Question Random BSODs over the past month

[ronizu]

Over the past month or so I've had various random BSODs. A few have happened while using the PC but it feels like most of them happen when my PC is idle, I go out of my room to do something and when I come back my PC has restarted. According to event viewer, the BSODs are the following:

0x50 PAGE_FAULT_IN_NONPAGED_AREA
0xA IRQL_NOT_LESS_OR_EQUAL
0x3B SYSTEM_SERVICE_EXCEPTION
0x139 KERNEL_SECURITY_CHECK_FAILURE
0x10000007E SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M
0x4A IRQL_GT_ZERO_AT_SYSTEM_SERVICE
0x162 KERNEL_AUTO_BOOST_INVALID_LOCK_RELEASE
0x1E KMODE_EXCEPTION_NOT_HANDLED
0x133 DPC_WATCHDOG_VIOLATION

Edit: The most common ones are 0x139 (by far the most common, accounts for like 50% of all my BSODs), 0xA and 0x50. The other ones were either one-offs or few and far between.

Minidump of today's BSOD: https://drive.google.com/file/d/1BlbkiwK0LCeOtPIZizZMFEpOlsgYht-x/view?usp=sharing

I'm not sure what more is needed to solve the problem, if you need more information (logs, screenshots etc.) please do ask.

R7 3700X
MSI Armor OC RX 580 8GB
Asus PRIME B350-PLUS
WD Blue 1TB HDD
Crucial MX500 SSD
2x Kingston 8GB 3200MHz

 

[ronizu]

you can also google "how to force a memory dump using a keyboard" make the registry changes, reboot then use the keyboard to force a kernel dump on the working system. This will make sure that the system can produce a good kernel dump while working.

I'll try that. I've changed the "CrashDumpEnabled" to 1 and "CrashOnCtrlScroll" to 1 as well. Now I just reboot and initiate the BSOD for the memory dump right? Will edit it in here once I get it uploaded.

Edit: It'll take a while as it's 16GB in size (not sure if Drive will even accept it as the free storage limit is 15GB)

 

[johnbl]

I'll try that. I've changed the "CrashDumpEnabled" to 1 and "CrashOnCtrlScroll" to 1 as well. Now I just reboot and initiate the BSOD for the memory dump right? Will edit it in here once I get it uploaded.

Edit: It'll take a while as it's 16GB in size (not sure if Drive will even accept it as the free storage limit is 15GB)

most likely you did a full dump rather than just a kernel dump. you can compress the full dump. kernel dumps should be around 1- 1.5 gb
full dumps will be the same size as your actual installed RAM memory.

 

[ronizu]

most likely you did a full dump rather than just a kernel dump. you can compress the full dump. kernel dumps should be around 1- 1.5 gb
full dumps will be the same size as your actual installed RAM memory.

Ah, <Mod Edit>, the dump mode had changed to a full dump by itself. A full dump should still work right? I'll compress it and upload to drive.

 

[johnbl]

Ah, <Mod Edit>, the dump mode had changed to a full dump by itself. A full dump should still work right? I'll compress it and upload to drive.

yep it will work. it will include the standby memory data.

you can run this tool https://docs.microsoft.com/en-us/sysinternals/downloads/rammap
and find the menu item that says empty. then select each one.
it will delete the windows standby memory and make future dumps smaller. Standby memory is old programs that windows has run in the past and are stuck into memory in the hopes of a faster load time in case you run them again.

 

[ronizu]

yep it will work. it will include the standby memory data.

Never mind, I couldn't get it to compress so I just changed to just kernel dump and re-did it. Here it is: https://drive.google.com/file/d/1TnMUWRbTkJXVws_T4DobyQA2I137oWxm/view?usp=sharing

 

[johnbl]

Never mind, I couldn't get it to compress so I just changed to just kernel dump and re-did it. Here it is: https://drive.google.com/file/d/1TnMUWRbTkJXVws_T4DobyQA2I137oWxm/view?usp=sharing

system was running for 57 seconds.
plug and play is trying to find a driver for
"PCI\VEN_1022&DEV_1486&SUBSYS_87C01043&REV_00\4&3a616374&0&0141"
failed install:
vendor =1022 = AMD
device = 1486 = .[AMD] Starship/Matisse Cryptographic Coprocessor PSPCPP

see this thread on how to attempt a fix:
https://community.amd.com/t5/driver...tion-driver-pci-ven-1022-dev-1486/td-p/122875

basically, missing a pci encryption/decryption driver. see instructions on downloading AMD chipset and using windows control panel device manager to install the device.

you should also update the bios if you can. debugger indicates it is using old formats for some table entries.

I would update the bios first, then apply the updated drivers and be sure to look for any firmware update app the the motherboard vendor provides. a few years ago, hackers found ways to hack security cores in CPUs. bunch of updates were required because of this.
------------
debugger reports these modified windows drivers:
nt kernel 6 modications
pci bus driver 8 changes
usbxhci driver 6 changes
hidclass driver 280 changes

this version of this driver corrupts kernel memory, you should remove it.
\SystemRoot\System32\drivers\ScpVBus.sys Sun May 5 14:31:26 2013

two copies of this running:
C:\WINDOWS\system32\AMDRyzenMasterDriver.sys Thu Jun 24 22:21:58 2021
C:\Program Files\AMD\RyzenMaster\bin\AMDRyzenMasterDriver.sys Wed Oct 17 21:47:22 2018

this is bad, as it tweaks cpu voltages. use autoruns and delete both or just the older one. This would cause a bunch of random bugchecks.

I would run cmd.exe as an admin then run
dism.exe /onilne /cleanup-image /restore health
it might repair the modified files for your kernel, PCI bus, and usb extensions and human interface devices.

this overclock driver is kind of old:
\C:\Program Files (x86)\MSI Afterburner\RTCore64.sys Fri Sep 30 05:03:17 2016

use autoruns to remove it, then if you need it update to a current version.
------------
your cpu came out in 2019
AMD Ryzen 7 3700X 8-Core Processor
BIOS Version 5602
BIOS Starting Address Segment f000
BIOS Release Date 07/14/2020

--------
not sure what this driver is fore:
\SystemRoot\System32\drivers\Nssmkig.sys Sat Jul 17 11:37:52 2021
(never seen it before)
you also have 2 droid video drivers installed (just fyi)
--------
some issue with
Image: SpatialAudioLicenseSrv.exe

it is running 20 threads and using lots of memory.
-------------
you might look and see if you need this service:
AMDRSServ.exe

----------------
i would also look at
AdobeUpdateService.exe
just because it is running 7 threads. just make sure you have some adobe software you are really using and it is not a bogus malware installer.
-------------
prio_svc.exe
never have seen anyone running this. you might check to see if you need it

 

[ronizu]

debugger reports these modified windows drivers:
nt kernel 6 modications
pci bus driver 8 changes
usbxhci driver 6 changes
hidclass driver 280 changes

this version of this driver corrupts kernel memory, you should remove it.
\SystemRoot\System32\drivers\ScpVBus.sys Sun May 5 14:31:26 2013

two copies of this running:
C:\WINDOWS\system32\AMDRyzenMasterDriver.sys Thu Jun 24 22:21:58 2021
C:\Program Files\AMD\RyzenMaster\bin\AMDRyzenMasterDriver.sys Wed Oct 17 21:47:22 2018

this is bad, as it tweaks cpu voltages. use autoruns and delete both or just the older one. This would cause a bunch of random bugchecks.

I would run cmd.exe as an admin then run
dism.exe /onilne /cleanup-image /restore health
it might repair the modified files for your kernel, PCI bus, and usb extensions and human interface devices.

this overclock driver is kind of old:
\C:\Program Files (x86)\MSI Afterburner\RTCore64.sys Fri Sep 30 05:03:17 2016

use autoruns to remove it, then if you need it update to a current version.

Thank you so much for your help. I removed the ScpVBus.sys (although I already deleted that once yesterday, I guess there was a copy) and both of the AMDRyzenMasterDriver.sys (are they really harmful, considering they are part of an AMD software? I'll trust you on that however). Also ran the cmd command. Should I do a kernel dump once more for you so you can see if anything new popped up or should that be all?

 

[johnbl]

Thank you so much for your help. I removed the ScpVBus.sys (although I already deleted that once yesterday, I guess there was a copy) and both of the AMDRyzenMasterDriver.sys (are they really harmful, considering they are part of an AMD software? I'll trust you on that however). Also ran the cmd command. Should I do a kernel dump once more for you so you can see if anything new popped up or should that be all?

i added notes to the last message. you should take a quick look.
after cleanup you should run to see if your system is more stable.

the ryzen driver can be ok, but it is to allow overclocking and cpu tweaking voltages, you have to have a version that matches your cpu, and bios. you should never have 2 copies or another cpu overclocker installed at the same time. most of theses tools, just run by adding a offset to a voltage rather than just picking a certain voltage. if you have 2 copies and each copy adds 5% voltage you get too high a voltage on a cpu pin then the cpu electronics timings get messed up. most of the voltages will be set in a bios update and you only want to run the ryzenmaster driver if you want to override some setting for some particular reason. Mostly, for when you mother board vendor has not updated a bios for a new CPU that you want to install in the machine. Or you want to push some limit in speed.

 

[ronizu]

i added notes to the last message. you should take a quick look.
after cleanup you should run to see if your system is more stable.

Yeah I've been refreshing the page to see all the new notes you've been adding, thank you very much for everything. I deleted both the Ryzen Master services and the whole software itself while I was at it. Just a few more questions, you mentioned that I should "do something about" SpatialAudioLicenseSrv.exe, what is that something? How would I go about making it not run 20 threads. Also removed adobe updater cause I really don't have any need for it. But apart from that, I'll just keep using my PC and see if I get any more BSODs, I'll reply here if I do. But until then, I thank you very much for your time and help!

 

[johnbl]

Yeah I've been refreshing the page to see all the new notes you've been adding, thank you very much for everything. I deleted both the Ryzen Master services and the whole software itself while I was at it. Just a few more questions, you mentioned that I should "do something about" SpatialAudioLicenseSrv.exe, what is that something? How would I go about making it not run 20 threads. Also removed adobe updater cause I really don't have any need for it. But apart from that, I'll just keep using my PC and see if I get any more BSODs, I'll reply here if I do. But until then, I thank you very much for your time and help!

SpatialAudioLicenseSrv.exe just seems to be using way too much resources for what it should be doing. it could be just a bad app. If it is something you use, i would look for a update. if it is a service, i would just start and stop the service.