BSOD hal.dll and ntoskrnl.exe / WHEA Uncorrectable error

[shiiire]

Week ago my brother switched old hard drive with win10 on and then the newer one with win10 back again. All kinds of problems started. Windows wouldn't boot even from USB, don't remember how he got it working again and what happened in which order.
When playing a game it crashed few times with random access violation error. He reinstalled graphic drivers and nothing seemed to work.
All hell broke loose. He got BSOD irql_not_less_or_equal. After googling and testing I came to an conclusion that there was a problem with RAM which memtest confirmed. So he bought new ones.

Today when he got home black screen was waiting. After awhile he got Memory Management error, PCI express root complex. And then another irql_not_less_or_equal. Googling again for hours he decided to just reinstall windows.
It was good for awhile until this WHEA thing. Is it just bad luck or are these all connected. All seems to have something to do with bad drivers?

CPU, pass
Memory, pass
sfc scan, pass
did this one too from some other post (don't know the results or what it does): dism.exe /online /cleanup-image /restorehealth

Anyhow hopefully we managed to fix the problem. Since there was one notification with cooling system drivers in device manager. Also he used some software which pointed out that he had some old can't remember what drivers. But still would like to hear an opinion from someone in case this problem continues tomorrow. Like could it still be hardware issue?

Not sure it this helps at all:
https://www.dropbox.com/s/suwxs9pcmx5bu4f/minidump.png?dl=0

Thanks

 

[Colif]

what did he do? He swapped win 10 hdd for an old one and then put the usual hdd back in again?

In a PCI Express (PCIe) system, a root complex device connects the processor and memory subsystem to the PCI Express switch fabric composed of one or more switch devices.

Similar to a host bridge in a PCI system, the root complex generates transaction requests on behalf of the processor, which is interconnected through a local bus. Root complex functionality may be implemented as a discrete device, or may be integrated with the processor. A root complex may contain more than one PCI Express port and multiple switch devices can be connected to ports on the root complex or cascaded.[2]

https://en.wikipedia.org/wiki/Root_complex

Can't say I seen that error before.

WHEA = Windows Hardware Error Architecture. Its an error called by the CPU but not necessarily caused by it.
NTOSKRNL = windows kernel. It handles all driver requests, power management, and memory management. It sits between Hardware and Applications. It got blamed but its not the cause
HAL.dll = Hardware Abstraction Layer. Works with ntoskrnl to carry out driver requests

IRQ errors are often drivers, not ram. They can be ram but 90% of time, its drivers

Remove any overclocks, remove any overclocking software. If you have an Intel CPU, run Intel processor diagnostic tool (Unless that is how you tested CPU already.

I can't read dumps but someone will for you, or decode them so i can see more.

 

[gardenman]

Hi, copy the minidumps from the following folder: C:\Windows\minidump
to your desktop or documents folder then upload them to a public server so others can download and review them. Any place will do, such as a Google drive or a Microsoft OneDrive account. Make the files public so they can be downloaded by anyone and provide the link here.

 

[shiiire]

Colif: Yes that's what he did.. And yes that's exaclty how we tested CPU.

-------------

Hi, copy the minidumps from the following folder: C:\Windows\minidump
to your desktop or documents folder then upload them to a public server so others can download and review them. Any place will do, such as a Google drive or a Microsoft OneDrive account. Make the files public so they can be downloaded by anyone and provide the link here.

So today he told me that he installed Win again, after graphic driver installation there was some notification: "Display driver failed to start; using Microsoft Basic Display Driver instead". And hole punch of other errors like "settingsynchost.exe".

Here's the dump and screenshot from BlueScreenView from todays BSOD that happened just now.

https://www.dropbox.com/sh/2nzgwtzt47x454o/AACeW6w6gJteHzmgi6p8KE_8a?dl=0

 

[gardenman]

The minidump you uploaded is 0 bytes, meaning we can't use it. Did you copy it to another folder before trying to upload it? If not, try again and before you upload it, right click on it and make sure it's not 0 bytes. Also after it's uploaded, make sure it isn't 0 bytes.

 

[shiiire]

There you go.. replaced it with working one.

 

[gardenman]

I ran the dump file through the debugger and got the following information: https://pastebin.com/rEXZPAz6

File: 090617-13265-01.dmp (Wed Sep 6 13:35:27.996 2017)
BugCheck: [PAGE_FAULT_IN_NONPAGED_AREA (50)]
*** WARNING: Unable to verify timestamp for FSgk.sys
*** WARNING: Unable to verify timestamp for fshs.sys
Probably caused by: memory_corruption (Process: opera.exe)
System Uptime: 0 days 1:05:32.674

I am not an expert debugger mini dump reader person, but there are few on here and if you are lucky they will stop by and help. Others may be able to help with the drivers.

My suggestion: For now, remove F-Secure to see if the BSODs stop or the frequency of them drop.

Consider updating as many as the older drivers as you can. You can find a list of them in the 3rd Party Drivers section in the first link I posted above. Maybe this will help too: https://www.asus.com/us/Motherboards/P8Z77V_LX/HelpDesk_Download/

I can't help you with this. Wait for someone else to reply. Good luck.

 

[axe0axe0]

We could use more dumps to get a clearer picture of what we're dealing with.

Let your brother get some crashes, if the above suggestion about F-secure doesn't help, then follow below link (ignore the tests) and upload the zip with extra information to dropbox.
https://www.sysnative.com/forums/bsod-crashes-kernel-debugging/68-blue-screen-of-death-bsod-posting-instructions-windows-10-8-1-8-7-vista.html



A 0x124 PCI-e error? That's one you don't see often, in my opinion it's 1 of the easier crashes as they point to a max of 2 device drivers (shared addresses) and either of them is guaranteed the cause. One just has to be lucky the offending devices haven't been removed and the hardware database hasn't been rebuild, because if that happens, it could be nearly impossible to track down the offending devices.