ntoskrnl.exe BOSD

kfachrudin · May 25, 2024

Hi everyone, please help me out by identifying the source of the BSOD and how to solve it. Much appreciated! Here's the log link KFACHRUDIN-(2024-05-25_21-20-22).zip

My system hardware is as follow:
Lenovo LOQ 15IRH8
Core i7 13700H
RTX 4060
Samsung DDR5-5600 16GB
SSD LENOVO UBIS 512GB
Windows 11 23H2

Any assistance will be much appreciated

zbook · May 25, 2024

Please perform the following steps:

1) Run Tuneup plus > post a share link

https://www.tenforums.com/attachments/bsod-crashes-debugging/360139d1645183596-batch-files-use-bsod-debugging-tuneup_plus_log.zip

Batch files for use in BSOD debugging - Windows 10 Help Forums

Information This thread is for use by the BSOD team to store batch files that can be used to collect additional data, fix settings or anything else that is useful in debugging BSOD problems in Windows 10. The way I see it working is the first

www.tenforums.com

Batch files for use in BSOD debugging - Windows 10 Help Forums

Information This thread is for use by the BSOD team to store batch files that can be used to collect additional data, fix settings or anything else that is useful in debugging BSOD problems in Windows 10. The way I see it working is the first

www.tenforums.com

2) Create a new restore point

Create System Restore Point in Windows 11 Tutorial

This tutorial will show you how to manually create a restore point in Windows 11. Turning on system protection for a drive allows System Restore to include the drive when restore points are created so you can undo undesired system changes by reverting to a previous point in time. System...

www.elevenforum.com

3) Read this link on Windows Driver Verifier (WDV):

Enable and Disable Driver Verifier in Windows 10

How to Enable and Disable Driver Verifier in Windows 10

www.tenforums.com

4) Plan to run WDV for 48 hours with various customized tests

Start the tool with these settings:

a) test all non-Microsoft drivers
b) test no Microsoft drivers
c) start the testing with the 3 customized tests in the TF link

Each time the tool is restarted if there is no immediate BSOD then open administrative command prompt and copy and paste:

verifier /querysettings

Post a share link.

For any BSOD post a new V2 share link into the newest post.

During the troubleshooting WDV can run continuously in the background until the testing is modified.

(Later today (after 2pm the tool can be started)

kfachrudin · Jun 2, 2024

zbook said:
Please perform the following steps:

1) Run Tuneup plus > post a share link

https://www.tenforums.com/attachments/bsod-crashes-debugging/360139d1645183596-batch-files-use-bsod-debugging-tuneup_plus_log.zip

Batch files for use in BSOD debugging - Windows 10 Help Forums

Information This thread is for use by the BSOD team to store batch files that can be used to collect additional data, fix settings or anything else that is useful in debugging BSOD problems in Windows 10. The way I see it working is the first

www.tenforums.com

Batch files for use in BSOD debugging - Windows 10 Help Forums

Information This thread is for use by the BSOD team to store batch files that can be used to collect additional data, fix settings or anything else that is useful in debugging BSOD problems in Windows 10. The way I see it working is the first

www.tenforums.com

2) Create a new restore point

Create System Restore Point in Windows 11 Tutorial

This tutorial will show you how to manually create a restore point in Windows 11. Turning on system protection for a drive allows System Restore to include the drive when restore points are created so you can undo undesired system changes by reverting to a previous point in time. System...

www.elevenforum.com

3) Read this link on Windows Driver Verifier (WDV):

Enable and Disable Driver Verifier in Windows 10

How to Enable and Disable Driver Verifier in Windows 10

www.tenforums.com

4) Plan to run WDV for 48 hours with various customized tests

Start the tool with these settings:

a) test all non-Microsoft drivers
b) test no Microsoft drivers
c) start the testing with the 3 customized tests in the TF link

Each time the tool is restarted if there is no immediate BSOD then open administrative command prompt and copy and paste:

verifier /querysettings

Post a share link.

For any BSOD post a new V2 share link into the newest post.

During the troubleshooting WDV can run continuously in the background until the testing is modified.

(Later today (after 2pm the tool can be started)

Hi Zbook

Sorry, for the long follow-up.

I've already done the steps that you suggested as follows:
1. Here is the link to the tuneup result

Tuneup.log

drive.google.com

2. I've done the driver verifier with 2 scenarios
a. Scenario 1 with all Microsoft drivers unchecked, no BSOD, here is the log

verifier.txt

drive.google.com

b. scenario 2 with only Microsoft drivers checked, BSOD occurred. here is the log v2

KFACHRUDIN-(2024-06-02_20-52-37).zip

drive.google.com

thank you so much for the help

zbook · Jun 2, 2024

Please restart WDV with these customized test settings:

Code:

    [ ] 0x00000001 Special pool.
    [ ] 0x00000002 Force IRQL checking.
    [ ] 0x00000008 Pool tracking.
    [ ] 0x00000020 Deadlock detection.
    [ ] 0x00000080 DMA checking.
    [ ] 0x00000100 Security checks.
    [ ] 0x00000800 Miscellaneous checks.
    [ ] 0x00020000 DDI compliance checking.

a) test all non-Microsoft drivers

b) test no Microsoft drivers

If there is no immediate BSOD then open administrative command prompt and copy and paste:

verifier /querysettings

Post a share link.

For any BSOD post a new V2 share link into the newest post.

kfachrudin · Jun 2, 2024

zbook said:
Please restart WDV with these customized test settings:

Code:

[ ] 0x00000001 Special pool. [ ] 0x00000002 Force IRQL checking. [ ] 0x00000008 Pool tracking. [ ] 0x00000020 Deadlock detection. [ ] 0x00000080 DMA checking. [ ] 0x00000100 Security checks. [ ] 0x00000800 Miscellaneous checks. [ ] 0x00020000 DDI compliance checking.

a) test all non-Microsoft drivers

b) test no Microsoft drivers

If there is no immediate BSOD then open administrative command prompt and copy and paste:

verifier /querysettings

Post a share link.

For any BSOD post a new V2 share link into the newest post.

What's the different between all non-Microsoft and no Microsoft drivers?

zbook · Jun 2, 2024

Please see the TF WDV tutorial:

PART TWO

Configure Driver Verifier Settings and Enable

4: Click on the Provider header to sort providers alphabetically, then select all non-Microsoft Corporation drivers. Click Finish.

kfachrudin · Jun 3, 2024

zbook said:
Please see the TF WDV tutorial:

PART TWO

Configure Driver Verifier Settings and Enable
4: Click on the Provider header to sort providers alphabetically, then select all non-Microsoft Corporation drivers. Click Finish.

I've already run the verifier with all non-Microsoft Corporation drivers. No BSOD occured

verifier all non microsoft driver.txt

drive.google.com

zbook · Jun 3, 2024

Please restart WDV with these customized tests:

Code:

    [ ] 0x00000010 I/O verification.
    [ ] 0x00002000 Invariant MDL checking for stack.
    [ ] 0x00004000 Invariant MDL checking for driver.
    [ ] 0x00008000 Power framework delay fuzzing.
    [ ] 0x00010000 Port/miniport interface checking.
    [ ] 0x00040000 Systematic low resources simulation.
    [ ] 0x00200000 NDIS/WIFI verification.
    [ ] 0x00800000 Kernel synchronization delay fuzzing.
    [ ] 0x01000000 VM switch verification.
    [ ] 0x02000000 Code integrity checks.

If there is no immediate BSOD then open administrative command prompt and copy and paste:

verifier /querysettings

Post a share link.

For any BSOD post a new V2 share link into the newest post.

kfachrudin · Jun 4, 2024

zbook said:
Please restart WDV with these customized tests:

Code:

[ ] 0x00000010 I/O verification. [ ] 0x00002000 Invariant MDL checking for stack. [ ] 0x00004000 Invariant MDL checking for driver. [ ] 0x00008000 Power framework delay fuzzing. [ ] 0x00010000 Port/miniport interface checking. [ ] 0x00040000 Systematic low resources simulation. [ ] 0x00200000 NDIS/WIFI verification. [ ] 0x00800000 Kernel synchronization delay fuzzing. [ ] 0x01000000 VM switch verification. [ ] 0x02000000 Code integrity checks.

If there is no immediate BSOD then open administrative command prompt and copy and paste:

verifier /querysettings

Post a share link.

For any BSOD post a new V2 share link into the newest post.

I've already attached the verifier query log, here are the links mentioned.

verifier all non microsoft driver.txt

drive.google.com

zbook · Jun 4, 2024

The previous customized tests were:

Code:

    [X] 0x00000001 Special pool.
    [X] 0x00000002 Force IRQL checking.
    [X] 0x00000008 Pool tracking.
    [ ] 0x00000010 I/O verification.
    [X] 0x00000020 Deadlock detection.
    [X] 0x00000080 DMA checking.
    [X] 0x00000100 Security checks.
    [X] 0x00000800 Miscellaneous checks.
    [X] 0x00020000 DDI compliance checking.

Please restart WDV with these customized tests:

Code:

    [ ] 0x00000010 I/O verification.
    [ ] 0x00002000 Invariant MDL checking for stack.
    [ ] 0x00004000 Invariant MDL checking for driver.
    [ ] 0x00008000 Power framework delay fuzzing.
    [ ] 0x00010000 Port/miniport interface checking.
    [ ] 0x00040000 Systematic low resources simulation.
    [ ] 0x00080000 DDI compliance checking (additional).
    [ ] 0x00200000 NDIS/WIFI verification.
    [ ] 0x00800000 Kernel synchronization delay fuzzing.
    [ ] 0x01000000 VM switch verification.
    [ ] 0x02000000 Code integrity checks.

If there is no immediate BSOD then open administrative command prompt and copy and paste:

verifier /querysettings

Post a share link.

For any BSOD post a new V2 share link into the newest post.

kfachrudin · Jun 4, 2024

zbook said:

The previous customized tests were:

Code:

    [X] 0x00000001 Special pool.
    [X] 0x00000002 Force IRQL checking.
    [X] 0x00000008 Pool tracking.
    [ ] 0x00000010 I/O verification.
    [X] 0x00000020 Deadlock detection.
    [X] 0x00000080 DMA checking.
    [X] 0x00000100 Security checks.
    [X] 0x00000800 Miscellaneous checks.
    [X] 0x00020000 DDI compliance checking.

Please restart WDV with these customized tests:

Code:

    [ ] 0x00000010 I/O verification.
    [ ] 0x00002000 Invariant MDL checking for stack.
    [ ] 0x00004000 Invariant MDL checking for driver.
    [ ] 0x00008000 Power framework delay fuzzing.
    [ ] 0x00010000 Port/miniport interface checking.
    [ ] 0x00040000 Systematic low resources simulation.
    [ ] 0x00080000 DDI compliance checking (additional).
    [ ] 0x00200000 NDIS/WIFI verification.
    [ ] 0x00800000 Kernel synchronization delay fuzzing.
    [ ] 0x01000000 VM switch verification.
    [ ] 0x02000000 Code integrity checks.

If there is no immediate BSOD then open administrative command prompt and copy and paste:

verifier /querysettings

Post a share link.

For any BSOD post a new V2 share link into the newest post.

Hi Zbook

I've run the scenario and BSOD has occurred. Please see the log on the link below:

KFACHRUDIN-(2024-06-04_21-22-11).zip

drive.google.com

zbook · Jun 4, 2024

1) Uninstall or uninstall and reinstall: RzDev_0082.sys

rzdev_0082 Razer 0082 Service c:\windows\system32\drivers\rzdev_0082.sys

2) Create a new restore point

3) Restart WDV with the same customized tests

kfachrudin · Jun 5, 2024

zbook said:
1) Uninstall or uninstall and reinstall: RzDev_0082.sys

rzdev_0082 Razer 0082 Service c:\windows\system32\drivers\rzdev_0082.sys

2) Create a new restore point

3) Restart WDV with the same customized tests

After I uninstalled the Razer Synapse and ran WDV, BSOD occurred. Now the driver violation is because the AlsysIO64.sys --> this one comes from CoreTemp apps.
I cannot run the V2 Log, it has this description:
"Copy-Item : The process cannot access the file 'C:\ProgramData\Microsoft\Windows\WER\ReportArchive\18ac973e-b2d9-4ea1-814e-ca6d0019fb14' because it is being used by another process.
At D:\V2 log collector1.11\resources\elevated.ps1:173 char:2
+ Copy-Item "$ProgramDataWER\*" -Destination $WER -Recurse -Contain ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [Copy-Item], IOException
+ FullyQualifiedErrorId : System.IO.IOException,Microsoft.PowerShell.Commands.CopyItemCommand"

zbook · Jun 5, 2024

List any of these non-Microsoft software:
a) antivirus
b) firewall
c) drive encryption

Please reboot the computer > rerun V2 after clicking extract all
(if there are any problems > take pictures > post images or share links)

Reboot the computer into safe mode (shift + restart) > rerun V2 after clicking extract all
(if there are any problems > take pictures > post images or share links)

kfachrudin · Jun 5, 2024

zbook said:
List any of these non-Microsoft software:
a) antivirus
b) firewall
c) drive encryption

Please reboot the computer > rerun V2 after clicking extract all
(if there are any problems > take pictures > post images or share links)

Reboot the computer into safe mode (shift + restart) > rerun V2 after clicking extract all
(if there are any problems > take pictures > post images or share links)

Please see the software list on the attached screen capture, I don't use drive encryption nor firewall other than the Microsoft one.
here is the v2 log from normal boot mode: V2 log normal mode.zip
and this one from safe mode: V2 log safe mode.zip

zbook · Jun 5, 2024

1) Please uninstall Bitdefender using the applicable uninstall tool:

Uninstall Bitdefender

www.bitdefender.com

Using the Uninstall Tool to remove Bitdefender Endpoint Security Tools

www.bitdefender.com

2) Make sure that Microsoft defender is on

3) Perform Windows and defender updates

4) Reboot

5) Create a new restore point.

6) Restart WDV with the same customized tests

If there is no immediate BSOD then open administrative command prompt and copy and paste:

verifier /querysettings

Post a share link.

For any BSOD post a new V2 share link into the newest post.

7) Plan to reinstall Bitdefender after troubleshooting is completed or continue using Microsoft defender

Code:

atc.sys      Thu Feb 29 10:01:14 2024 (65E0AA4A)

kfachrudin · Jun 6, 2024

zbook said:
1) Please uninstall Bitdefender using the applicable uninstall tool:

Uninstall Bitdefender

Uninstall Bitdefender

www.bitdefender.com

Using the Uninstall Tool to remove Bitdefender Endpoint Security Tools

www.bitdefender.com

2) Make sure that Microsoft defender is on

3) Perform Windows and defender updates

4) Reboot

5) Create a new restore point.

6) Restart WDV with the same customized tests

If there is no immediate BSOD then open administrative command prompt and copy and paste:

verifier /querysettings

Post a share link.

For any BSOD post a new V2 share link into the newest post.

7) Plan to reinstall Bitdefender after troubleshooting is completed or continue using Microsoft defender

Code:

atc.sys Thu Feb 29 10:01:14 2024 (65E0AA4A)

I've done the step you mentioned, run the wdv and it turn BSOD again. Please see the v2 log below:

KFACHRUDIN-(2024-06-06_13-47-26).zip

drive.google.com

The bsod mentioned the same AlsysIO64.sys again.

zbook · Jun 6, 2024

Uninstall: Core Temp 1.18.1

alsysio ALSysIO \??\c:\users\thinkpad\appdata\local\temp\alsysio64.sys

Code:

ALSysIO64.sys Tue Oct 18 09:38:31 2022 (634EBA67)

Core Temp

Core Temp is a compact, no fuss, small footprint, yet powerful program to monitor processor temperature and other vital information.

www.alcpu.com

Restart WDV with the same settings.

kfachrudin · Jun 6, 2024

zbook said:
Uninstall: Core Temp 1.18.1

alsysio ALSysIO \??\c:\users\thinkpad\appdata\local\temp\alsysio64.sys

Code:

ALSysIO64.sys Tue Oct 18 09:38:31 2022 (634EBA67)

Core Temp

Core Temp is a compact, no fuss, small footprint, yet powerful program to monitor processor temperature and other vital information.

www.alcpu.com

Restart WDV with the same settings.

No BSOD occurred. Please see the verifier log below:

CWindowsSystem32verifier querysetti.txt

drive.google.com

zbook · Jun 6, 2024

1) Turn off WDV.

2) Create a new restore point.

3) Restart WDV with all customized tests except:

Code:

[ ] 0x00000004 Randomized low resources simulation.

4) If there is no immediate BSOD then open administrative command prompt and copy and paste:

verifier /querysettings

Post a share link.

5) For any BSOD post a new V2 share link into the newest post

6) Run these customized tests for 24 -48 hours