[SOLVED] system crash caused by smartscreen.exe

[artemisfowl872]

Hi, my system suddenly crashed without bsod, and I'm trying to understand why and what happened.
I'm somewhat used to bsods thank to the infamous shield controller drivers, but this time the os simply froze while using chrome, blasting noise through the tv it was connected to. (the classic glitchy sound you can hear when something that was playing audio crashes).
No bsod was displayed, the pc just rebooted after few seconds. I'm excluding the possibility of the shield controller's involvement because

1. the bluetooth was already turned off
2. the log is different from the typical "xusb" crash

My machine is a brand new rog zephyrus m, (GM501GS-EI003T), running Windows10 Pro and Bitdefender Total Security
Here's what i got by running the dump file through WinDbg:

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8056d13e841, The address that the exception occurred at
Arg3: ffffca08bc3719c8, Exception Record Address
Arg4: fffff80568daf930, Context Record Address

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : AV.Fault
    Value: Read

    Key  : Analysis.CPU.Sec
    Value: 4

    Key  : Analysis.DebugAnalysisProvider.CPP
    Value: Create: 8007007e on LUC

    Key  : Analysis.DebugData
    Value: CreateObject

    Key  : Analysis.DebugModel
    Value: CreateObject

    Key  : Analysis.Elapsed.Sec
    Value: 4

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 62

    Key  : Analysis.System
    Value: CreateObject


BUGCHECK_CODE:  7e

BUGCHECK_P1: ffffffffc0000005

BUGCHECK_P2: fffff8056d13e841

BUGCHECK_P3: ffffca08bc3719c8

BUGCHECK_P4: fffff80568daf930

EXCEPTION_RECORD:  ffffca08bc3719c8 -- (.exr 0xffffca08bc3719c8)
ExceptionAddress: fffff8056d13e841 (nt!MiDemoteCombinedPte+0x0000000000000051)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff80568daf930 -- (.cxr 0xfffff80568daf930)
rax=ffff9ecf67b3d000 rbx=0000001004000001 rcx=ffffa48fdcfe8580
rdx=ffff9ebffe00bcf0 rsi=ffff9ebffe00bcf0 rdi=ffffca08bc372210
rip=fffff8056d13e841 rsp=ffffca08bc371c00 rbp=00007ffc0179e000
 r8=8000000000000000  r9=ffffa48fdd0c9010 r10=0000000000000000
r11=ffff9e8000000000 r12=0000000000000000 r13=ffffca08bc372310
r14=8000000000000000 r15=ffffa48fdcfe8580
iopl=0         nv up ei ng nz na po cy
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00050287
nt!MiDemoteCombinedPte+0x51:
fffff805`6d13e841 498378f001      cmp     qword ptr [r8-10h],1 ds:002b:7fffffff`fffffff0=????????????????
Resetting default scope

PROCESS_NAME:  smartscreen.exe

READ_ADDRESS:  ffffffffffffffff

ERROR_CODE: (NTSTATUS) 0xc0000005 - L'istruzione a 0x%p ha fatto riferimento alla memoria a 0x%p. La memoria non poteva essere %s.

EXCEPTION_CODE_STR:  c0000005

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

EXCEPTION_STR:  0xc0000005

BAD_STACK_POINTER:  fffff80568daf0c8

STACK_TEXT: 
ffffca08`bc371c00 fffff805`6d0b0087 : ffffa48f`dcfe8640 fffff805`6d0749e6 00000000`00000003 00000000`00000000 : nt!MiDemoteCombinedPte+0x51
ffffca08`bc371cd0 fffff805`6d0ac837 : ffffa48f`00000003 ffffca08`bc372310 00000000`00000000 00000000`00000000 : nt!MiAgePte+0x427
ffffca08`bc371d70 fffff805`6d0accf1 : ffffca08`bc372310 ffffca08`bc372310 ffffa48f`00000000 ffff9ecf`5fff0058 : nt!MiWalkPageTablesRecursively+0x1e7
ffffca08`bc371e30 fffff805`6d0accf1 : ffffca08`bc372310 ffffca08`bc372310 ffffa48f`00000000 ffff9ecf`67afff80 : nt!MiWalkPageTablesRecursively+0x6a1
ffffca08`bc371ef0 fffff805`6d0accf1 : ffffca08`bc372310 ffffca08`bc372310 ffffa48f`00000000 ffff9ecf`67b3d7f8 : nt!MiWalkPageTablesRecursively+0x6a1
ffffca08`bc371fb0 fffff805`6d0ac47c : ffffca08`bc372310 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiWalkPageTablesRecursively+0x6a1
ffffca08`bc372070 fffff805`6d0abf07 : ffffca08`bc372310 ffffca08`00000002 00000000`00000002 fffff805`00000000 : nt!MiWalkPageTables+0x36c
ffffca08`bc372170 fffff805`6d0ab642 : ffffa48f`d3d0d240 fffff805`00000000 00000000`008bded8 00000000`00000000 : nt!MiAgeWorkingSet+0x3a7
ffffca08`bc372690 fffff805`6d0aaf5a : ffffa48f`dcfe8580 ffffca08`bc372950 00000000`00000000 00000000`00000000 : nt!MiTrimOrAgeWorkingSet+0x3b2
ffffca08`bc372780 fffff805`6d0a8bb0 : fffff805`6d468340 00000000`00000000 fffff805`6d468340 ffffa48f`bda3f520 : nt!MiProcessWorkingSets+0x1fa
ffffca08`bc372930 fffff805`6d2c8ed6 : 00000000`00000001 00000000`00000007 00000000`ffffffff 00000000`00000001 : nt!MiWorkingSetManager+0xc8
ffffca08`bc3729f0 fffff805`6d189e65 : 00000000`00000007 00000000`ffffffff fffff805`6d468340 00000000`000001e2 : nt!MmWorkingSetManager+0x12
ffffca08`bc372a20 fffff805`6d129e95 : ffffa48f`bdb48040 00000000`00000080 fffff805`6d189d10 00000000`00000000 : nt!KeBalanceSetManager+0x155
ffffca08`bc372b10 fffff805`6d1c730a : ffffe381`89bc0180 ffffa48f`bdb48040 fffff805`6d129e40 00000000`00a132db : nt!PspSystemThreadStartup+0x55
ffffca08`bc372b60 00000000`00000000 : ffffca08`bc373000 ffffca08`bc36c000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x2a


SYMBOL_NAME:  nt!MiDemoteCombinedPte+51

MODULE_NAME: nt

STACK_COMMAND:  .cxr 0xfffff80568daf930 ; kb

IMAGE_NAME:  memory_corruption

BUCKET_ID_FUNC_OFFSET:  51

FAILURE_BUCKET_ID:  AV_STACKPTR_ERROR_nt!MiDemoteCombinedPte

OS_VERSION:  10.0.18362.1

BUILDLAB_STR:  19h1_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {51bd6656-a4b2-8d9b-1231-94678dd83b3a}

Followup:     MachineOwner
---------

Here's the link to the MEMORY.DMP file: https://1drv.ms/u/s!ArpFFw9rJBoeidtJLENhspNaMh7zcA?e=C7eksh
Thank you

 

[Colif]

Have you run the Application called My Asus on the laptop and checked you have latest drivers?

if its not on the laptop, its the last utilkity on the list here - https://www.asus.com/Laptops/ROG-Zephyrus-M-GU502/HelpDesk_Download/

parts of windows generally don't crash by themselves so likely a driver involved

 

[artemisfowl872]

As soon as I got the pc a month ago, I updated the bios, did a fresh install of windows, ran the horrible and rather useless "Asus Live Update" tool, went through the embarrassingly disorganized "driver and support" page , and ran Intel's-actually-pretty-good driver updater to do the rest of the work.
But that was about a month ago, since then it's been running well, even under load. I cannot explain why it crashed yesterday, out of the blue.

 

[Colif]

i have sent link to a friend, he will reply later and may be able to help, or he will attach a paste file i can use to assist further

 

[gardenman]

Hi, I ran the dump file through the debugger and got the following information: https://pste.eu/p/uuhR.html

File information:	MEMORY.DMP (Sep 6 2019 - 10:40:54)
Bugcheck:	SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7E)
Probably caused by:	memory_corruption (Process: smartscreen.exe)
Uptime:	0 Day(s), 5 Hour(s), 46 Min(s), and 20 Sec(s)

The dump file was partially corrupt so I tried to edit out all of the errors that I could. This is common with memory.dmp files.

Possible Motherboard page: https://www.asus.com/us/Laptops/ROG-Zephyrus-M-GM501/
There is a BIOS update available for your system (Version 313). You have version 312 installed. Wait for additional information before deciding to update or not. Important: Verify that I have linked to the correct motherboard. Updating your BIOS can be risky. Never try it when you might lose power (lightning storms, recent power outages, etc).

This information can be used by others to help you. I can't help you with this. Someone else will post with more information. Please wait for additional answers. Good luck.

 

[artemisfowl872]

The model you linked to is correct.
I saw the new bios on the support page, but the downloaded zip file isn't even recognized by asus' WinFlash tool, so I won't update for now. I don't even know if there's a backup chip in this machine, if the updated bios malfunctions.
Asus' software support for these kind of expensive machines is turning out to be a big disappointment.
I'm not sure how to feel about all this, it seems like I'm trying to revive an old 2012 hp notebook with long gone support. much wow

 

[Colif]

I am not sure if some of the drivers I am seeing in the 3rd party drivers section of that crash aren't Microsoft drivers, which always makes it fun. I think VmsProxy.sys is part of windows
Time travel

May 11 2020

winhvr.sys

Windows Hypervisor Root Interface driver (Microsoft)

Dump didn't convert right, there are lines it cannot read so its hard to say what caused that one. Bitdefender and smartscreen play well together, so it shouldn't be it.

 

[artemisfowl872]

Just minutes ago the pc rebooted on me again. This time no dump was made, just an entry on Windows' event viewer, saying "The system has rebooted without cleanly shutting down first."
Here's the xml-encoded details:

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331c3b3a-2005-44c2-ac5e-77220c37d6b4}" />
  <EventID>41</EventID>
  <Version>6</Version>
  <Level>1</Level>
  <Task>63</Task>
  <Opcode>0</Opcode>
  <Keywords>0x8000400000000002</Keywords>
  <TimeCreated SystemTime="2019-09-08T17:38:55.699526600Z" />
  <EventRecordID>8493</EventRecordID>
  <Correlation />
  <Execution ProcessID="4" ThreadID="8" />
  <Channel>System</Channel>
  <Computer>Luc</Computer>
  <Security UserID="S-1-5-18" />
  </System>
- <EventData>
  <Data Name="BugcheckCode">159</Data>
  <Data Name="BugcheckParameter1">0x3</Data>
  <Data Name="BugcheckParameter2">0x0</Data>
  <Data Name="BugcheckParameter3">0x0</Data>
  <Data Name="BugcheckParameter4">0x0</Data>
  <Data Name="SleepInProgress">0</Data>
  <Data Name="PowerButtonTimestamp">0</Data>
  <Data Name="BootAppStatus">0</Data>
  <Data Name="Checkpoint">41</Data>
  <Data Name="ConnectedStandbyInProgress">false</Data>
  <Data Name="SystemSleepTransitionsToOn">1</Data>
  <Data Name="CsEntryScenarioInstanceId">0</Data>
  <Data Name="BugcheckInfoFromEFI">true</Data>
  <Data Name="CheckpointStatus">0</Data>
  </EventData>
  </Event>

 

[Colif]

my fav event... its just a reaction, its not the cause. Its not a sign of a bad psu, all it represents is the result of a report windows runs at startup. It found it wasn't shut down fight, its not telling you anything you didn't already know. Windows doesn't know why.

Nice color scheme

So its a Zephyrus M GM501GS with a i7-8750H & 1 16gb ram stick

Not sure whats up with the bios file if the tool doesn't recognise it, I only mention it as it could help.

 

[artemisfowl872]

Nice color scheme

Yeah, I'm in love with this machine, apart from the awkward driver experience. (and the lack of RJ45 connector, and the single channel ram)
If you disable all the "gaming leds", it makes for an elegant, sober, look too. For 1€ below 2000, and an additional one year full-refund-if-fail warranty, I can say I'm happy overall.
Quite a leap from my 8 yro hp pavilion dv6 6c73el

I'll keep an eye on it, If anything new happens, i'll post here

 

[Colif]

I was actually talking about the coding on the event error, but both works

 

[artemisfowl872]

Another reboot, this time I identified three warnings, and the second one seems interesting:
1. "The previous system shutdown was unexpected"

<?xml version="1.0" encoding="UTF-8"?>
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
   <System>
      <Provider Name="EventLog" />
      <EventID Qualifiers="32768">6008</EventID>
      <Level>2</Level>
      <Task>0</Task>
      <Keywords>0x80000000000000</Keywords>
      <TimeCreated SystemTime="2019-09-10T14:21:56.983351100Z" />
      <EventRecordID>9321</EventRecordID>
      <Channel>System</Channel>
      <Computer>Luc</Computer>
      <Security />
   </System>
   <EventData>
      <Data>13:34:28</Data>
      <Data>‎10/‎09/‎2019</Data>
      <Data />
      <Data />
      <Data>9</Data>
      <Data />
      <Data />
      <Binary>E307090002000A000D0022001C00ED02E307090002000A000B0022001C00ED023C0000003C000000000000000000000000000000000000000100000000000000</Binary>
   </EventData>
</Event>

2. "Dump file creation failed due to error during dump creation."

<?xml version="1.0" encoding="UTF-8"?>
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
   <System>
      <Provider Name="volmgr" />
      <EventID Qualifiers="49156">161</EventID>
      <Level>2</Level>
      <Task>0</Task>
      <Keywords>0x80000000000000</Keywords>
      <TimeCreated SystemTime="2019-09-10T14:21:49.751026800Z" />
      <EventRecordID>9340</EventRecordID>
      <Channel>System</Channel>
      <Computer>Luc</Computer>
      <Security />
   </System>
   <EventData>
      <Data>\Device\HarddiskVolume5</Data>
      <Binary>000000000100000000000000A10004C0250A0A00010000C000000000000000000000000000000000</Binary>
   </EventData>
</Event>

3. "The system has rebooted without cleanly shutting down first.", xml roughly as above

I'm noticing this happens always when the pc is left idle for some time, but not every time. Could be one of the disks going idle? the gpu? i'm running the gpu in "dedicated" mode.
Could this setting be affecting something? I have it set on "maximum power saving".