BSOD caused by ntoskrnl.exe

[hornet-wing]

Hi All,

I have been experiencing BSODs for a little while now and I thought the cause was a faulty hard drive as there were times when laptop would fail to start even before it reached the BIOS and I could hear the hard drive not spooling up. Also, the BSOD coincided with when I move the laptop and with the hard drive being the only moving part it made sense that it was the cause. However, after replacing it with a spare SSD I had and reinstalling clean Windows 10 the issue seems to be still there. I have dumps here if anyone would be kind enough to have a look.

Minidump download

System Information (local)
--------------------------------------------------------------------------------

Computer name: DESKTOP-P7N1NQ6
Windows version: Windows 10 , 10.0, build: 17134
Windows dir: C:\Windows
Hardware: 20C6003TUK, LENOVO
CPU: GenuineIntel Intel(R) Core(TM) i5-4200M CPU @ 2.50GHz Intel586, level: 6
4 logical processors, active mask: 15
RAM: 8290516992 bytes total




--------------------------------------------------------------------------------
Crash Dump Analysis
--------------------------------------------------------------------------------

Crash dumps are enabled on your computer.

Crash dump directories:
C:\Windows
C:\Windows\Minidump

On Tue 19/06/2018 13:16:03 your computer crashed or a problem was reported
crash dump file: C:\Windows\Minidump\061918-5734-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x197650)
Bugcheck code: 0x3D (0xFFFF8301FF1FFD38, 0xFFFF8301FF1FF580, 0x0, 0x0)
Error: INTERRUPT_EXCEPTION_NOT_HANDLED
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This bug check appears very infrequently.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Tue 19/06/2018 13:16:03 your computer crashed or a problem was reported
crash dump file: C:\Windows\MEMORY.DMP
This was probably caused by the following module: ntkrnlmp.exe (nt!KeSetEventBoostPriority+0x51)
Bugcheck code: 0x3D (0xFFFF8301FF1FFD38, 0xFFFF8301FF1FF580, 0x0, 0x0)
Error: INTERRUPT_EXCEPTION_NOT_HANDLED
Bug check description: This bug check appears very infrequently.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Tue 19/06/2018 13:08:12 your computer crashed or a problem was reported
crash dump file: C:\Windows\Minidump\061918-4687-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x197650)
Bugcheck code: 0x1E (0xFFFFFFFFC0000005, 0xFFFFF801BEC7B4C0, 0x0, 0xFFFFFFFFFFFFFFFF)
Error: KMODE_EXCEPTION_NOT_HANDLED
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a kernel-mode program generated an exception which the error handler did not catch.
This might be a case of memory corruption. This may be because of a hardware issue such as faulty RAM, overheating (thermal issue) or because of a buggy driver.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

https://drive.google.com/file/d/1nrZCHE8-cAaFwYmNJ-GiqdQPkCprP22c/view

On Tue 19/06/2018 13:04:31 your computer crashed or a problem was reported
crash dump file: C:\Windows\Minidump\061918-6984-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x197650)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF80193A5A9B6, 0xFFFFE38AF430FE90, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

 

[Colif]

who crashed just tells you what crashed, not why. Sometimes it will show the driver name but most times it blames windows. I used to use it but found its faster to just look at the dump files.

all files mentioned are part of the windows kernel
NTOSKRNL = windows kernel. It handles all driver requests, power management, and memory management. It sits between Hardware and Applications. It got blamed but its not the cause
ntkrnlmp.exe = New Technology Kernel Multi Processor

i will get someone to read dump files and convert them into a form I can read

 

[hornet-wing]

Thank you!

 

[gardenman]

Hi, I ran the dump files through the debugger and got the following information: https://pste.eu/p/Ojsk.html

File: 061918-6984-01.dmp (Jun 19 2018 - 08:04:31)
BugCheck: [SYSTEM_SERVICE_EXCEPTION (3B)]
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Uptime: 0 Day(s), 0 Hour(s), 03 Min(s), and 00 Sec(s)

File: 061918-5734-01.dmp (Jun 19 2018 - 08:16:03)
BugCheck: [INTERRUPT_EXCEPTION_NOT_HANDLED (3D)]
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Uptime: 0 Day(s), 0 Hour(s), 07 Min(s), and 19 Sec(s)

File: 061918-4687-01.dmp (Jun 19 2018 - 08:08:12)
BugCheck: [KMODE_EXCEPTION_NOT_HANDLED (1E)]
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Uptime: 0 Day(s), 0 Hour(s), 03 Min(s), and 01 Sec(s)

Either the files were partially corrupt or my debugger couldn't read all of it. There was some useful information gathered though (driver list).

System: ThinkPad Edge E540
https://www3.lenovo.com/gb/en/laptops/thinkpad/edge-series/e540/

I can't help you with this. Wait for additional replies. Good luck.

 

[hornet-wing]

Hi gardenman,
Is there anything I can do / enable to make sure the dump files are complete?

I have another one from just now.

https://drive.google.com/open?id=14lQfaaJ27d5tyYbnKl-qgwk67ntZP7b0

 

[gardenman]

I don't think there's anything that you can do that will fix the problem. It could be the debugger that I'm using, or the Microsoft symbols server, or it could even be bad hardware (such as bad RAM, or a bad disk). It might even be something that I'm doing wrong with the debugger (I'm no expert).

I did go ahead and read the new dump file you posted and will post the info here now: https://pste.eu/p/KBQE.html

File: 061918-4687-01.dmp (Jun 19 2018 - 08:08:12)
BugCheck: [KMODE_EXCEPTION_NOT_HANDLED (1E)]
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Uptime: 0 Day(s), 0 Hour(s), 03 Min(s), and 01 Sec(s)

This one also appears corrupt, or like I said above, it could be my debugger or my lack of knowledge.

One question, I noticed that you have 2 different types of RAM... are you 100% sure they are compatible? Have you tried removing one of the RAM chips and testing, then try the other RAM chip? While you are doing that I would also test with the free version of [memtest86]. Basically you put it on a flash drive and boot up to that flash drive and run the tests. It's better if you test one RAM chip at a time.

I would test your RAM while you wait for additional replies. Good luck.

 

[hornet-wing]

Hi gardenman,
I ran memetest86 (admittedly for longer than I needed to) and it does certainly look like a memory error. I am testing each stick individually and each slot.

 

[Colif]

considering only error count you want is 0 it sure does. Any sticks with errors need to be removed before you can stop random errors.

 

[hornet-wing]

So I tested both stick individually in both slots (4 tests), all passed. Then I tested them together in the slots they were originally in and it all passed again. I am not sure what that means :/

I have now replaced one of the sticks with a matching one that passed too. So at least I now have matching sticks and I'll see how that goes.

 

[gardenman]

It could have been something as simple as 1 of the RAM chips being slightly loose in its slot. As you moved them around and snapped them back in, problem fixed. Unlikely, but possible.

Hopefully the new RAM works out. I always prefer matching RAM, same model # and everything.

If not and you have more BSODs, upload the dump files.

 

[Colif]

Does it have a CD drive in it? There is anew BIOS for laptop dated March 2018 but it creates a bootable CD

Sometimes BIOS upgrades can fix errors as well - https://pcsupport.lenovo.com/au/en/products/LAPTOPS-AND-NETBOOKS/THINKPAD-EDGE-LAPTOPS/THINKPAD-EDGE-E540/downloads/DS037208

You can try automatic driver update here as well - https://pcsupport.lenovo.com/au/en/products/laptops-and-netbooks/thinkpad-edge-laptops/thinkpad-edge-e540/downloads

 

[hornet-wing]

Good spot, i'll give it a go. Thank you!

 

[hornet-wing]

Updated the BIOS and reinstalled Windows again, it was all looking good but then I got another just as I moved the laptop. Here is the dump:
https://drive.google.com/file/d/1nN2-PB8iAjyAuflZGgQs6Hru_X7Ri31f/view?usp=sharing

Hope it contains the full report this time.

 

[gardenman]

I ran the dump file through the debugger and got the following information: https://pste.eu/p/4uQf.html

File: 062218-3296-01.dmp (Jun 22 2018 - 14:32:15)
BugCheck: [INTERRUPT_EXCEPTION_NOT_HANDLED (3D)]
Probably caused by: ntkrnlmp.exe (Process: System)
Uptime: 0 Day(s), 0 Hour(s), 03 Min(s), and 49 Sec(s)

This dump file appears to be intact.

I can't help you with this. Wait for additional replies. Good luck.

 

[Colif]

Try running this on CPU - https://downloadcenter.intel.com/download/19792/Intel-Processor-Diagnostic-Tool
Might also want to run Prime95, just checking stability of CPU

1 fix I found was to try this
right click start button
choose powershell (admin)
type SFC /scannow and press enter


At least its the same BSOD every time. It is consistent I am now looking for what cause might be, it seems like most BSOD it can be hardware or software. I don't see this one very often

I wonder if you need Intel smart connect as its from 2012.

try the steps here in 1st answer, don't do reset yet. - https://answers.microsoft.com/en-us/windows/forum/windows_10-power/bsod-interrupt-exception-not-handled-windows-10/ac142910-e147-424e-866e-2db56a42c52f

 

[hornet-wing]

Ran the Intel Diagnostic Tool several times and all passed
Ran Prime95 for several hours and nothing unusual happened and it was passing.
SFC /scannow found nothing.

Installed smart connect it did seem to change anything, I was still able to trigger a the BSOD moving the laptop around.

I went with method 3 (Boot into Safe Mode) and I was still able to trigger the BSOD by moving the laptop.

 

[Colif]

Moving laptop causes error... that makes me think its a hardware problem. I just don't know what exactly.

Its not CPU, its not ram, its not ssd (unless its the connection with drive itself)
Because it happens in safe mode, its not likely to be drivers and I can't think of a reason moving laptop would cause software to cause this anyway.
Bios update didn't fix it.

did you run the auto update feature on Lenova web site? Perhaps go here - link - and under diagnostics, choose LSC Lite for Windows 64-bit and see if it finds any problems

If its still under warranty I would be tempted to get Lenova to look at it.