Not your normal BSOD post

axe0 · Jan 28, 2022

TheMystic said:
I concluded that this problem mostly arises due to the user installing something incompatible.

To be fair, it's usually because software becomes incompatible after an update which can happen years after the installation of said software.

jbcarreon123 · Jan 28, 2022

zbook said:
There were 5 unexpected shutdowns and restarts during the past 20 days.
One was the the BSOD with bugcheck EF.

Had you powered off for any hangs and freezes?

Dell does not support Windows 11 on the computer:

Supported Operating Systems | Dell US

There were multiple event viewer entries related to the disk drive including corruption of the Master File Table (MFT)

Please test the drives:

Code:

------------------------ Disk & DVD/CD-ROM Drives ------------------------ Drive: C: Free Space: 77.7 GB Total Space: 113.8 GB File System: NTFS Model: Patriot Burst Drive: D: Free Space: 72.8 GB Total Space: 113.9 GB File System: NTFS Model: Patriot Burst

1) Please make a new restore point:

Create System Restore Point in Windows 11 Tutorial

This tutorial will show you how to manually create a restore point in Windows 11. Turning on system protection for a drive allows System Restore to include the drive when restore points are created so you can undo undesired system changes by reverting to a previous point in time. System...

www.elevenforum.com

2) Please run:

a) HD Tune: (free or trial version)

HD Tune website

HD Tune

www.hdtune.com

Post images for results on these tabs:
a) Health
b) Benchmark
c) Full error scan

b) Sea Tools for Windows:

SeaTools | Support Seagate US

SeaTools - Quick diagnostic tool that checks the health of your drive.

www.seagate.com

long generic test

c) Open administrative command prompt and type or copy and paste:

chkdsk /r /v W:

Change the letter W: to the applicable drive.

Test all drives using the syntax: chkdsk /r /v C: or chkdsk /r /v D: or chkdsk /r /v E: etc.

C:\WINDOWS\system32>chkdsk /r /v
The type of the file system is NTFS.
Cannot lock current drive.

Chkdsk cannot run because the volume is in use by another
process. Would you like to schedule this volume to be
checked the next time the system restarts? (Y/N)

Type: Y

3) These tests can be performed overnight:
a) HD Tune full error scan
b) Sea Tools for Windows long generic test
c) Chkdsk /r /v C:

Code:

The IO operation at logical block address 0x10b56a90 for Disk 0 (PDO name: \Device\00000037) was retried.

Code:

The IO operation at logical block address 0xfe67380 for Disk 0 (PDO name: \Device\00000037) was retried.

Code:

The IO operation at logical block address 0x127d74f8 for Disk 0 (PDO name: \Device\00000037) was retried.

Code:

The driver detected a controller error on \Device\Harddisk4\DR8.

Code:

A corruption was discovered in the file system structure on volume \\?\Volume{97c77eb2-79b8-4187-a868-79fc63111b32}. The exact nature of the corruption is unknown. The file system structures need to be scanned online.

Code:

A corruption was discovered in the file system structure on volume \\?\Volume{93e0e9a5-a191-4ee5-bc11-9a779709eb8d}. The Master File Table (MFT) contains a corrupted file record. The file reference number is 0x1000000000000. The name of the file is "<unable to determine file name>".

Code:

The default transaction resource manager on volume \\?\Volume{97c77eb2-79b8-4187-a868-79fc63111b32} encountered a non-retryable error and could not start.

Thanks.
I will run it later.

It looks like if this isn't going to support Win11. Clean installing Win10 if have time.

zbook · Jan 28, 2022

The drive file system is corrupted.
The drive needs to be tested.
The same findings could appear with Windows 7, 8, 10 or 11.

The drive size is relatively small.

When available please post test results.

jbcarreon123 · Jan 28, 2022

Created a Restore Point:

HD tune
Health

Benchmark

Error Scan

I will run others later.

/EDIT 1
CHKDSK

Code:

Microsoft Windows [Version 10.0.22000.438]
(c) Microsoft Corporation. All rights reserved.

==============================
  jbcarreon123's CMD AutoRun
------------------------------
  PC Name: JB-PC
  RunAs Admin? True
  Windows Version:
  Microsoft Windows 11 Pro
==============================

C:\Users\jbcarreon123>chkdsk /r /v C:
The type of the file system is NTFS.
Cannot lock current drive.

Chkdsk cannot run because the volume is in use by another
process.  Would you like to schedule this volume to be
checked the next time the system restarts? (Y/N) y

This volume will be checked the next time the system restarts.

C:\Users\jbcarreon123>chkdsk /r /v D:
The type of the file system is NTFS.

Chkdsk cannot run because the volume is in use by another
process.  Chkdsk may run if this volume is dismounted first.
ALL OPENED HANDLES TO THIS VOLUME WOULD THEN BE INVALID.
Would you like to force a dismount on this volume? (Y/N) n

Chkdsk cannot run because the volume is in use by another
process.  Would you like to schedule this volume to be
checked the next time the system restarts? (Y/N) y

This volume will be checked the next time the system restarts.

C:\Users\jbcarreon123>

/EDIT 2
SeaTools - Long Generic Test

zbook · Jan 28, 2022

When available please post results from post #18 and chkdsk results:

Check Disk (chkdsk) - Read Event Viewer Log

How to Read the Event Viewer Log for Check Disk (chkdsk) in Vista, Windows 7, and Windows 8

www.sevenforums.com

At some time the computer was running hot (up to 91 degrees Fahrenheit).

Please run:
Hard Disk Sentinel (free or trial version)

Hard Disk Sentinel - HDD health and temperature monitoring

Monitoring hard disk health and temperature. Test and repair HDD problems, predict disk failure.

www.hdsentinel.com

Post images for results on these tabs:
a) Overview
b) Temperature
c) SMART

jbcarreon123 · Jan 28, 2022

zbook said:
When available please post results from post #18 and chkdsk results:

Check Disk (chkdsk) - Read Event Viewer Log

How to Read the Event Viewer Log for Check Disk (chkdsk) in Vista, Windows 7, and Windows 8

www.sevenforums.com

At some time the computer was running hot (up to 91 degrees Fahrenheit).

Please run:
Hard Disk Sentinel (free or trial version)

Hard Disk Sentinel - HDD health and temperature monitoring

Monitoring hard disk health and temperature. Test and repair HDD problems, predict disk failure.

www.hdsentinel.com

Post images for results on these tabs:
a) Overview
b) Temperature
c) SMART

CHKDSK results:
below
I modified the command a little bit to make sure it will parse to my Relocated Desktop

Code:

get-winevent -FilterHashTable @{logname="Application"; id="1001"}| ?{$_.providername –match "wininit"} | fl timecreated, message | out-file D:\RELDesktop\CHKDSKResults.txt

HD Sentinel:
Overview

Temps

S.M.A.R.T.

Tuneup_plus_log
below (log files not allowed), and

Code:

    Started on Sat 01/29/2022 at 10:55:49.44 

        [SFC /ScanNow] 

Beginning system scan.  This process will take some time.

Results: 
 
Windows Resource Protection did not find any integrity violations.
 
==================================================================

    Started on Sat 01/29/2022 at 11:00:02.30 

        [DISM /online /cleanup-image /ScanHealth] 

Deployment Image Servicing and Management tool
Version: 10.0.22000.1

Image Version: 10.0.22000.438 
 
No component store corruption detected.

The operation completed successfully. 
 
==================================================================

    Started on Sat 01/29/2022 at 11:03:17.05 

        [DISM /online /cleanup-image /RestoreHealth] 

Deployment Image Servicing and Management tool
Version: 10.0.22000.1

Image Version: 10.0.22000.438 
 
The restore operation completed successfully.

The operation completed successfully. 
 
==================================================================

The second "SFC /ScanNow" was skipped, as the first output the following:

Windows Resource Protection did not find any integrity violations.
 
==================================================================

    Started on Sat 01/29/2022 at 11:06:04.67 

        [ChkDsk /Scan]  
 
The type of the file system is NTFS.
Volume label is Windows 11.
 
Stage 1: Examining basic file system structure ... 
297984 file records processed.                                                        
File verification completed.
Phase duration (File record verification): 4.89 seconds.
6467 large file records processed.                                   
Phase duration (Orphan file record recovery): 4.66 milliseconds.
0 bad file records processed.                                     
Phase duration (Bad file record checking): 0.07 milliseconds.
 
Stage 2: Examining file name linkage ... 
10656 reparse records processed.                                      
433280 index entries processed.                                                       
Index verification completed.
Phase duration (Index verification): 14.63 seconds.
0 unindexed files scanned.                                        
Phase duration (Orphan reconnection): 908.77 milliseconds.
0 unindexed files recovered to lost and found.                    
Phase duration (Orphan recovery to lost and found): 0.90 milliseconds.
10656 reparse records processed.                                      
Phase duration (Reparse point and Object ID verification): 35.61 milliseconds.
 
Stage 3: Examining security descriptors ... 
Security descriptor verification completed.
Phase duration (Security descriptor verification): 57.05 milliseconds.
67649 data files processed.                                           
Phase duration (Data attribute verification): 0.08 milliseconds.
CHKDSK is verifying Usn Journal...
39063496 USN bytes processed.                                                           
Usn Journal verification completed.
Phase duration (USN journal verification): 309.41 milliseconds.

Windows has scanned the file system and found no problems.

No further action is required.
 
116486143 KB total disk space. 
32336540 KB in 223772 files.
164800 KB in 67650 indexes.
0 KB in bad sectors.
410643 KB in use by the system.
65536 KB occupied by the log file.
83574160 KB available on disk.
 
4096 bytes in each allocation unit. 
29121535 total allocation units on disk.
20893540 allocation units available on disk.
Total duration: 20.84 seconds (20842 ms).
 
==================================================================
 
    Started on Sat 01/29/2022 at 11:06:33.33 
 
AutoReboot   
 
TRUE        
 
==================================================================
 
        [Set AutoReboot = False] 
 
Updating property(s) of '\\JB-PC\ROOT\CIMV2:Win32_OSRecoveryConfiguration.Name="Microsoft Windows 11 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition4"'

Property(s) update successful.

==================================================================
 
AutoReboot   
 
FALSE       
 
==================================================================
 
DebugInfoType   
 
7              
 
==================================================================

        [Set DebugInfoType = 7]

Updating property(s) of '\\JB-PC\ROOT\CIMV2:Win32_OSRecoveryConfiguration.Name="Microsoft Windows 11 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition4"'

Property(s) update successful.

==================================================================
 
DebugInfoType   
 
7              
 
==================================================================

        [WMIC PageFile list]

AllocatedBaseSize=2944
CurrentUsage=502
Description=C:\pagefile.sys
InstallDate=20220109040322.424821+480
Name=C:\pagefile.sys
PeakUsage=502
Status=
TempPageFile=FALSE
 
==================================================================
 
AutomaticManagedPagefile   
 
TRUE                      
 
==================================================================

        [Set AutomaticManagedPagefile = True]

Updating property(s) of '\\JB-PC\ROOT\CIMV2:Win32_ComputerSystem.Name="JB-PC"'

Property(s) update successful.

==================================================================
 
AutomaticManagedPagefile   
 
TRUE                      
 
==================================================================

        [BcdEdit /enum {badmemory}]

RAM Defects
-----------
identifier              {badmemory}
 
==================================================================

    Finished on Sat 01/29/2022 at 11:06:36.08
    It took 10 minutes and 46 seconds to complete the operations.

Gather_additional_dump_files
below

zbook · Jan 28, 2022

Please search for: C:\Windows\LiveKernelReports\ResourceTimeout-20220124-2155.dmp

Post a share link using one drive, drop box or google drive.

Open administrative command prompt and type or copy and paste:

PowerShell Compress-Archive "%WinDir%\MEMORY.DMP" "%UserProfile%\Desktop\Memory_dmp"

Post a share link using one drive, drop box or google drive.

Code:

2022-01-24 9:55:15 PM   586.07      C:\Windows\LiveKernelReports\ResourceTimeout-20220124-2155.dmp

Code:

1/25/2022 9:20:12 PM     673.1 C:\Windows\MEMORY.DMP

jbcarreon123 · Jan 28, 2022

zbook said:
Please search for: C:\Windows\LiveKernelReports\ResourceTimeout-20220124-2155.dmp

Post a share link using one drive, drop box or google drive.

Open administrative command prompt and type or copy and paste:

PowerShell Compress-Archive "%WinDir%\MEMORY.DMP" "%UserProfile%\Desktop\Memory_dmp"

Post a share link using one drive, drop box or google drive.

Code:

2022-01-24 9:55:15 PM 586.07 C:\Windows\LiveKernelReports\ResourceTimeout-20220124-2155.dmp

Code:

1/25/2022 9:20:12 PM 673.1 C:\Windows\MEMORY.DMP

DUMPS - Google Drive

drive.google.com

zbook · Jan 28, 2022

I've included multiple scripts / commands into this thread for your script troubleshooting.

Which need further modification?

Please run:
chkdskFromEvent.bat - Click here to go to the BSOD batch repository to download and run this batch file.

jbcarreon123 · Jan 28, 2022

zbook said:
I've included multiple scripts / commands into this thread for your script troubleshooting.

Which need further modification?

Please run:
chkdskFromEvent.bat - Click here to go to the BSOD batch repository to download and run this batch file.

chkdskFromEvent

Code:

Get-WinEvent : There is not an event provider on the localhost computer that matches "ChkDsk".
At line:1 char:1
+ & get-winevent -ProviderName 'ChkDsk' | fl timecreated, message
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (ChkDsk:String) [Get-WinEvent], Exception
    + FullyQualifiedErrorId : NoMatchingProvidersFound,Microsoft.PowerShell.Commands.GetWinEventCommand
 


TimeCreated : 1/29/2022 10:52:26 AM
Message     : 
              
              Checking file system on C:
              The type of the file system is NTFS.
              Volume label is Windows 11.
              
              A disk check has been scheduled.
              Windows will now check the disk.                         
              
              Stage 1: Examining basic file system structure ...
                290816 file records processed.                                                        
              
              File verification completed.
               Phase duration (File record verification): 4.66 seconds.
                6468 large file records processed.                                   
              
               Phase duration (Orphan file record recovery): 4.05 milliseconds.
                0 bad file records processed.                                     
              
               Phase duration (Bad file record checking): 1.27 milliseconds.
              
              Stage 2: Examining file name linkage ...
                10656 reparse records processed.                                      
              
                421092 index entries processed.                                                       
              
              Index verification completed.
               Phase duration (Index verification): 14.43 seconds.
                0 unindexed files scanned.                                        
              
               Phase duration (Orphan reconnection): 723.04 milliseconds.
                0 unindexed files recovered to lost and found.                    
              
               Phase duration (Orphan recovery to lost and found): 948.87 milliseconds.
                10656 reparse records processed.                                      
              
               Phase duration (Reparse point and Object ID verification): 30.26 milliseconds.
              
              Stage 3: Examining security descriptors ...
              Cleaning up 1080 unused index entries from index $SII of file 0x9.
              Cleaning up 1080 unused index entries from index $SDH of file 0x9.
              Cleaning up 1080 unused security descriptors.
              Security descriptor verification completed.
               Phase duration (Security descriptor verification): 71.81 milliseconds.
                65139 data files processed.                                           
              
               Phase duration (Data attribute verification): 1.36 milliseconds.
              CHKDSK is verifying Usn Journal...
                33897976 USN bytes processed.                                                           
              
              Usn Journal verification completed.
               Phase duration (USN journal verification): 281.43 milliseconds.
              
              Stage 4: Looking for bad clusters in user file data ...
                290800 files processed.                                                               
              
              File data verification completed.
               Phase duration (User file recovery): 2.67 minutes.
              
              Stage 5: Looking for bad, free clusters ...
                21205970 free clusters processed.                                                       
              
              Free space verification is complete.
               Phase duration (Free space recovery): 4.31 minutes.
              
              Windows has scanned the file system and found no problems.
              No further action is required.
              
               116486143 KB total disk space.
                31106208 KB in 218467 files.
                  157708 KB in 65140 indexes.
                       0 KB in bad sectors.
                  398343 KB in use by the system.
                   65536 KB occupied by the log file.
                84823884 KB available on disk.
              
                    4096 bytes in each allocation unit.
                29121535 total allocation units on disk.
                21205971 allocation units available on disk.
              Total duration: 7.34 minutes (440761 ms).
              
              Internal Info:
              00 70 04 00 e1 53 04 00 08 fb 07 00 00 00 00 00  .p...S..........
              f4 00 00 00 ac 28 00 00 00 00 00 00 00 00 00 00  .....(..........
              

TimeCreated : 1/29/2022 10:52:26 AM
Message     : 
              
              Checking file system on D:
              The type of the file system is NTFS.
              Volume label is Data.
              
              A disk check has been scheduled.
              Windows will now check the disk.                         
              
              Stage 1: Examining basic file system structure ...
                50432 file records processed.                                                        
              
              File verification completed.
               Phase duration (File record verification): 476.86 milliseconds.
                2 large file records processed.                                   
              
               Phase duration (Orphan file record recovery): 1.38 milliseconds.
                0 bad file records processed.                                     
              
               Phase duration (Bad file record checking): 1.29 milliseconds.
              
              Stage 2: Examining file name linkage ...
                450 reparse records processed.                                      
              
                87620 index entries processed.                                                       
              
              Index verification completed.
               Phase duration (Index verification): 854.78 milliseconds.
                0 unindexed files scanned.                                        
              
               Phase duration (Orphan reconnection): 12.74 milliseconds.
                0 unindexed files recovered to lost and found.                    
              
               Phase duration (Orphan recovery to lost and found): 1.93 milliseconds.
                450 reparse records processed.                                      
              
               Phase duration (Reparse point and Object ID verification): 4.57 milliseconds.
              
              Stage 3: Examining security descriptors ...
              Cleaning up 6 unused index entries from index $SII of file 0x9.
              Cleaning up 6 unused index entries from index $SDH of file 0x9.
              Cleaning up 6 unused security descriptors.
              Security descriptor verification completed.
               Phase duration (Security descriptor verification): 2.35 milliseconds.
                18595 data files processed.                                           
              
               Phase duration (Data attribute verification): 1.35 milliseconds.
              CHKDSK is verifying Usn Journal...
                40706656 USN bytes processed.                                                           
              
              Usn Journal verification completed.
               Phase duration (USN journal verification): 176.11 milliseconds.
              
              Stage 4: Looking for bad clusters in user file data ...
                50416 files processed.                                                               
              
              File data verification completed.
               Phase duration (User file recovery): 2.42 minutes.
              
              Stage 5: Looking for bad, free clusters ...
                18490491 free clusters processed.                                                       
              
              Free space verification is complete.
               Phase duration (Free space recovery): 3.64 minutes.
              
              Windows has scanned the file system and found no problems.
              No further action is required.
              
               116621311 KB total disk space.
                42489244 KB in 22134 files.
                    9892 KB in 18596 indexes.
                       0 KB in bad sectors.
                  160207 KB in use by the system.
                   65536 KB occupied by the log file.
                73961968 KB available on disk.
              
                    4096 bytes in each allocation unit.
                29155327 total allocation units on disk.
                18490492 allocation units available on disk.
              Total duration: 6.09 minutes (365462 ms).
              
              Internal Info:
              00 c5 00 00 26 9f 00 00 71 ac 00 00 00 00 00 00  ....&...q.......
              c2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
              

TimeCreated : 1/23/2022 1:53:37 PM
Message     : A critical system process, C:\Windows\system32\lsass.exe, failed with status code ffffffff.  The machine 
              must now be restarted.

zbook · Jan 29, 2022

The chkdsk displayed cleaning on each drive.
There was no corruption reported using the /r switch.

The disk tests were all ok.

There were multiple dump files (one memory dump, one live kernel dump, and multiple mini dump files).

The live kernel dump displayed a misbehaving GPU driver.

The Intel GPU driver: IGFX, Igdkmd.sys is from 2016.

Please uninstall and reinstall this driver.

Then download and install: Intel Driver and Support Assistant

Download Intel Drivers and Software

Download new and previously released drivers including support software, bios, utilities, firmware and patches for Intel products.

www.intel.com

Run the software to see if it finds a newer driver.

jbcarreon123 · Jan 29, 2022

zbook said:
The chkdsk displayed cleaning on each drive.
There was no corruption reported using the /r switch.

The disk tests were all ok.

There were multiple dump files (one memory dump, one live kernel dump, and multiple mini dump files).

The live kernel dump displayed a misbehaving GPU driver.

The Intel GPU driver: IGFX, Igdkmd.sys is from 2016.

Please uninstall and reinstall this driver.

Then download and install: Intel Driver and Support Assistant

Download Intel Drivers and Software

Download new and previously released drivers including support software, bios, utilities, firmware and patches for Intel products.

www.intel.com

Run the software to see if it finds a newer driver.

Thanks. I will do it later.

I remembered that is the driver that crashed during the 128 partitions DiskParInfo test.

zbook · Jan 29, 2022

After replacing the Intel GPU driver you can either:

a) wait to see if there are any recurrent BSOD

b) run Windows Driver Verifier (WDV)

Enable and Disable Driver Verifier in Windows 10

How to Enable and Disable Driver Verifier in Windows 10

www.tenforums.com

Please list the hardware that you've connected to USB ports during the past month except for flash drives.

Stigg · Jan 29, 2022

tomdsr said:
Is it just me or does 11 seem to have less crashes than 10? I haven't had one in 10 or 11 in years, knock on wood, but does 11 behave a little better? Less user base yet making it seem less?

If this should be somewhere else, feel free to move.

I'm happy for you. :wink:

:)
And you should be too. Who wants BSODs?

jbcarreon123 · Jan 29, 2022

zbook said:
After replacing the Intel GPU driver you can either:

a) wait to see if there are any recurrent BSOD

b) run Windows Driver Verifier (WDV)

Enable and Disable Driver Verifier in Windows 10

How to Enable and Disable Driver Verifier in Windows 10

www.tenforums.com

Please list the hardware that you've connected to USB ports during the past month except for flash drives.

a sound card
a basic keyboard
a basic wireless mouse
a basic wired mouse (when the batteries of the wireless mouse is low)
a cheap webcam

zbook · Jan 29, 2022

One of the listed hardware may be causing the live kernel events.

Often live kernel events can be ignored.

If they cause hangs and freezes they can be troubleshooted.

Make a new restore point.

Read the link on WDV.

Learn the methods to turn off the tool in safe mode running: verifier /reset and verifier /bootmode resetonbootfail

jbcarreon123 · Jan 29, 2022

zbook said:
One of the listed hardware may be causing the live kernel events.

Often live kernel events can be ignored.

If they cause hangs and freezes they can be troubleshooted.

Make a new restore point.

Read the link on WDV.

Learn the methods to turn off the tool in safe mode running: verifier /reset and verifier /bootmode resetonbootfail

Thanks. I have a 2 Windows PE ISOs, 1 Windows 10 Install ISO, and 1 Windows 11 Install ISO when everything goes wrong with WDV.
The Windows PE ISOs can connect to the internet, and one of the ISO has tools when I have to restore the restore point.

Code:

D:\ISO> Directory PE

Directory of D:\ISO\PE

Win10xPE_x64.iso
BOOTPE.ISO

P.S.
Some of the hardware specified is not connected, because a rat cutting the USB cables of some of the USB hardware. I will replacing some of it, and some I will replace the USB cable.

P.S. 2
One of my USB drives looks like it's failing, slow speeds, diskpart takes too long to open when it's connected, when I do anything to it, Disk management is not responding.

zbook · Jan 29, 2022

See if HD Sentinel has any abnormal findings for all of the USB drives.
(instantaneous results)

jbcarreon123 · Jan 29, 2022

Created a restore point

Now enabling WDV in the next 24 hours and reporting for any BSOD and disabling WDV.

Matthew Wai · Jan 29, 2022

jbcarreon123 said:

Code:

Get-WinEvent : There is not an event provider on the localhost computer that matches "ChkDsk".
At line:1 char:1
+ & get-winevent -ProviderName 'ChkDsk' | fl timecreated, message
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Please run the following PowerShell command and see whether it will return the same error.

get-winevent -ProviderName "*ChkDsk*" | fl timecreated, message