Bugcheck error SYSTEM_SERVICE_EXCEPTION (3b)

Question

Hi, I have built my own PC and since then I am getting BSOD every time I boot up.

Setup is:

MOBO: Asus ROG Strix Z790-A Gaming WIFI (LGA 1700) DDR5 ATX Motherboard

GPU: Gigabyte GeForce RTX 4090 Gaming OC 24GB GDDR6X PCI-Express Graphics Card

CPU: 13th Gen Intel(R) Core(TM) i9-13900K 3.00 GHz

RAM: 4 x 16GB Corsair 5600MHz Dominator Platinum RGB

I ran a bugcheck analysis and these are the results of the mini dump:

I only get BSOD when booting up from a shutdown.

I don't get BSOD when restarting

Is anyone able to help with this

Thanks

************* Preparing the environment for Debugger Extensions Gallery repositories **************
   ExtensionRepository : Implicit
   UseExperimentalFeatureForNugetShare : false
   AllowNugetExeUpdate : false
   AllowNugetMSCredentialProviderInstall : false
   AllowParallelInitializationOfLocalRepositories : true

   -- Configuring repositories
      ----> Repository : LocalInstalled, Enabled: true
      ----> Repository : UserExtensions, Enabled: true

>>>>>>>>>>>>> Preparing the environment for Debugger Extensions Gallery repositories completed, duration 0.000 seconds

************* Waiting for Debugger Extensions Gallery to Initialize **************

>>>>>>>>>>>>> Waiting for Debugger Extensions Gallery to Initialize completed, duration 0.016 seconds
   ----> Repository : UserExtensions, Enabled: true, Packages count: 0
   ----> Repository : LocalInstalled, Enabled: true, Packages count: 36

Microsoft (R) Windows Debugger Version 10.0.25877.1004 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\102023-11031-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*
Symbol search path is: srv*
Executable search path is: 
Windows 10 Kernel Version 19041 MP (32 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Kernel base = 0xfffff807`42c00000 PsLoadedModuleList = 0xfffff807`4382a360
Debug session time: Fri Oct 20 15:33:13.855 2023 (UTC + 1:00)
System Uptime: 0 days 0:00:08.438
Loading Kernel Symbols
...............................................................
................................................................
........................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 00000094`dd95e018).  Type ".hh dbgerr001" for details
Loading unloaded module list
.........
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff807`42ffd640 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:ffff8301`1799db30=000000000000003b
10: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the BugCheck
Arg2: fffff80744fb897f, Address of the instruction which caused the BugCheck
Arg3: ffff83011799e430, Address of the context record for the exception that caused the BugCheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------

KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 1311

    Key  : Analysis.Elapsed.mSec
    Value: 2365

    Key  : Analysis.IO.Other.Mb
    Value: 0

    Key  : Analysis.IO.Read.Mb
    Value: 0

    Key  : Analysis.IO.Write.Mb
    Value: 0

    Key  : Analysis.Init.CPU.mSec
    Value: 233

    Key  : Analysis.Init.Elapsed.mSec
    Value: 9905

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 99

    Key  : Bugcheck.Code.LegacyAPI
    Value: 0x3b

    Key  : Failure.Bucket
    Value: AV_Ntfs!NtfsDeleteInternalAttributeStream

    Key  : Failure.Hash
    Value: {9c24352a-02bd-dde4-4c86-63687dd4f5ec}

    Key  : WER.OS.Branch
    Value: vb_release

    Key  : WER.OS.Version
    Value: 10.0.19041.1

BUGCHECK_CODE:  3b

BUGCHECK_P1: c0000005

BUGCHECK_P2: fffff80744fb897f

BUGCHECK_P3: ffff83011799e430

BUGCHECK_P4: 0

FILE_IN_CAB:  102023-11031-01.dmp

CONTEXT:  ffff83011799e430 -- (.cxr 0xffff83011799e430)
rax=0000000000000000 rbx=0000000000000000 rcx=dfe20060a9ce0000
rdx=ffffbd85926ca170 rsi=0000000020000000 rdi=ffffbd85926ca170
rip=fffff80744fb897f rsp=ffff83011799ee30 rbp=0000000000000000
 r8=ffffd2025221ea00  r9=0000000000000001 r10=fffff80742e252b0
r11=ffff83011799ee00 r12=000000000000ff00 r13=ffffd202521c7680
r14=ffffbd85926ca218 r15=0000000000000400
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00050246
Ntfs!NtfsDeleteInternalAttributeStream+0xbf:
fffff807`44fb897f 488b4618        mov     rax,qword ptr [rsi+18h] ds:002b:00000000`20000018=????????????????
Resetting default scope

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  svchost.exe

STACK_TEXT:  
ffff8301`1799ee30 fffff807`44e917d1     : ffff8301`1799f400 00000000`00000000 00000000`00000000 ffffbd85`926ca170 : Ntfs!NtfsDeleteInternalAttributeStream+0xbf
ffff8301`1799ee70 fffff807`44f6ad9a     : ffff8301`1799f400 ffffd202`4e9b55e0 ffffbd85`926ca101 ffff8301`1799f400 : Ntfs!NtfsDecrementCleanupCounts+0x281
ffff8301`1799eec0 fffff807`44f5b9ad     : 00000000`00000000 00000000`00000000 00000000`00000000 ffff8301`1799f3d0 : Ntfs!NtfsCommonCleanup+0x544a
ffff8301`1799f360 fffff807`42e10665     : ffffd202`50e1f8b0 ffff8301`1799f780 ffffd202`4e9b55e0 ffffd202`4983bd60 : Ntfs!NtfsFsdCleanup+0x1bd
ffff8301`1799f6b0 fffff807`3eb6710f     : ffffd202`4e9b0005 ffff8301`1799f760 ffffd202`4dc39018 ffff8301`179a0000 : nt!IofCallDriver+0x55
ffff8301`1799f6f0 fffff807`3eb64a43     : ffff8301`1799f780 00000000`00000000 00000000`00000000 ffffd202`5101f080 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x28f
ffff8301`1799f760 fffff807`42e10665     : ffffd202`521c7680 fffff807`42e1052d ffffd202`4e9b5658 fffff807`42e181fd : FLTMGR!FltpDispatch+0xa3
ffff8301`1799f7c0 fffff807`431ff137     : 00000000`00000001 ffffd202`521c7680 00000000`00000000 00000000`00040042 : nt!IofCallDriver+0x55
ffff8301`1799f800 fffff807`4320718f     : ffffd202`5101f080 00000000`00000001 ffffbd85`00000000 ffffd202`521c7650 : nt!IopCloseFile+0x177
ffff8301`1799f890 fffff807`4320207c     : 00000000`000002ac 00000094`de2fe758 00000094`de2fe750 00000000`00000008 : nt!ObCloseHandleTableEntry+0x51f
ffff8301`1799f9d0 fffff807`43010ef5     : 00000000`00000000 00000000`00000010 ffff8301`1799fac0 00000218`ca8c79d0 : nt!NtClose+0xec
ffff8301`1799fa40 00007ff8`bc08d1c4     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
00000094`de2fe6d8 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff8`bc08d1c4

SYMBOL_NAME:  Ntfs!NtfsDeleteInternalAttributeStream+bf

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

IMAGE_VERSION:  10.0.19041.3570

STACK_COMMAND:  .cxr 0xffff83011799e430 ; kb

BUCKET_ID_FUNC_OFFSET:  bf

FAILURE_BUCKET_ID:  AV_Ntfs!NtfsDeleteInternalAttributeStream

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {9c24352a-02bd-dde4-4c86-63687dd4f5ec}

Followup:     MachineOwner
---------

Answer 1

Sorry, I was offline.

Your minidump files just indicate memory (RAM) corruption no specific driver is listed

1

The best option is to download the widely available free utility MemTest86, then run a full 4 pass scan with that to test your RAM for physical errors

2

If no RAM errors are found, to try to force Windows 10 show any faulting drivers, the best option would be to turn on Driver Verifier, let your PC crash 3 times, then you must turn off Driver Verifier, and finally, upload any newly created minidump files

Before you run Driver Verifier, please create a new System Restore Point

https://answers.microsoft.com/en-us/windows/for...

---

Note, if you have any difficulty getting into Windows with Driver Verifier enabled:

Start your PC, just as Windows attempts to load (spinning dots), press and hold Power Button for 5 - 10 seconds to perform a Hard Shut Down

Do this twice

On the third start Windows will boot into the Recovery Environment and from there you can access System Repair, Safe Mode, Command Prompt... etc.

Go to Troubleshoot - Advanced Option - Startup Settings and click Restart

Upon restart, press 4 to enter Safe Mode

Open Command Prompt as Administrator and run these two commands, then restart your PC.

verifier /reset

verifier /bootmode resetonbootfail

Answer 2

Thanks for your reply Dave.

Minidump.zip

Answer 3

Hi, I am Dave, I will help you with this.

Can you now get into Windows?

1

If you can get into Windows.

Please upload any minidump files you have for analysis, I will check those to see if they provide any insight into a potential cause of the system crashes.

Open Windows File Explorer.

Navigate to C:\Windows\Minidump

Copy any minidump files onto your Desktop, then zip those up.

Upload the zip file to the Cloud (OneDrive, DropBox... etc.), then choose to share those and get a share link.

Then post the link here to the zip file, so we can take a look for you.

2

If you cannot get into Windows.

Start your PC, just as Windows attempts to load (spinning dots), press and hold Power Button for 5 - 10 seconds to perform a Hard Shut Down

Do this twice

On the third start Windows will boot into the Recovery Environment and from there you can access System Repair, Safe Mode, Command Prompt... etc.

Please try each option one at a time, then see of Windows will boot.

Go to Troubleshoot - Advanced Option - Startup Repair

See if Windows startup can repair itself

Go to Troubleshoot - Advanced Option - System Restore

Check to see if you have a restore point you can go back to

If you do not have a Restore Point, go to Troubleshoot - Advanced Option - Startup Settings and click Restart

Upon restart, press 5 to enter Safe Mode

Once in Safe Mode, backup your data if you do not already have a backup

Open Device Manager and check to make sure all your Drivers are up to date

Reboot to see if Windows will start Normally