver https://downloadcenter.intel.com/

as the bios, and although your bios is from 2019, the newest version of that on website is still 2018, but its newer than what you have.

 

[Rohtash]

Hi, I ran the dump files through the debugger and got the following information: https://pste.eu/p/YXzy.html

File information:	090719-229906-01.dmp (Sep 7 2019 - 12:12:32)
Bugcheck:	CRITICAL_PROCESS_DIED (EF)
Probably caused by:	memory_corruption (Process: svchost.exe)
Uptime:	0 Day(s), 0 Hour(s), 09 Min(s), and 19 Sec(s)

File information:	091419-266843-01.dmp (Sep 14 2019 - 14:17:35)
Bugcheck:	CRITICAL_PROCESS_DIED (EF)
Probably caused by:	ntkrnlmp.exe (Process: svchost.exe)
Uptime:	0 Day(s), 0 Hour(s), 16 Min(s), and 14 Sec(s)

Comment: 2 or more types of RAM are installed.

Possible System Support Page: https://pcsupport.lenovo.com/us/en/...-series/legion-y520-15ikbn/downloads/ds121057

This information can be used by others to help you. I can't help you with this. Someone else will post with more information. Please wait for additional answers. Good luck.

Thanks for your Analysis.
I have added a RAM of 16 GB recently. The BSODs are happening for few months now.

 

[Rohtash]

ram change was last 15 days, BSOD happened before it so it shouldn't be cause... did you make sure memory matched laptop before buying?

have you gone here and clicked Automatic driver update? https://pcsupport.lenovo.com/au/en/...y520-15ikbn/downloads/automatic-driver-update

as your chipset drivers are older than your bios and could be reason for errors. It helps if this is around same age

Jul 18 2017

TeeDriverW8x64.sys

Intel Management Engine Interface driver https://downloadcenter.intel.com/

as the bios, and although your bios is from 2019, the newest version of that on website is still 2018, but its newer than what you have.

Yes Correct second RAM of 16 Gb ( Kingston) was added few days ago. Yes I checked with Lenovo for the RAM before installing it. basically 2 things, if I can install different capacity.. existing was 8 so if 16 gB will work. and then the speed 2400 .
I checked the Automatic driver update but its not giving anything to update.

As suggested, I have updated the chipset drivers. now its of dated 11 Apr 2018. Will see how it goes now.

I am just hoping that this has anything to do with hardware of the laptop. I forgot to tell onething, that few days after my motherboard was replaced with new one., some coffee was spilled over on one side of the laptop. USB port, hdmi port, and card reader was not working for few hours, but later upon cleaning all started to work and no issues with any port atleast. I wonder that could these BSODs be related to it.

I am just having a bad time, coz sometimes OS doesnt crashes for days and sometime it does multiple times in few hours.

 

[Colif]

critical process is a software error, it can be caused by bad storage as well.

Service host is essential but at same time not easy to pin down a cause of, as every process in win 10 has its own service host. So there is about 90 of them. I wonder if it shows any info about which service it might be in event viewer, as it might tell you in the lines leading up to the event 41 (63) - the restart. Should be a way to identify which service host is involved

 

[Rohtash]

critical process is a software error, it can be caused by bad storage as well.

Service host is essential but at same time not easy to pin down a cause of, as every process in win 10 has its own service host. So there is about 90 of them. I wonder if it shows any info about which service it might be in event viewer, as it might tell you in the lines leading up to the event 41 (63) - the restart. Should be a way to identify which service host is involved

Just had a one more BSOD. This time unfortunately minidump is not created.
I have noticed couple of things in event viewer.
Is there any good debugging tool I can use to Analyze the Full memory Dump.

 

[gardenman]

Unless you know alot about the debugger itself and how to use it, you'll get about the same info (or less) that I can give you from it. There's a new WinDbg Preview app available in the Windows store. I prefer the older less buggy ones available here. The debugger is one of the options you can install when you install the SDK. You can skip all other SDK installation options but if I remember right, it still downloads a gig or two of junk when you only need to the 25MB debugger installer.

I'm using the debugger from the following download: Windows 10 SDK (ver. 10.0.14393.795). I cant help you with how to use it. You'll have to figure that out.

Edit: From what you've posted above, it seems you already know about the debugger. If you're looking for a better easier version: No such thing.

 

[Colif]

i suspect they caused by a driver.

Try looking at 2nd post here and see if Driver verifer can reveal the driver hiding behind it all - https://forums.tomshardware.com/thr...nclude-in-blue-screen-of-death-posts.3468965/

I am not sure how you would figure out which service crashed in both cases.

what is showing in event viewer? Just something would be somewhere to start from. Although you will always get errors in event viewer, even on working systems there are always errors in there. Only need to worry about critical ones (unless they event 41)

reliability monitor might also offer some clues

 

[Rohtash]

critical process is a software error, it can be caused by bad storage as well.

Service host is essential but at same time not easy to pin down a cause of, as every process in win 10 has its own service host. So there is about 90 of them. I wonder if it shows any info about which service it might be in event viewer, as it might tell you in the lines leading up to the event 41 (63) - the restart. Should be a way to identify which service host is involved

Hi Colif,
Here is the link for todays minidump. https://drive.google.com/open?id=1vHPq1U7RJcxqgUEd16IF6JTv71DAR7RR

Can you please have your friend analyse it.

Also, if its possible to share the debugger tool so that I can view it myself as well.

 

[gardenman]

I ran the dump file through the debugger and got the following information: https://pste.eu/p/qm5f.html

File information:	092219-224109-01.dmp (Sep 22 2019 - 11:31:33)
Bugcheck:	CRITICAL_PROCESS_DIED (EF)
Probably caused by:	memory_corruption (Process: svchost.exe)
Uptime:	4 Day(s), 20 Hour(s), 32 Min(s), and 47 Sec(s)

This information can be used by others to help you. I can't help you with this. Someone else will post with more information. Please wait for additional answers. Good luck.

 

[Colif]

if you look at the paste file in top line of any reply from gardenman, it shows the output of his script. Its all I have to go off and often its not clear what cause is.

If you run driver verifer we might push the driver into spotlight, its currently hiding behind the kernel