BSOD like clockwork when trying to complete windows related tasks.

[Brock1025]

I have no idea what is going on with my computer any more. I never really had issues with it till the last couple of weeks, other than a slight problem with my motherboard, but that wouldn't explain what's been happening to my computer lately.

I try to run a backup, it gives a BSOD and restarts without completing the backup. I try to reset the computer, BSOD and restarts without resetting the computer. I try to sign out through ctrl+alt+del, BSOD and restarts. In the first week I wouldn't even have to be at home for a BSOD to happen and my computer restart. I've slightly fixed it but I'm still getting BSOD and I can't for the life of me figure out what is going on.

Sfc /scannow returns no errors, chkdsk gives no errors, memtest gives no errors. It wont blue screen in day to day if I don't try to do anything related to built in tasks, only when windows tries to complete some task will it give an error and restart.

Two weeks I've been at this with no success in ending the barrage of BSOD. This is the first time I've ever even gotten the blue screens with this computer since I built it years ago.

Some of the BSOD that I've been in front of the computer to see:
-Page Fault in Nonpage Area
-Kernel Mode Heap Corruption
-Kmode Exception Not Handled
-PFN List Corrupt
-Bad Header Pool
-Memory Management
-System Service Exception

Computer specs:
-i5-4570
-Z87-G43 MSI Gaming motherboard
-16GB gskill ram
-GTX 960
-Windows 10 Pro

Any help at all would be greatly appreciated. Any ideas on what could be the issue? I could just reinstall, but I would much rather try to fix the issue. I've spent a long time customizing things.

I've never lost any data unless I was switching OS's so I don't have any backups to go to, data loss only became a concern recently when I started college.

 

[Colif]

1. Can you download and run who crashed - it will give us a glimpse of the errors you getting and might help us solve them

Copy/paste summary in here and I see what I can do

2. Can you follow option one here
and then do this step below: Small memory dumps - Have Windows Create a Small Memory Dump (Minidump) on BSOD

that creates a file in c windows/minidump
copy that file to documents
upload the copy from documents to a cloud server and share the link here and someone with right software to read them will help you fix it

 

[Brock1025]

1. Can you download and run who crashed - it will give us a glimpse of the errors you getting and might help us solve them

Copy/paste summary in here and I see what I can do

2. Can you follow option one here
and then do this step below: Small memory dumps - Have Windows Create a Small Memory Dump (Minidump) on BSOD

that creates a file in c windows/minidump
copy that file to documents
upload the copy from documents to a cloud server and share the link here and someone with right software to read them will help you fix it

--------------------------------------------------------------------------------
Crash Dump Analysis
--------------------------------------------------------------------------------

Crash dump directory: C:\WINDOWS\Minidump

Crash dumps are enabled on your computer.

On Mon 7/31/2017 11:28:30 PM your computer crashed
crash dump file: C:\WINDOWS\Minidump\073117-39671-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x14F960)
Bugcheck code: 0x13A (0x3, 0xFFFFF6A443600000, 0xFFFFF6A443690B40, 0x0)
Error: CUSTOM_ERROR
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Mon 7/31/2017 11:28:30 PM your computer crashed
crash dump file: C:\WINDOWS\memory.dmp
This was probably caused by the following module: win32kbase.sys (win32kbase!HMFreeObject+0x168)
Bugcheck code: 0x13A (0x3, 0xFFFFF6A443600000, 0xFFFFF6A443690B40, 0x0)
Error: CUSTOM_ERROR
file path: C:\WINDOWS\system32\win32kbase.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Base Win32k Kernel Driver
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.



On Mon 7/31/2017 10:04:24 AM your computer crashed
crash dump file: C:\WINDOWS\Minidump\073117-34359-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x14F960)
Bugcheck code: 0x19 (0x3, 0xFFFFBD0D2C2388C0, 0xFFFFBD4D2C2388C0, 0xFFFFBD0D2C2388C0)
Error: BAD_POOL_HEADER
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a pool header is corrupt.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules. This problem might also be caused because of overheating (thermal issue).
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Mon 7/31/2017 9:55:49 AM your computer crashed
crash dump file: C:\WINDOWS\Minidump\073117-87328-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x14F960)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF8017FAA0F09, 0xFFFFDF002E8B6680, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Mon 7/31/2017 9:47:10 AM your computer crashed
crash dump file: C:\WINDOWS\Minidump\073117-106218-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x14F960)
Bugcheck code: 0x1E (0xFFFFFFFFC0000005, 0xFFFFF802B8EDB038, 0x0, 0x40000)
Error: KMODE_EXCEPTION_NOT_HANDLED
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a kernel-mode program generated an exception which the error handler did not catch.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.





--------------------------------------------------------------------------------
Conclusion
--------------------------------------------------------------------------------

45 crash dumps have been found and analyzed. Only 5 are included in this report. A third party driver has been identified to be causing system crashes on your computer. It is strongly suggested that you check for updates for these drivers on their company websites. Click on the links below to search with Google for updates for these drivers:

ampse.sys (AMP Scan Engine driver, CYREN Inc.)


------------------------------------------------------------------------------
That's the full report from whocrashed, I did update two drivers (a chipset and graphics driver from intel), but neither related to the one suggested by the program. I rolled the chipset driver that i installed back, but the graphics driver hasn't been rolled back, could a graphics driver cause this type of issue?

This is a link to dropbox for the latest minidump file, created 7/31/2017.
https://www.dropbox.com/s/pcn9c3ypgxaezlm/073117-106218-01.dmp?dl=0

 

[gardenman]

Hi, I ran the dump file through the debugger and got the following information: https://pastebin.com/M22DLkbN

File: 073117-106218-01.dmp (Mon Jul 31 09:47:10.899 2017)
BugCheck: [KMODE_EXCEPTION_NOT_HANDLED (1E)] {ffffffffc0000005, fffff802b8edb038, 0, 40000}
Probably caused by: memory_corruption (Process: svchost.exe)

Tip: Providing more than 1 minidump can be useful. Each crash creates a minidump. Crashes can be caused by different things. You might have 1 video driver crash and 5 wifi card crashes. If you only upload the dump file when the video driver crashed, then we won't see the wifi card crashes. A good number is between 5 and 10 of your latest dumps. We definitely don't need all 45! Feel free to ZIP them up.

I can't help you with this. Wait for someone else to reply. Good luck.

 

[Brock1025]

Hi, I ran the dump file through the debugger and got the following information: https://pastebin.com/M22DLkbN

File: 073117-106218-01.dmp (Mon Jul 31 09:47:10.899 2017)
BugCheck: [KMODE_EXCEPTION_NOT_HANDLED (1E)] {ffffffffc0000005, fffff802b8edb038, 0, 40000}
Probably caused by: memory_corruption (Process: svchost.exe)

Tip: Providing more than 1 minidump can be useful. Each crash creates a minidump. Crashes can be caused by different things. You might have 1 video driver crash and 5 wifi card crashes. If you only upload the dump file when the video driver crashed, then we won't see the wifi card crashes. A good number is between 5 and 10 of your latest dumps. We definitely don't need all 45! Feel free to ZIP them up.

I can't help you with this. Wait for someone else to reply. Good luck.

Thank you for trying anyway

For whoever wants to, here's a dropbox link for a zip of the last 10 dumps, from 7/27 to 7/31:
https://www.dropbox.com/s/n1talfc3ngs64j9/10%20mini%20dumps.zip?dl=0

Any help will be much appreciated, and if I find a fix on my own I'll post here as well

 

[gardenman]

Hi Brock, give Colif time to reply... I'm sure he'll be able to help you. I just provide some info that is useful to him (and others) if needed. Here's the info from new dump files you posted: https://pastebin.com/sg1u9dsw

Spoiler

File: 073017-131078-01.dmp (Sun Jul 30 21:19:52.791 2017)
BugCheck: [PAGE_FAULT_IN_NONPAGED_AREA (50)] {ffffe10c0000555f, 0, fffff805de7ccae6, 2}
Warning: Unable to verify timestamp for: ampse.sys
Probably caused by: memory_corruption (Process: NVDisplay.Container.exe)

File: 073117-33203-01.dmp (Mon Jul 31 02:12:19.527 2017)
BugCheck: [DPC_WATCHDOG_VIOLATION (133)] {1, 1e00, fffff803f31b7540, 0}
Probably caused by: ntkrnlmp.exe (Process: System)

File: 073117-34359-01.dmp (Mon Jul 31 10:04:24.618 2017)
BugCheck: [BAD_POOL_HEADER (19)] {3, ffffbd0d2c2388c0, ffffbd4d2c2388c0, ffffbd0d2c2388c0}
Warning: Unable to verify timestamp for: ampse.sys
Probably caused by: ampse.sys (Process: svchost.exe)

File: 073117-39671-01.dmp (Mon Jul 31 23:28:30.116 2017)
BugCheck 13A, {3, fffff6a443600000, fffff6a443690b40, 0}
Probably caused by: win32kbase.sys (Process: RzSynapse.exe)

File: 073117-87328-01.dmp (Mon Jul 31 09:55:49.196 2017)
BugCheck: [SYSTEM_SERVICE_EXCEPTION (3B)] {c0000005, fffff8017faa0f09, ffffdf002e8b6680, 0}
Probably caused by: ntkrnlmp.exe (Process: KillerService.exe)

File: 073117-106218-01.dmp (Mon Jul 31 09:47:10.899 2017)
BugCheck: [KMODE_EXCEPTION_NOT_HANDLED (1E)] {ffffffffc0000005, fffff802b8edb038, 0, 40000}
Probably caused by: memory_corruption (Process: svchost.exe)

File: 072717-134343-01.dmp (Thu Jul 27 11:19:07.832 2017)
BugCheck: [KMODE_EXCEPTION_NOT_HANDLED (1E)] {ffffffffc000001d, fffff8022741ac9f, ffffe00dbba10800, 0}
Probably caused by: ntkrnlmp.exe (Process: GWCtlSrv.exe)

File: 072817-122609-01.dmp (Fri Jul 28 17:40:01.502 2017)
BugCheck: [SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007E)] {ffffffffc0000005, fffff802b64c275c, ffffd880a5e638c8, ffffd880a5e63100}
Probably caused by: memory_corruption (Process: System)

File: 072817-143984-01.dmp (Fri Jul 28 19:31:18.738 2017)
BugCheck: [PFN_LIST_CORRUPT (4E)] {99, 2d1414, 2, e0004000040431c}
Warning: Unable to verify timestamp for: ampse.sys
Probably caused by: memory_corruption (Process: dllhost.exe)

File: 073017-68312-01.dmp (Sun Jul 30 21:14:23.929 2017)
BugCheck: [SYSTEM_SERVICE_EXCEPTION (3B)] {c0000005, fffff800f2ac0a30, ffff8280bf80ed30, 0}
Probably caused by: memory_corruption (Process: dwm.exe)

Sometimes this helps Colif and others point out a driver or hardware that could be the cause of the crashes. Wait for Colif or someone else to reply.

 

[Colif]

top one blames Authentium AntiVirus5 driver, as does 3rd one down... have you got latest version? I haven't hear their name before. File is dated Tue Mar 25 2014 so update or remove it.

Update Killer drivers, yours are from 2015: http://www.killernetworking.com/driver-downloads (your model is e2200)
Update Synapse as you have 2015 software

old drivers that might be cause: (I selected all files older than 2 years, some might be fine as there may not be newer versions)

PxHlpa64.sys (Dated Mon Oct 17 2011) - it might be okay, its a CD/DVD driver, there just might not be a newer one.
SeLow_x64.sys (Dated Sun Oct 18 2015) - SoftEther VPN Driver
Neo6_x64_VPN.sys - Soft either
gwdrv.sys (Dated Fri May 29 2015) - GlassWire Network Security driver - this program was mentioned in one of the errors, it said GWCtlSrv.exe in the bsod
rawdsk3.sys (Dated Tue Feb 11 2014) - EldoS Corporation RawDisk Driver
AE3000w764.sys (Dated Fri Mar 2 2012) - Ralink 802.11n Wireless Adapter Driver
USBPcap.sys (dated Fri Oct 2 2015) - http://desowin.org/usbpcap/ - doesn't look like a newer version, might be fine
npf.sys (Dated Thu Feb 28 2013) - NPF stands for NetGroup Packet Filter Driver
MBfilt64.sys (Dated Thu Jul 30 2009) - Realtek HD Audio driver for Win 8, you can get latest from https://www.tenforums.com/drivers-hardware/5993-latest-realtek-hd-audio-driver-version.html

Intel drivers
ICCWDT.sys (Dated Wed Jan 23 2013) - Intel(R) Watchdog Timer Driver
XtuAcpiDriver.sys (Dated Thu Feb 26 2015) - Intel extreme tuning BIOS interface driver
ISCTD64.sys (Dated Tue Nov 27 2012) - Intel Smart Connect Technology Driver (I would remove this)

 

[Brock1025]

top one blames Authentium AntiVirus5 driver, as does 3rd one down... have you got latest version? I haven't hear their name before. File is dated Tue Mar 25 2014 so update or remove it.

Update Killer drivers, yours are from 2015: http://www.killernetworking.com/driver-downloads (your model is e2200)
Update Synapse as you have 2015 software

old drivers that might be cause: (I selected all files older than 2 years, some might be fine as there may not be newer versions)

PxHlpa64.sys (Dated Mon Oct 17 2011) - it might be okay, its a CD/DVD driver, there just might not be a newer one.
SeLow_x64.sys (Dated Sun Oct 18 2015) - SoftEther VPN Driver
Neo6_x64_VPN.sys - Soft either
gwdrv.sys (Dated Fri May 29 2015) - GlassWire Network Security driver - this program was mentioned in one of the errors, it said GWCtlSrv.exe in the bsod
rawdsk3.sys (Dated Tue Feb 11 2014) - EldoS Corporation RawDisk Driver
AE3000w764.sys (Dated Fri Mar 2 2012) - Ralink 802.11n Wireless Adapter Driver
USBPcap.sys (dated Fri Oct 2 2015) - http://desowin.org/usbpcap/ - doesn't look like a newer version, might be fine
npf.sys (Dated Thu Feb 28 2013) - NPF stands for NetGroup Packet Filter Driver
MBfilt64.sys (Dated Thu Jul 30 2009) - Realtek HD Audio driver for Win 8, you can get latest from https://www.tenforums.com/drivers-hardware/5993-latest-realtek-hd-audio-driver-version.html

Intel drivers
ICCWDT.sys (Dated Wed Jan 23 2013) - Intel(R) Watchdog Timer Driver
XtuAcpiDriver.sys (Dated Thu Feb 26 2015) - Intel extreme tuning BIOS interface driver
ISCTD64.sys (Dated Tue Nov 27 2012) - Intel Smart Connect Technology Driver (I would remove this)

From what I can tell, updating those drivers and removing what I could of residual drivers from uninstalled programs fixed my issue, and somehow stopped the A2 boot error I couldn't get rid of. The backup completed successfully for the first time.

Thank you so much for this, you guys are amazing!!

(Just to let you know: The Authentium AntiVirus5 is in multiple programs, but the one that's on my computer is from System Mechanic which is an optimization and protection tool. Parts of it didn't get removed when I deleted it in 2014 in windows 7, I can't stop the desktop icon and I can't delete the driver, but untill now I never got BSOD so I don't mind ignoring it.)