B
Ben_S_1234
I have an issue plaguing my system, a Gateway LX-6810. I am able to cold boot into Windows fine, but typically shortly after Windows is finished booting and loading all applications, the system will lock and I am forced to do a hard restart by powering the system off. Lately, it happens a second time upon boot, and by the third time usually Windows locks before it loads. The fourth time seems to do the trick.
I can turn off fast boot, etc., but I'm hoping to resolve the issue so the PC can run normally without these tweaks and without reinstalling/refreshing the OS - Windows 10 Home.
This is a PC that has survived an upgrade from Windows Vista (OEM) to 7 and now to 10 and it's old but it still runs like a champ. The issue only started happening with the newer version releases 1709 and forward (1607 was the first it had and it worked fine) and seems to be getting worse with each upgrade release.
I believe it to be a driver error but haven't figured out which one.
I've been able to narrow the EventViewer event consistently to Kernel-Power Error 41 (this may have to do with me powering it off by hand, holding the power button for 5 seconds). Below is an analysis of the memory crash dump file MEMORY.DMP (copy created before the system removed the original).
Any suggestions would be appreciated.
Microsoft (R) Windows Debugger Version 10.0.17134.12 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Benjamin\Documents\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.
************* Path validation summary **************
Response Time (ms) Location
Deferred SRV*C:\Windows\symbol_cache*Symbol information
Symbol search path is: SRV*C:\Windows\symbol_cache*Symbol information
Executable search path is:
Windows 10 Kernel Version 17134 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 17134.1.amd64fre.rs4_release.180410-1804
Machine Name:
Kernel base = 0xfffff801`e9209000 PsLoadedModuleList = 0xfffff801`e95c31f0
Debug session time: Mon Aug 6 17:24:23.534 2018 (UTC - 4:00)
System Uptime: 2 days 21:03:25.437
Loading Kernel Symbols
...............................................................
................................................................
................................................................
..
Loading User Symbols
PEB is paged out (Peb.Ldr = 00000000`00e9a018). Type ".hh dbgerr001" for details
Loading unloaded module list
..........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1E, {ffffffffc0000005, fffff801e9299719, 0, 0}
Probably caused by : ntkrnlmp.exe ( nt!KeSetEvent+9 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff801e9299719, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception
Debugging Details:
------------------
KEY_VALUES_STRING: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 401
BUILD_VERSION_STRING: 17134.1.amd64fre.rs4_release.180410-1804
SYSTEM_MANUFACTURER: Gateway
SYSTEM_PRODUCT_NAME: LX6810-01
SYSTEM_SKU: To Be Filled By O.E.M.
SYSTEM_VERSION:
BIOS_VENDOR: American Megatrends Inc.
BIOS_VERSION: R01-A0
BIOS_DATE: 10/31/2008
BASEBOARD_MANUFACTURER: Gateway
BASEBOARD_PRODUCT: FMCP7AM
BASEBOARD_VERSION:
DUMP_TYPE: 1
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff801e9299719
BUGCHECK_P3: 0
BUGCHECK_P4: 0
READ_ADDRESS: 0000000000000000
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
FAULTING_IP:
nt!KeSetEvent+9
fffff801`e9299719 f6017f test byte ptr [rcx],7Fh
BUGCHECK_STR: 0x1E_c0000005_R
CPU_COUNT: 4
CPU_MHZ: 91d
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 17
CPU_STEPPING: 7
CPU_MICROCODE: 6,17,7,0 (F,M,S,R) SIG: 70B'00000000 (cache) 70B'00000000 (init)
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: explorer.exe
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: GATEWAY-MC
ANALYSIS_SESSION_TIME: 08-06-2018 18:20:10.0146
ANALYSIS_VERSION: 10.0.17134.12 amd64fre
LAST_CONTROL_TRANSFER: from fffff801e92622bd to fffff801e93a1430
STACK_TEXT:
fffffb0e`46efa998 fffff801`e92622bd : 00000000`0000001e ffffffff`c0000005 fffff801`e9299719 00000000`00000000 : nt!KeBugCheckEx
fffffb0e`46efa9a0 fffff801`e93b2042 : 00000000`00000000 00000000`00000000 fffffb0e`46efb128 ffffd026`19265349 : nt!KiDispatchException+0x58d
fffffb0e`46efb050 fffff801`e93aebbf : ffffd026`19264df9 00000000`00000001 ffffe58e`f5e6b930 00000000`00000001 : nt!KiExceptionDispatch+0xc2
fffffb0e`46efb230 fffff801`e9299719 : 00000000`00000000 ffffe58e`f956b300 00000000`00000000 fffff801`e971dadf : nt!KiPageFault+0x3ff
fffffb0e`46efb3c0 fffff801`e93e10e3 : 00000000`00000000 ffffe58e`f9133080 00000000`0000017c ffffbf14`53646156 : nt!KeSetEvent+0x9
fffffb0e`46efb450 fffff801`e927f397 : 00000000`00000001 00000000`00000000 ffffe58e`00000000 ffffe58e`00000000 : nt!MiFinishVadDeletion+0x161c13
fffffb0e`46efb520 fffff801`e92e1f56 : 00000000`000031e1 ffff82dd`0544c518 00000000`00000000 fffff801`e92b60cb : nt!MiDeleteVad+0x18b7
fffffb0e`46efb850 fffff801`e96c8eeb : 00000000`00000000 00000000`00000000 ffffe58e`f5e6b930 00000000`00000000 : nt!MiFreeVadRange+0x92
fffffb0e`46efb8b0 fffff801`e96c8b3b : fffffb0e`46efbab0 ffff82dd`0576c982 ffffe58e`f9133080 ffff82b0`400b8d10 : nt!MmFreeVirtualMemory+0x37b
fffffb0e`46efb9e0 fffff801`e93b1a43 : ffffe58e`f9133080 00000000`00000001 00000000`00000000 ffffe58e`f9133080 : nt!NtFreeVirtualMemory+0x8b
fffffb0e`46efba40 fffff801`e93a4e50 : ffff82dd`0543d1a6 ffff82b0`00000000 35b2a1c4`0e5cea4b ffff82b0`4001f010 : nt!KiSystemServiceCopyEnd+0x13
fffffb0e`46efbbd8 ffff82dd`0543d1a6 : ffff82b0`00000000 35b2a1c4`0e5cea4b ffff82b0`4001f010 ffff82b0`441a82c0 : nt!KiServiceLinkage
fffffb0e`46efbbe0 ffff82dd`05446257 : 00000000`03050000 00000000`00000000 ffff82b0`441a82c0 ffff82dd`00000000 : win32kbase!SURFACE::bDeleteSurface+0x746
fffffb0e`46efbdc0 fffff801`e93b1a43 : 00000000`00000000 ffff82b0`441a82c0 ffffe58e`f9133080 fffffb0e`46efbec0 : win32kbase!NtGdiDeleteObjectApp+0x227
fffffb0e`46efbe40 00007ff8`154814e4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`00ddd5f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff8`154814e4
THREAD_SHA1_HASH_MOD_FUNC: 91e938ce135434af6bc6f6e4d1b009c89258dab2
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 2911682260830b3d632152d3856c390388e6d9a5
THREAD_SHA1_HASH_MOD: 8dbb7d78761da9ce33775171c2058d940d056bdd
FOLLOWUP_IP:
nt!KeSetEvent+9
fffff801`e9299719 f6017f test byte ptr [rcx],7Fh
FAULT_INSTR_CODE: 417f01f6
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: nt!KeSetEvent+9
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 5b3f12f4
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 9
FAILURE_BUCKET_ID: 0x1E_c0000005_R_nt!KeSetEvent
BUCKET_ID: 0x1E_c0000005_R_nt!KeSetEvent
PRIMARY_PROBLEM_CLASS: 0x1E_c0000005_R_nt!KeSetEvent
TARGET_TIME: 2018-08-06T21:24:23.000Z
OSBUILD: 17134
OSSERVICEPACK: 0
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 784
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS Personal
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2018-07-06 02:57:56
BUILDDATESTAMP_STR: 180410-1804
BUILDLAB_STR: rs4_release
BUILDOSVER_STR: 10.0.17134.1.amd64fre.rs4_release.180410-1804
ANALYSIS_SESSION_ELAPSED_TIME: ccf
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x1e_c0000005_r_nt!kesetevent
FAILURE_ID_HASH: {91253d05-aaf3-3834-ca81-2fd8905e81b8}
Followup: MachineOwner
---------
Continue reading...
I can turn off fast boot, etc., but I'm hoping to resolve the issue so the PC can run normally without these tweaks and without reinstalling/refreshing the OS - Windows 10 Home.
This is a PC that has survived an upgrade from Windows Vista (OEM) to 7 and now to 10 and it's old but it still runs like a champ. The issue only started happening with the newer version releases 1709 and forward (1607 was the first it had and it worked fine) and seems to be getting worse with each upgrade release.
I believe it to be a driver error but haven't figured out which one.
I've been able to narrow the EventViewer event consistently to Kernel-Power Error 41 (this may have to do with me powering it off by hand, holding the power button for 5 seconds). Below is an analysis of the memory crash dump file MEMORY.DMP (copy created before the system removed the original).
Any suggestions would be appreciated.
Microsoft (R) Windows Debugger Version 10.0.17134.12 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Benjamin\Documents\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.
************* Path validation summary **************
Response Time (ms) Location
Deferred SRV*C:\Windows\symbol_cache*Symbol information
Symbol search path is: SRV*C:\Windows\symbol_cache*Symbol information
Executable search path is:
Windows 10 Kernel Version 17134 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 17134.1.amd64fre.rs4_release.180410-1804
Machine Name:
Kernel base = 0xfffff801`e9209000 PsLoadedModuleList = 0xfffff801`e95c31f0
Debug session time: Mon Aug 6 17:24:23.534 2018 (UTC - 4:00)
System Uptime: 2 days 21:03:25.437
Loading Kernel Symbols
...............................................................
................................................................
................................................................
..
Loading User Symbols
PEB is paged out (Peb.Ldr = 00000000`00e9a018). Type ".hh dbgerr001" for details
Loading unloaded module list
..........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1E, {ffffffffc0000005, fffff801e9299719, 0, 0}
Probably caused by : ntkrnlmp.exe ( nt!KeSetEvent+9 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff801e9299719, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception
Debugging Details:
------------------
KEY_VALUES_STRING: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 401
BUILD_VERSION_STRING: 17134.1.amd64fre.rs4_release.180410-1804
SYSTEM_MANUFACTURER: Gateway
SYSTEM_PRODUCT_NAME: LX6810-01
SYSTEM_SKU: To Be Filled By O.E.M.
SYSTEM_VERSION:
BIOS_VENDOR: American Megatrends Inc.
BIOS_VERSION: R01-A0
BIOS_DATE: 10/31/2008
BASEBOARD_MANUFACTURER: Gateway
BASEBOARD_PRODUCT: FMCP7AM
BASEBOARD_VERSION:
DUMP_TYPE: 1
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff801e9299719
BUGCHECK_P3: 0
BUGCHECK_P4: 0
READ_ADDRESS: 0000000000000000
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
FAULTING_IP:
nt!KeSetEvent+9
fffff801`e9299719 f6017f test byte ptr [rcx],7Fh
BUGCHECK_STR: 0x1E_c0000005_R
CPU_COUNT: 4
CPU_MHZ: 91d
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 17
CPU_STEPPING: 7
CPU_MICROCODE: 6,17,7,0 (F,M,S,R) SIG: 70B'00000000 (cache) 70B'00000000 (init)
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: explorer.exe
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: GATEWAY-MC
ANALYSIS_SESSION_TIME: 08-06-2018 18:20:10.0146
ANALYSIS_VERSION: 10.0.17134.12 amd64fre
LAST_CONTROL_TRANSFER: from fffff801e92622bd to fffff801e93a1430
STACK_TEXT:
fffffb0e`46efa998 fffff801`e92622bd : 00000000`0000001e ffffffff`c0000005 fffff801`e9299719 00000000`00000000 : nt!KeBugCheckEx
fffffb0e`46efa9a0 fffff801`e93b2042 : 00000000`00000000 00000000`00000000 fffffb0e`46efb128 ffffd026`19265349 : nt!KiDispatchException+0x58d
fffffb0e`46efb050 fffff801`e93aebbf : ffffd026`19264df9 00000000`00000001 ffffe58e`f5e6b930 00000000`00000001 : nt!KiExceptionDispatch+0xc2
fffffb0e`46efb230 fffff801`e9299719 : 00000000`00000000 ffffe58e`f956b300 00000000`00000000 fffff801`e971dadf : nt!KiPageFault+0x3ff
fffffb0e`46efb3c0 fffff801`e93e10e3 : 00000000`00000000 ffffe58e`f9133080 00000000`0000017c ffffbf14`53646156 : nt!KeSetEvent+0x9
fffffb0e`46efb450 fffff801`e927f397 : 00000000`00000001 00000000`00000000 ffffe58e`00000000 ffffe58e`00000000 : nt!MiFinishVadDeletion+0x161c13
fffffb0e`46efb520 fffff801`e92e1f56 : 00000000`000031e1 ffff82dd`0544c518 00000000`00000000 fffff801`e92b60cb : nt!MiDeleteVad+0x18b7
fffffb0e`46efb850 fffff801`e96c8eeb : 00000000`00000000 00000000`00000000 ffffe58e`f5e6b930 00000000`00000000 : nt!MiFreeVadRange+0x92
fffffb0e`46efb8b0 fffff801`e96c8b3b : fffffb0e`46efbab0 ffff82dd`0576c982 ffffe58e`f9133080 ffff82b0`400b8d10 : nt!MmFreeVirtualMemory+0x37b
fffffb0e`46efb9e0 fffff801`e93b1a43 : ffffe58e`f9133080 00000000`00000001 00000000`00000000 ffffe58e`f9133080 : nt!NtFreeVirtualMemory+0x8b
fffffb0e`46efba40 fffff801`e93a4e50 : ffff82dd`0543d1a6 ffff82b0`00000000 35b2a1c4`0e5cea4b ffff82b0`4001f010 : nt!KiSystemServiceCopyEnd+0x13
fffffb0e`46efbbd8 ffff82dd`0543d1a6 : ffff82b0`00000000 35b2a1c4`0e5cea4b ffff82b0`4001f010 ffff82b0`441a82c0 : nt!KiServiceLinkage
fffffb0e`46efbbe0 ffff82dd`05446257 : 00000000`03050000 00000000`00000000 ffff82b0`441a82c0 ffff82dd`00000000 : win32kbase!SURFACE::bDeleteSurface+0x746
fffffb0e`46efbdc0 fffff801`e93b1a43 : 00000000`00000000 ffff82b0`441a82c0 ffffe58e`f9133080 fffffb0e`46efbec0 : win32kbase!NtGdiDeleteObjectApp+0x227
fffffb0e`46efbe40 00007ff8`154814e4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`00ddd5f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff8`154814e4
THREAD_SHA1_HASH_MOD_FUNC: 91e938ce135434af6bc6f6e4d1b009c89258dab2
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 2911682260830b3d632152d3856c390388e6d9a5
THREAD_SHA1_HASH_MOD: 8dbb7d78761da9ce33775171c2058d940d056bdd
FOLLOWUP_IP:
nt!KeSetEvent+9
fffff801`e9299719 f6017f test byte ptr [rcx],7Fh
FAULT_INSTR_CODE: 417f01f6
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: nt!KeSetEvent+9
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 5b3f12f4
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 9
FAILURE_BUCKET_ID: 0x1E_c0000005_R_nt!KeSetEvent
BUCKET_ID: 0x1E_c0000005_R_nt!KeSetEvent
PRIMARY_PROBLEM_CLASS: 0x1E_c0000005_R_nt!KeSetEvent
TARGET_TIME: 2018-08-06T21:24:23.000Z
OSBUILD: 17134
OSSERVICEPACK: 0
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 784
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS Personal
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2018-07-06 02:57:56
BUILDDATESTAMP_STR: 180410-1804
BUILDLAB_STR: rs4_release
BUILDOSVER_STR: 10.0.17134.1.amd64fre.rs4_release.180410-1804
ANALYSIS_SESSION_ELAPSED_TIME: ccf
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x1e_c0000005_r_nt!kesetevent
FAILURE_ID_HASH: {91253d05-aaf3-3834-ca81-2fd8905e81b8}
Followup: MachineOwner
---------
Continue reading...