Question Trying to figure out the cause of frequent blue screens, mainly related to ntoskrnl.exe

[kaptainkouk]

Hello everyone,

So this all started about a week ago when I installed the latest Windows 10 update. Immediately after the restart, I noticed that something was off as everything suddenly took a lot longer to load than usual, especially the first time I try to open something (e.g. Chrome, File Explorer). After a while, while browsing chrome I got the "Aw snap, something went wrong" error and a little bit later my PC crashed to a blue screen.

Since then I have been getting blue screens multiple times a day and I have tried quite a lot of things poking around, but I still haven't managed to pinpoint a problem. I ran a Windows memory diagnostic and it returned memory related errors, I updated all my drivers, I tried to update Windows again, but every time I get a 0x80070057 error. I also ran the Verifier a couple of times and got different results, but every time they involve ntoskrnl.exe . Here is a link of the latest crash minidumps:

https://www.dropbox.com/sh/ecnomh0vyirhkbo/AABbtAqjeoH2OUehrfVmxBwGa?dl=0

At this point I am pretty lost and I would greatly appreciate any help. Thank you in advance for your answers.

 

[Colif]

it is unlikely ntoskrnl is cause, victim for sure but if it was the cause windows wouldn't work. NTOSKRNL = windows kernel. It handles all driver requests, power management, and memory management. It sits between Hardware and Applications. It got blamed but its not the cause

what are details of the PC? is it a custom made PC or brand name?
if custom, what parts?
if brand name, what make/model?

what type of drives do you have? Hdd or ssd? how old?

Causes of Error Code 0x80070057
If you come across error code 0x80070057, it means there was a problem with your storage solution, whether it's a hard drive or SSD. This might be because you've attempted to install something that's too large for the drive and you've run out of space, or you're trying to copy files to the drive and they've run out of room.

Installing Windows is also a common time to see this error code appear. If your storage solution doesn't have enough space or isn't using the right file system for the version of Windows you're installing, error code 0x80070057 can appear. Similarly, when installing Windows updates, if there's a storage issue, these (occasionally large) installations can trigger this particularly frustrating error.

https://www.lifewire.com/fix-error-code-0x80070057-4691502

I can't read dumps but I have asked a friend to convert the files for me. If Driver verifer is blaming ntoskrnl then its not a driver problem.

 

[kaptainkouk]

what are details of the PC? is it a custom made PC or brand name?
if custom, what parts?
if brand name, what make/model?

what type of drives do you have? Hdd or ssd? how old?

Thank you for your answer and I'm sorry I didn't provide specs already.

This is a custom build PC, built (and all of the parts purchased) around 4&1/2 years.

Motherboard: Gigabyte B150M-D3H-CF
CPU: Intel Core i5-6500 3.20GHz
RAM: Corsair Value Select 8GB DDR4-2133MHz
GPU: NVIDIA GeForce GTX 1060 6GB
SSD: SanDisk SDSSDA-240G-G2 240GB (Windows is installed here)
HDD: Toshiba 1TB
OS: Windows 10 Pro (64-bit)

The drives are also around 4&1/2 years old.

 

[gardenman]

Hi, I ran the dump files through the debugger and got the following information: https://jsfiddle.net/7pn8ktgz/show This link is for anyone wanting to help. You do not have to view it. It is safe to "run the fiddle" as the page asks.

Spoiler

File information:	111020-7015-01.dmp (Nov 9 2020 - 18:24:51)
Bugcheck:	CRITICAL_PROCESS_DIED (EF)
Probably caused by:	ntkrnlmp.exe (Process: csrss.exe)
Uptime:	0 Day(s), 2 Hour(s), 36 Min(s), and 23 Sec(s)

File information:	110920-7921-01.dmp (Nov 9 2020 - 12:39:55)
Bugcheck:	MEMORY_MANAGEMENT (1A)
Probably caused by:	memory_corruption (Process: msedge.exe)
Uptime:	0 Day(s), 2 Hour(s), 24 Min(s), and 51 Sec(s)

File information:	110920-6796-01.dmp (Nov 9 2020 - 14:53:11)
Bugcheck:	DRIVER_VERIFIER_DETECTED_VIOLATION (C4)
Driver warnings:	*** WARNING: Unable to verify timestamp for dtliteusbbus.sys
Probably caused by:	dtliteusbbus.sys (Process: System)
Uptime:	0 Day(s), 0 Hour(s), 00 Min(s), and 07 Sec(s)

File information:	110920-6421-01.dmp (Nov 9 2020 - 14:58:59)
Bugcheck:	DRIVER_VERIFIER_DETECTED_VIOLATION (C4)
Probably caused by:	ntkrnlmp.exe (Process: System)
Uptime:	0 Day(s), 0 Hour(s), 00 Min(s), and 05 Sec(s)

File information:	110820-9656-01.dmp (Nov 8 2020 - 07:49:09)
Bugcheck:	KERNEL_SECURITY_CHECK_FAILURE (139)
Probably caused by:	Pool_Corruption (Process: System)
Uptime:	0 Day(s), 14 Hour(s), 43 Min(s), and 11 Sec(s)

File information:	110820-8078-01.dmp (Nov 7 2020 - 17:05:39)
Bugcheck:	SYSTEM_SERVICE_EXCEPTION (3B)
Probably caused by:	memory_corruption (Process: TiWorker.exe)
Uptime:	0 Day(s), 1 Hour(s), 13 Min(s), and 15 Sec(s)

File information:	110820-7593-01.dmp (Nov 8 2020 - 16:52:06)
Bugcheck:	PAGE_FAULT_IN_NONPAGED_AREA (50)
Probably caused by:	Pool_Corruption (Process: MoUsoCoreWorke)
Uptime:	0 Day(s), 0 Hour(s), 11 Min(s), and 14 Sec(s)

File information:	110820-7203-01.dmp (Nov 8 2020 - 16:55:57)
Bugcheck:	PAGE_FAULT_IN_NONPAGED_AREA (50)
Probably caused by:	memory_corruption (Process: TiWorker.exe)
Uptime:	0 Day(s), 0 Hour(s), 03 Min(s), and 31 Sec(s)

File information:	110720-7343-01.dmp (Nov 6 2020 - 21:28:33)
Bugcheck:	SYSTEM_SERVICE_EXCEPTION (3B)
Probably caused by:	ntkrnlmp.exe (Process: TiWorker.exe)
Uptime:	0 Day(s), 12 Hour(s), 03 Min(s), and 38 Sec(s)

File information:	110720-7187-01.dmp (Nov 7 2020 - 05:18:35)
Bugcheck:	SYSTEM_SERVICE_EXCEPTION (3B)
Probably caused by:	memory_corruption (Process: TiWorker.exe)
Uptime:	0 Day(s), 0 Hour(s), 03 Min(s), and 21 Sec(s)

Comment: The overclocking driver "XtuAcpiDriver.sys" was found on your system. (Intel Extreme Tuning Utility)

Comment: The overclocking driver "IOCBios2.sys" was found on your system. (Intel Extreme Tuning Utility)

Possible Motherboard page: https://www.gigabyte.com/Motherboard/GA-B150M-D3H-rev-10
There are BIOS updates available for your system. Wait for additional information before deciding to update or not. Important: Verify that I have linked to the correct motherboard. Updating your BIOS can be risky. Never try it when you might lose power (lightning storms, recent power outages, etc).

This information can be used by others to help you. Someone else will post with more information. Please wait for additional answers. Good luck.

 

[Secret-Squirrel]

..................................I ran a Windows memory diagnostic and it returned memory related errors,.................

Well that could be highly significant.

Defective RAM can cause all manner of weird problems, BSoDs, and more.

I'd like to see the Memory Diagnostics results please so head over to Event Viewer then navigate to Windows Logs -> System. In the centre pane, look for the MemoryDiagnostcs-Results in the "Source" column. There's a "Find" option on the right if you need it - search for "memory" or "results" etc.

When you find what you're looking for, copy and paste the report here please.

 

[kaptainkouk]

When you find what you're looking for, copy and paste the report here please.

Hello, I found the logs. By report, do you mean this:

Log Name: System
Source: Microsoft-Windows-MemoryDiagnostics-Results
Date: 8/11/2020 3:02:31 μμ
Event ID: 1202
Task Category: None
Level: Error
Keywords:
User: SYSTEM
Computer: DESKTOP-PFOMDJR
Description:
The Windows Memory Diagnostic tested the computer's memory and detected hardware errors. To identify and repair these problems, contact the computer manufacturer
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-MemoryDiagnostics-Results" Guid="{5f92bc59-248f-4111-86a9-e393e12c6139}" />
<EventID>1202</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2020-11-08T13:02:31.7817266Z" />
<EventRecordID>4993</EventRecordID>
<Correlation />
<Execution ProcessID="6628" ThreadID="6632" />
<Channel>System</Channel>
<Computer>DESKTOP-PFOMDJR</Computer>
<Security UserID="S-1-5-18" />
</System>
<UserData>
<Results xmlns="http://manifests.microsoft.com/win/2005/08/windows/Reliability/Postboot/Events">
<CompletionType>Fail</CompletionType>
</Results>
</UserData>
</Event>

 

[Secret-Squirrel]

......................................The Windows Memory Diagnostic tested the computer's memory and detected hardware errors........................

Thanks for that and it clearly shows that Windows thinks you've got defective RAM.

If your PC has two 4GB RAM modules then remove one and see if you get any further problems. If you do then put that one back and remove the other. Note that Windows will run slower with 4GB of RAM so don't be concerned. When you find the defective module you can get a replacement.

There are other memory tests available such as MemTest64 if you want a second opinion.

 

[kaptainkouk]

Thanks for that and it clearly shows that Windows thinks you've got defective RAM.

If your PC has two 4GB RAM modules then remove one and see if you get any further problems. If you do then put that one back and remove the other. Note that Windows will run slower with 4GB of RAM so don't be concerned. When you find the defective module you can get a replacement.

Thank you for your answers Secret-Squirrel. Unfortunately, I only have one RAM module and no spares to test with. What do you suggest?

 

[Secret-Squirrel]

I suggest you get a second opinion from a different memory tester. If that shows RAM problems too then that's a conclusive overall result so you should go ahead and buy another RAM module.

By the way, faulty RAM can't be repaired - the only solution is to replace it.

 

[kaptainkouk]

MemTest64

With Memtest64, what would the result look like to suggest that I should replace my RAM?

 

[Secret-Squirrel]

It's been a while since I last used that tool so I can't offer specific advice. However, the results should be pretty clear because a RAM module will either fail or pass the tests.

Best of luck.

 

[kaptainkouk]

However, the results should be pretty clear because a RAM module will either fail or pass the tests.

Best of luck.

Update: after almost 3 loops with memtest64 it has returned more than 100.000 errors. I suppose it's pretty safe to say that my module is busted and that it's not a software or otherwise related issue? So next step should be to get a new module right?

 

[Secret-Squirrel]

The errors can't be caused by a software-related issue because both tools run outside of Windows where no other software can run.

RAM shouldn't be showing any errors in MemTest, so with 100,000 reported so far, there's clearly something very wrong with it.

If I were you then I'd have no hesitation in buying a replacement module.

 

[kaptainkouk]

The errors can't be caused by a software-related issue because both tools run outside of Windows where no other software can run.

RAM shouldn't be showing any errors in MemTest, so with 100,000 reported so far, there's clearly something very wrong with it.

If I were you then I'd have no hesitation in buying a replacement module.

Thank you so much for your advice.

 

[Colif]

Max error count for memtest is 0 errors. Any higher is a fail, 100000 is a clear fail. All you need to do is show memory maker the memtest results and they will replace the ram.

 

[kaptainkouk]

All you need to do is show memory maker the memtest results and they will replace the ram.

Really, they will replace it after more than four years? And who should I contact, the seller or the maker (Corsair in this case) directly?

 

[Colif]

ram has a life time warranty so yes.

Contact Corsair - https://help.corsair.com/hc/en-us/articles/360033067832-Corsair-Limited-Warranty

you may need to be able to prove you bought it.