Windows 10 BSOD (ntoskrnl, afd.sys, ndis.sys)

Speccy system snapshot http://speccy.piriform.com/results/ovEq2GZcW6R1Qa24s4xEFxC

I started experiencing bluescreens more frequently lately. It started about a month ago and since then I had a bsod about every week and it seems to get more frequent.

The Bug Check String is always different so far with DRIVER_IRQL_NOT_LESS_OR_EQUAL, IRQL_NOT_LESS_OR_EQUAL and REFERENCE_BY_POINTER.
BlueScreenView says the caused Driver is either "afd.sys", "ntoskrnl.exe" or "ndis.sys".
I ran the windows memory check and no error was found, will probably run memtest86 soon as well just to double check.

The last 2 times I had problems regarding bsod it was either ram or a dying gpu so I am curious what it could be this time. Hoping it's just a driver issue. Grateful for any help.

Edited by Stagnation2, 29 February 2024 - 03:43 PM.

Hi, Welcome to BC.

There is a BIOS Update : v3I   Release Date : 2023-10-28  That would be beneficial :  AGESA ComboAm4v2PI 1.2.0.B update. - AMD security issue patch. - Support new Ryzen 5000 CPU.   Watch How To Video if need to.

https://www.msi.com/Motherboard/B450-TOMAHAWK-MAX/support

At the time of your Speccy Report you only had : Available Physical:  5.68 GB  Ram and were using 64%   & CMK16GX4M2B3200C16 (3200MHz) is running @ 2132MHz  with XMP enabled. 

- It might be best to not run more than a single game at a time.  Possibly where all your ram is going.

You possibly may benefit by setting the speed in BIOS possibly in Advanced and timings as they are all over the place in SPD and lock them in and not use XMP unless need to at the moment or for a game as needed only.

Please turn off XMP while figure things out.  

In BIOS please turn off anything that Speeds Up the Boot example ASUS Fast Boot for the same reasons as below :

Turn off MS Fast Start : https://www.windowscentral.com/how-disable-windows-10-fast-startup /11

Please make sure your Razor Drivers are up to date as well as your : Sound BlasterX G6   If you have been taking Microsoft Update Drivers please stop.  If have for these Suggest uninstall the MS Supplied drivers and download the makers.

This also is suggested for your Video Card and never take Update Drivers if at all possible and while the maker supplies these drivers.

- In Task Scheduler a Entry:  IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473

The above Identifies out as a INTEL but path is incomplete.  Check your stuff in Device Manager and Identify what you are running of Intel and check for updates of your Support Page and or Search for it.

As well in Task Scheduler :  FreeDownloadManagerHelperService  & MSIAfterburner

If running MSI After Burner : Please return the NVIDIA GeForce GTX 1080 Ti card to Stock Settings

I would suggest as well to Download the newest Driver from here : https://www.techspot.com/drivers/manufacturer/nvidia_geforce/ as you can read about them and know why it is released.

Then Remove your Existing Drivers with DDU and then install the above.

- Nice to see your Java is current :=}    Note : unless a program or a game needs this then keep, as all modern Browsers do not need it anymore.

- if not running Samsung Magician please do so and check for Firmware Updates for your SSD's : https://semiconductor.samsung.com/us/consumer-storage/support/tools/

- If not running the ADATA SX8200PNP Toolbox / Firmware  : https://www.adata.com/us/xpg/583?tab=downloads

- Please check Update and Security--> View Update History and check for Failed Updates.

If you have this one as failed can follow the info or hide it for now as slight danger of screwing up your boot enlarging the UEFI  / System Partitions.

https://support.microsoft.com/en-us/topic/kb5034441-windows-recovery-environment-update-for-windows-10-version-21h2-and-22h2-january-9-2024-62c04204-aaa5-4fee-a02a-2fdea17075a8

If there are others that have failed : Please Download Minitoolbox from the below link :
http://www.bleepingcomputer.com/download/minitoolbox/
  Run the tool and only select the following tick boxes.
    -List last 10 Event viewer errors
    -List installed programs
    -List devices
    -List users, partition and memory size
Now click "Go" and Copy/Paste and post the output text in your next reply

- Uninstall your Steam Wallpaper as wallpaper programs cause issues.

- TabTip is a Windows Supplied Program for Tablets. 

If your system is not a Tablet please change the settings : Select action center on the taskbar (next to the date and time), and then select Tablet mode to turn it on or off when not using Wacom Tablet.

- a lot of stuff running behind : svchost.exe   FYI Only : In Win11 you can find out what is running behind svchost.exe    NOTE : You have Drivers available to run Win11.

Edited by Pkshadow, 29 February 2024 - 07:38 PM.

DxDiagx64

=========

RADAR_PRE_LEAK_64

ahitr.exe   - a AMD Updater from somewhere, Suggest remove it and use your M/B Support Page Drivers.

WinRAR.exe - if is cracked, remove and delete the crack and program, If not Uninstall and Update to New Version this Week.  Https:Rarlabs.com

TheGoldenBoy.exe

HOSTS file  fyi

======

# Added by Docker Desktop
192.168.178.25 host.docker.internal
192.168.178.25 gateway.docker.internal
# To allow the same kube context to work on the host and the container:
127.0.0.1 kubernetes.docker.internal
# End of section

MSInfo32  - all are crashing out.

========

Please remove while figuring things out : bakkesmod.exe

WinRAR.exe

HearthstoneDeckTracker.exe

wallpaper32.exe

MsMpEng.exe

ScreenSketch.exe

esrv_svc.exe  ============ Intel\SUR\QUEENCREEK

backgroundTaskHost.exe   == KERNELBASE.dll

eldenring.exe

python.exe

NVDisplay.Container.exe

perfect dark.update.exe

yo-movrepair.exe

WindowsTerminal.exe

ffmpeg.exe

======================= Stopping here as the collection of crashing programs continues.

Dump File

=========

022924-7562-01 -  This date

REFERENCE_BY_POINTER (18)

PROCESS_NAME:  python.exe

IMAGE_NAME:  ntkrnlmp.exe
FAILURE_BUCKET_ID:  0x18_OVER_DEREFERENCE_nt!ObfDereferenceObjectWithTag

Not even going to try : Will need to wait for the : BSOD Kernel Dump Expert @ubuysa to check this and read the Stack.

Edited by Pkshadow, 29 February 2024 - 08:03 PM.

A suggestion is to go through your Autoruns and check if you really need them to start at boot.  The list is in the Sysnative Collection : Autoruns.txt and does show scvhost. Those need to be turned off in the program.

You can use MS Autoruns to turn stuff off as well.  Do not do anything if do not know and can not return it back.  It is a Powerful Program : https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns

Ok thank you very much I did some of the stuff I felt comfortable with doing like updating drivers and removing programs etc.
I also set the RAM to 3200MHz and made sure that XMP is disabled (it was already disabled it said, although the name in bios was X-AMP so not sure if that is something slighlty differen). I did not really know what to do about the timings.

I also ran memtest again as I said and it didn't find any errors in the 2 passes that I let it run for.

I did not see any failed updates in my windows update history.

I will probably leave it at that for now and check if any of the changes helped so far.
The bsod only started a month ago and I was having no problems prior to that. I am not sure what could have changed to cause these issues so suddenly. Also the frequency seemed to increase with experiencing one yesterday and one today.

The only thing that I recently started using again was my wacom tablet but I can't remember if that was before the bsod happened or after

Again thank you for the information provided I will keep an eye on things.

My first thought when looking through these five dumps was that this looks like a RAM problem. The dump that changed my mind from this being RAM was the 0x101 bugcheck. This is a CLOCK_WATCHDOG_TIMEOUT and it happens when one of the processors fails to respond to a clock synchronisation interrupt. Most of the time this indicates a potential CPU problem, however the 0x101 can be caused by a bad driver blocking a processor so that it's unable to respond to the clock synchronisation interrupt - that's what I think has happened here.

In that 0x101 dump we can clearly see an Easy Anti Cheat driver EasyAntiCheat_EOS.sys called numerous times in the lead-up to the bugcheck, this is most likely the bad driver that's blocked the processor and caused the x101 bugcheck. The version of this driver is close on 6 months old now and might benefit from an update...

0: kd> lmvm EasyAntiCheat_EOS
Browse full module list
start             end                 module name
fffff804`81580000 fffff804`82652000   EasyAntiCheat_EOS T (no symbols)           
    Loaded symbol image file: EasyAntiCheat_EOS.sys
    Image path: \??\C:\Program Files (x86)\EasyAntiCheat_EOS\EasyAntiCheat_EOS.sys
    Image name: EasyAntiCheat_EOS.sys
    Browse all global symbols  functions  data
    Timestamp:        Wed Oct 25 16:48:42 2023 (65391CBA)
    CheckSum:         010745EA
    ImageSize:        010D2000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:

That said, all of the anti cheat products cause many BSODs on numerous systems, they've very common in dumps. If you can, try running without the EasyAntiCheap tool running at all (reboot first to ensure the drivers are unloaded). If it won't BSOD when you're not using EasyAntiCheat then that's pretty good confirmation.

EasyAntiCheat is not referenced in any other dumps, but that's not unusual. If you can make it BSOD without EasyAntiCheat running at all then please upload a new SysnativeBSODCollectionApp output.

Edited by ubuysa, 01 March 2024 - 06:37 AM.

Sounds promising, will do.

Thank you very much