BSOD with different errors each time.

[jamiepugh]

I got a BSOD a few months ago and had to reinstall Win 7 (and then upgrade to Win 10). During the process, the network settings got fowled up, but I’ve since fixed all of that. PC was stable for a few of months but now I get the BSOD all the time and it gives different error codes each time. I’ve removed all but the KB and mouse and removed then swapped the memory, but its still crashing.

 

[jamiepugh]

My last few BlueScreenView files:

Spoiler

==================================================
Dump File : 070317-8031-01.dmp
Crash Time : 03/07/2017 21:03:26
Bug Check String : MEMORY_MANAGEMENT
Bug Check Code : 0x0000001a
Parameter 1 : 00000000`00041201
Parameter 2 : ffffa000`5ae239e0
Parameter 3 : 80000000`a9785867
Parameter 4 : ffffe30a`d8129c50
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+16c3f0
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 10.0.15063.413 (WinBuild.160101.0800)
Processor : x64
Crash Address : ntoskrnl.exe+16c3f0
Stack Address 1 :
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\WINDOWS\Minidump\070317-8031-01.dmp
Processors Count : 6
Major Version : 15
Minor Version : 15063
Dump File Size : 556,020
Dump File Time : 03/07/2017 21:04:12
==================================================

==================================================
Dump File : 070317-7515-01.dmp
Crash Time : 03/07/2017 21:22:57
Bug Check String : BAD_POOL_CALLER
Bug Check Code : 0x000000c2
Parameter 1 : 00000000`00000010
Parameter 2 : ffffd789`d4e13e10
Parameter 3 : 00000000`0a080001
Parameter 4 : ffffd789`d4e13e30
Caused By Driver : afd.sys
Caused By Address : afd.sys+556b2
File Description : Ancillary Function Driver for WinSock
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 10.0.15063.0 (WinBuild.160101.0800)
Processor : x64
Crash Address : ntoskrnl.exe+16c3f0
Stack Address 1 :
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\WINDOWS\Minidump\070317-7515-01.dmp
Processors Count : 6
Major Version : 15
Minor Version : 15063
Dump File Size : 606,668
Dump File Time : 03/07/2017 21:24:05
==================================================

==================================================
Dump File : 070317-8031-01.dmp
Crash Time : 03/07/2017 21:03:26
Bug Check String : MEMORY_MANAGEMENT
Bug Check Code : 0x0000001a
Parameter 1 : 00000000`00041201
Parameter 2 : ffffa000`5ae239e0
Parameter 3 : 80000000`a9785867
Parameter 4 : ffffe30a`d8129c50
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+16c3f0
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 10.0.15063.413 (WinBuild.160101.0800)
Processor : x64
Crash Address : ntoskrnl.exe+16c3f0
Stack Address 1 :
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\WINDOWS\Minidump\070317-8031-01.dmp
Processors Count : 6
Major Version : 15
Minor Version : 15063
Dump File Size : 556,020
Dump File Time : 03/07/2017 21:04:12
==================================================

Does this help?

 

[johnbl]

2 of the bugchecks are in the memory manager while accessing virtual memory (pagefile.sys)
for this you would:
run Malwarebytes scan, start cmd and run the windows system file checker:
sfc.exe /scannow
then run
dism.exe /online /cleanup-image /restorehealth

(these can fix malware problems that infect the storage drivers)

since the memory management bugcheck is in virtual memory I would delete the hidden c:\pagefile.sys
you can do this by turning off the system virtual memory reboot and then turn it back on to create a new pagefile.sys
do this for the case where the c:\pagefile.sys is located on a bad spot on the drive.

you will also want to update the SATA drivers and the BIOS to match if you have not already done so.

the last bugcheck shows a bad pool caller to adf.sys this is the winsock support for the network transports. This is likely to be caused by a bug in a network device driver. It can be a usb wireless driver, a Bluetooth driver or a wired network driver. I would start by updating the motherboard vendors drivers from the motherboard vendors website. very common for certain motherboard to have shipped with bad drivers. Note Microsoft windows do not update the Ethernet drivers, you have to go to the vendors website.
note for usb thumb wireless drivers you have to update the BIOS (depending on the date of the bios) as well as the vendors wireless driver.

Note: the bad pool call can corrupt the system memory and cause the other two bugchecks (you just can not tell with the info provided, you would have to set debug flags to trap the error)

 

[jamiepugh]

2 of the bugchecks are in the memory manager while accessing virtual memory (pagefile.sys)
for this you would:
run Malwarebytes scan, start cmd and run the windows system file checker:
sfc.exe /scannow
then run
dism.exe /online /cleanup-image /restorehealth

(these can fix malware problems that infect the storage drivers)

since the memory management bugcheck is in virtual memory I would delete the hidden c:\pagefile.sys
you can do this by turning off the system virtual memory reboot and then turn it back on to create a new pagefile.sys
do this for the case where the c:\pagefile.sys is located on a bad spot on the drive.

you will also want to update the SATA drivers and the BIOS to match if you have not already done so.

the last bugcheck shows a bad pool caller to adf.sys this is the winsock support for the network transports. This is likely to be caused by a bug in a network device driver. It can be a usb wireless driver, a Bluetooth driver or a wired network driver. I would start by updating the motherboard vendors drivers from the motherboard vendors website. very common for certain motherboard to have shipped with bad drivers. Note Microsoft windows do not update the Ethernet drivers, you have to go to the vendors website.
note for usb thumb wireless drivers you have to update the BIOS (depending on the date of the bios) as well as the vendors wireless driver.

Note: the bad pool call can corrupt the system memory and cause the other two bugchecks (you just can not tell with the info provided, you would have to set debug flags to trap the error)

 

[jamiepugh]

Hi
Thanks for the detailed response.
As a precaution I removed 1 stick of RAM and ran Memtest86 v7.3 on it over night and there were no problems.

I did the Malware scan – All clean.
The other 2 cmd prompt processes were also done without hitch.
I deleted pagefile.
All drivers and bios are up to date.

During all of this the PC did BSOD 3-4 times and also as I was writing this unfortunately!
Here are the last 3 BlueScreenViews:
==================================================
Dump File : 070417-7562-01.dmp
Crash Time : 04/07/2017 09:30:06
Bug Check String : IRQL_NOT_LESS_OR_EQUAL
Bug Check Code : 0x0000000a
Parameter 1 : 00000000`00000000
Parameter 2 : 00000000`00000002
Parameter 3 : 00000000`00000000
Parameter 4 : fffff801`4d10b8bb
Caused By Driver : NTFS.sys
Caused By Address : NTFS.sys+fc130
File Description : NT File System Driver
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 10.0.15063.0 (WinBuild.160101.0800)
Processor : x64
Crash Address : ntoskrnl.exe+16c3f0
Stack Address 1 :
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\WINDOWS\Minidump\070417-7562-01.dmp
Processors Count : 6
Major Version : 15
Minor Version : 15063
Dump File Size : 627,996
Dump File Time : 04/07/2017 09:30:52
==================================================
Dump File : 070417-8015-01.dmp
Crash Time : 04/07/2017 09:14:47
Bug Check String :
Bug Check Code : 0x00000189
Parameter 1 : ffff9c88`aa81f030
Parameter 2 : 00000000`00000000
Parameter 3 : 00000000`00000000
Parameter 4 : 00000000`00000000
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+16c3f0
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 10.0.15063.413 (WinBuild.160101.0800)
Processor : x64
Crash Address : ntoskrnl.exe+16c3f0
Stack Address 1 :
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\WINDOWS\Minidump\070417-8015-01.dmp
Processors Count : 6
Major Version : 15
Minor Version : 15063
Dump File Size : 731,380
Dump File Time : 04/07/2017 09:15:41

==================================================
Dump File : 070417-8000-01.dmp
Crash Time : 04/07/2017 09:00:49
Bug Check String : IRQL_NOT_LESS_OR_EQUAL
Bug Check Code : 0x0000000a
Parameter 1 : ffffbc88`e05918d8
Parameter 2 : 00000000`00000002
Parameter 3 : 00000000`00000000
Parameter 4 : fffff801`56c8b7bf
Caused By Driver : nvlddmkm.sys
Caused By Address : nvlddmkm.sys+1550b8
File Description :
Product Name :
Company :
File Version :
Processor : x64
Crash Address : ntoskrnl.exe+16c3f0
Stack Address 1 :
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\WINDOWS\Minidump\070417-8000-01.dmp
Processors Count : 6
Major Version : 15
Minor Version : 15063
Dump File Size : 633,708
Dump File Time : 04/07/2017 09:01:42

Any ideas?

 

[jamiepugh]

Hi

Can anyone help? I'm at a loss here...

Thanks
Jamie

 

[johnbl]

put some of your current memory dumps from c:\windows\minidump directory on a cloud server like Microsoft onedrive, share the file for public access and post a link.

one of the bugchecks was a object corruption, if this was done by software you might find that running driver verifier will allow you to catch the problem and produce a bugcheck memory dump that names the corrupting driver.
to do this you would start cmd.exe as an admin then run
verifier.exe /standard /all
then reboot your machine and wait for the next bugcheck. it would be useful to change the memory dump type from minidump to a kernel memory dump so all of the debug info is not stripped out of the memory dump.
the kernel memory dump is large and is stored at c:\window\memory.dmp

note: be sure you know how to get into safe mode so you can turn off verifier if the system bugchecks on boot.
to turn of verifier you run the command:
verifier.exe /reset
(after testing you should run this command or your machine will run slowly until you do)

Hi

Can anyone help? I'm at a loss here...

Thanks
Jamie

 

[jamiepugh]

Hi

I have done the driver veryfier thing.

Here are the mini dump links
https://1drv.ms/u/s!AtpRTO4SgqXlv3562cUmzsIu7z9K
https://1drv.ms/u/s!AtpRTO4SgqXlv30d6R2I0f5_8Udf
https://1drv.ms/u/s!AtpRTO4SgqXlv3_KEfV0jNYCEtMx
https://1drv.ms/u/s!AtpRTO4SgqXlv3wGH_SdLnouVd2u

Thanks

 

[jamiepugh]

Hi

System seems a lot more stable, but I have had a BSOD today.

Here is he kernal dump - sorry its 1.5GB

https://1drv.ms/u/s!AtpRTO4SgqXlwAbdK0VdtMS3vuK8

Thanks