Solving frequent BSoDs after Npsvctrig.sys and FileCrypt are loaded

Here we go:

Yet another instance from yet another user: First filecrypt is loaded, then npsvctrig, then, Presto! another unexpected reboot.

  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2019-06-10T14:55:00.959
  Event ID: 41
  Task: N/A
  Level: Critical
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: DESKTOP-G27CEL0
  Description: 
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.

Event[114]:
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2019-06-10T14:55:00.848
  Event ID: 6
  Task: N/A
  Level: Information
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: DESKTOP-G27CEL0
  Description: 
File System Filter 'npsvctrig' (10.0, ?2037?-?02?-?23T01:11:04.000000000Z) has successfully loaded and registered with Filter Manager.

Event[115]:
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2019-06-10T14:55:00.629
  Event ID: 6
  Task: N/A
  Level: Information
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: DESKTOP-G27CEL0
  Description: 
File System Filter 'FileCrypt' (10.0, ?2034?-?08?-?13T09:30:12.000000000Z) has successfully loaded and registered with Filter Manager.

BSoD errors for this particular user are:

3b (SYSTEM_SERVICE_EXCEPTION )

and

Bug Check 1e (KMODE_EXCEPTION_NOT_HANDLED)

I'm currently working on this person's issues, and have debug files. However, so far, it appears the likely culprits are RAM issues or bad drivers. The debugger points to cor eWindows system files, which, as we know, are very unlikely to be the problem, so the debugger has not been much help.

Anyone else have any recent instances of this or anything else which might shed light on this?

Edited by Shplad, 11 June 2019 - 12:00 PM.

Under start click on the gear cog wheel. Go to about. What version and OS builds??

technonymous:

Thanks, but I don't need the handholding. Maybe you didn't notice that I'm a tech. here. 

I've asked my latest user to obtain that info. and hopefully more people will come forward with their crash situations as as crash dumps.

So far, I have found no discernable pattern, and a guru programmer has told me that unless I can find something in the debugger pointing directly at the driver in question, it may not mean anything. So far, I haven't found any such smoking gun.

Edited by Shplad, 14 June 2019 - 09:41 AM.

Sorry about that didn't see you was a tech. I am a certified tech myself as well as in security and networking. I don't mind taking a look at the dump file if you or someone else posts it. I noticed others have posted about seeing event ID-41, which is a general error for abnormal power loss/shutdown. In most cases there isn't much to go on with that error. In my experience with the last couple of systems I worked on, one was the PSU and the other had a bad MOBO. It's good to have a larger dump, the more information the better and other info like speccy snapshots.

It appears my latest user with these crashes is using npsvctrig ver. 10.0.18362.1

I don't know yet if that means anything. A bunch of driver updates seems to have fixed his crashes for now, so it appears possibly not. With the problem sources being as varied as they are, I'm starting to think it's just coincidence that npsvctrig.sys is loading just before these crashes.

Keep the input coming, folks. Any other ideas?

Edited by Shplad, 15 June 2019 - 07:57 AM.

this my line up event log before crash.

3.File System Filter 'npsvctrig' (10.0, ‎2037‎-‎02‎-‎23T13:11:04.000000000Z) has successfully loaded and registered with Filter Manager.

2.File System Filter 'eamonm' (10.0, ‎2019‎-‎01‎-‎11T13:18:47.000000000Z) has successfully loaded and registered with Filter Manager.

1.File System Filter 'FileCrypt' (10.0, ‎2034‎-‎08‎-‎13T21:30:12.000000000Z) has successfully loaded and registered with Filter Manager.

after search this 'eamonm' is Amom monitor from Eset Security

my windows 10 1809 latest

i upload HWINFO sensor test maybe you can read this, i can't read properly

https://drive.google.com/open?id=1oJYnCitFr286hSU5U10XHh-5NbffYND8

this i play game Assasin Odyssey only 5 minute and boom crash.

system Spec

AMD ryzen 5 2400G

Ram 8 GB

GPU on Board

all settings in stock/Default.

putra:

Thanks, but that CSV file is way too hard to read in Excel. Maybe post a screenshot or two of another app. You do know that this thread is not designed for personal troubleshooting, right? If you want personal troubleshooting, you should start your own thread.

putra:

 

Thanks, but that CSV file is way too hard to read in Excel. Maybe post a screenshot or two of another app. You do know that this thread is not designed for personal troubleshooting, right? If you want personal troubleshooting, you should start your own thread.

btw i sometime notice this while high cpu usage, but idk some my pc same crash even not use :/ , and yeah no bsod file found . btw can i known windows 1903 same problem like this ?

but for now i relieved i think my hardware problem, seem windows self problem. maybe someday if i found to fix it will report to this thread

Hello all,

I have been running into this issue recently within the past month. FileCrypt, followed by npsvctrig, results in event 41 being executed. This can happen 5 times in the span of 2 minutes or twice in over 24 hours; I have stress tested my power supply, insured there are no voltage drops within the outlets I used, and tested each individual ram stick to see if I could prevent this from happening. I tried running the windows 10 debloater, but eventually the cycle continues. I have no idea what else I can do... any help is appreciated.

If it helps, these events did not occur until a couple weeks had past after rebuilding/updating the hardware in my computer. I tried a clean install of windows 10, but it did not solve the issue.

Well, I feel a little guilty about neglecting this thread and not coming back to it. What I've discovered from my own experiences is that so far, it may just be coincidence. In each case I've analyzed, there seems to be a fix that is unrelated to these system files. Either that or something else is going on. Perhaps one version of npsvctrig.sys causes more instability than others, triggering a high probability of other causes of system crashses.

I don't know for sure. Please...keep the data coming in.

the-falcon:  My suggestion: Do what everyone else is doing-start your own thread here in the appropriate forum and we'll get down to the bottom of it together, as we always do here. 

Edited by Shplad, 19 August 2019 - 12:10 AM.

According to a post on Arstechnica.com:

The Named Pipe Service Trigger Provider allows other services to be triggered by events on named pipes in Windows 8 and up, supporting the "(Trigger)" startup type for a service. If the service fails to start, Windows considers it mission-critical, so it will log an event and force-reboot the machine.

In other words, just because npsvctrig.sys is loaded immediately prior to a reboot (Event ID 41), it does not mean that it caused the problem.

I'm not clear from the post on Arstechnica.com whether the poster meant that npsvctrig.sys failing to load could cause a reboot for safety, or whether the service it tried to load failing could cause that reboot.

I'll keep digging.

Edited by Shplad, 09 September 2019 - 10:00 AM.

I actually just (hopefully) resolved this issue. I replaced my stock cooler with a a much better air cooler that keeps my CPU ~74 C max when stress testing the CPU. Now when "npsvcstriq" and "FileCrypt" execute, it's still followed by a kernel power event, but instead of the level being critical it's just information stating: "Connectivity state in standby: Disconnected, Reason: NIC compliance".

So far the system appears to be stable, but I will hold my final judgement until a week has passed since the last crash.

Ultimately, it seemed like there was a cooling issue with my system, but nothing that stuck out to me during an OCCT stress test. The Prime95 CPU stress test it what indicated the processor was getting too hot, with temperatures reach the high 80s and potentially higher if I didn't end the test.

I hope this was somewhat insightful for those struggling with the same issue.

the-falcon:

Do you mind if I ask what were you temps before and after replacing the cooler and on which CPU?

Edited by Shplad, 09 September 2019 - 11:14 AM.

Shplad:

Of course. Before, I was reaching 84°C before during the Prime95 test, but I do not believe it had peaked; it showed indication of climbing so I ended the test before it got worse.

As for CPU, I have a Ryzen 2600X 6-Core 3.6 GHz

I'm happy to answer any question I can.

Well, I'm no clocking expert, but I'm fairly certain those temps were much too high. I believe with proper cooling, (and of course depending on room temperature, a Prime95 session should have maxed out in the mid-60s to mid-70s degree region. I asked for after, but you didn't post after temps. What are your temps now that you've upgraded your cooler?

Has the crashing stopped completely?

FYI: There seems to be some consensus among overclockers that the stock voltage for the 2600x is too high and is causing instability. IT could also cause excessive heat as well. I don't want to go further into this here, this is not the thread for it-I just thought you should know it might be worth your playing with your VCore voltages to reduce heat somewhat.

Edited by Shplad, 09 September 2019 - 02:02 PM.