Constant BSOD problems

Question

Hi there,

I have had constant BSOD problems.

Minidump here: https://1drv.ms/u/s!AgTCubrZ_eFZ6y3xchp_vJtpOHYs?e=FkXWkM 

The last few minidumps are below from WhoCrashed:

System Information (local)

---

Computer name: DESKTOP-QLH60P4
Windows version: Windows 10, 10.0, version 2009, build: 22000
Windows dir: C:\WINDOWS
Hardware: Inspiron 5676, Dell Inc., 0VYXHD
CPU: AuthenticAMD AMD Ryzen 7 2700X Eight-Core Processor 8664, level: 23
16 logical processors, active mask: 65535
RAM: 8476606464 bytes (7.9GB)

---

---

Crash Dump Analysis

---

Crash dumps are enabled on your computer.
Crash dump directories:
C:\WINDOWS
C:\WINDOWS\Minidump

On Sat 7/01/2023 1:20:59 PM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\Minidump\010723-7375-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x41AFD0)
Bugcheck code: 0x12B (0xFFFFFFFFC00002C4, 0x49B, 0x1D565CEADB0, 0xFFFFB300D17DA000)
Error: FAULTY_HARDWARE_CORRUPTED_PAGE
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This bug check indicates that a single-bit error was found in this page. This is a hardware memory error.
This is likely to be caused by a hardware problem. This error suggests a case of memory corruption because of a hardware problem. It is suggested you do a test on your RAM modules (memory test) and make sure your system is not getting overheated. This problem might also be caused because of overheating (thermal issue).
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

On Sat 7/01/2023 1:20:59 PM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\MEMORY.DMP
This was probably caused by the following module: ntkrnlmp.exe (nt!SeConvertSidToStringSid+0x3D43)
Bugcheck code: 0x12B (0xFFFFFFFFC00002C4, 0x49B, 0x1D565CEADB0, 0xFFFFB300D17DA000)
Error: FAULTY_HARDWARE_CORRUPTED_PAGE
Bug check description: This bug check indicates that a single-bit error was found in this page. This is a hardware memory error.
This is likely to be caused by a hardware problem. This error suggests a case of memory corruption because of a hardware problem. It is suggested you do a test on your RAM modules (memory test) and make sure your system is not getting overheated. This problem might also be caused because of overheating (thermal issue).
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

On Wed 4/01/2023 9:20:15 PM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\Minidump\010423-7890-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x41AFD0)
Bugcheck code: 0x18B (0x18C, 0x1016, 0xFFFFF8051E0C9000, 0xBB27ED98)
Error: SECURE_KERNEL_ERROR
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that the secure kernel has encountered a fatal error.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

On Thu 29/12/2022 8:22:33 PM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\Minidump\122922-15718-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x41AFD0)
Bugcheck code: 0x18B (0x18C, 0x1016, 0xFFFFF8075A929000, 0xBB27ED98)
Error: SECURE_KERNEL_ERROR
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that the secure kernel has encountered a fatal error.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

On Mon 12/12/2022 9:17:12 PM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\Minidump\121222-15656-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x41AF80)
Bugcheck code: 0x18B (0x18C, 0x1016, 0xFFFFF80152E38000, 0x8ADFF4DF)
Error: SECURE_KERNEL_ERROR
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that the secure kernel has encountered a fatal error.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

On Mon 28/11/2022 7:13:58 PM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\Minidump\112822-10218-01.dmp
This was probably caused by the following module: smbco1.sys (smbco10x64+0x12dce20)
Bugcheck code: 0x133 (0x0, 0x501, 0x500, 0xFFFFF8022FF05330)
Error: DPC_WATCHDOG_VIOLATION
Bug check description: The DPC watchdog detected a prolonged run time at an IRQL of DISPATCH_LEVEL or above. This could be caused by either a non-responding driver or non-responding hardware. This bug check can also occur because of overheated CPUs (thermal issue).
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: smbco1.sys .
Google query: smbco1.sys DPC_WATCHDOG_VIOLATION

WINDBG:

Primary dump contents written successfully

Symbol search path is: srv*
Executable search path is: 
Windows 10 Kernel Version 22000 MP (16 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Edition build lab: 22000.1.amd64fre.co_release.210604-1628
Machine Name:
Kernel base = 0xfffff800`6e200000 PsLoadedModuleList = 0xfffff800`6ee29a80
Debug session time: Sat Jan  7 13:20:59.886 2023 (UTC + 11:00)
System Uptime: 0 days 23:13:10.529
Loading Kernel Symbols
...............................................................
................................................................
................................................................
...............
Loading User Symbols
PEB address is NULL !
Loading unloaded module list
...........................
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff800`6e61afd0 48894c2408      mov     qword ptr [rsp+8],rcx ss:fffffc88`d43571e0=000000000000012b
3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

FAULTY_HARDWARE_CORRUPTED_PAGE (12b)
This BugCheck indicates that a single bit error was found in this page.  This is a hardware memory error.
Arguments:
Arg1: ffffffffc00002c4, virtual address mapping the corrupted page
Arg2: 000000000000049b, physical page number
Arg3: 000001d565ceadb0, zero
Arg4: ffffb300d17da000, zero

Debugging Details:
------------------

KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 2389

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 6750

    Key  : Analysis.IO.Other.Mb
    Value: 10

    Key  : Analysis.IO.Read.Mb
    Value: 0

    Key  : Analysis.IO.Write.Mb
    Value: 20

    Key  : Analysis.Init.CPU.mSec
    Value: 1452

    Key  : Analysis.Init.Elapsed.mSec
    Value: 35564

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 100

    Key  : BlackBox.SmDecompressionFailure.CompressedSize
    Value: 0x49b

    Key  : BlackBox.SmDecompressionFailure.CompressionFormat
    Value: 0x3

    Key  : BlackBox.SmDecompressionFailure.SourceDataHash
    Value: 0x7b9b69ba

    Key  : BlackBox.SmDecompressionFailure.SourceDataOffset
    Value: 0xadb0

    Key  : BlackBox.SmDecompressionFailure.SourcePFN1
    Value: 0x841

    Key  : BlackBox.SmDecompressionFailure.SourcePFN2
    Value: 0x840

    Key  : BlackBox.SmDecompressionFailure.TargetPFN
    Value: 0x1ea72

    Key  : Bugcheck.Code.DumpHeader
    Value: 0x12b

    Key  : Bugcheck.Code.KiBugCheckData
    Value: 0x12b

    Key  : Bugcheck.Code.Register
    Value: 0x12b

    Key  : Dump.Attributes.AsUlong
    Value: 1000

    Key  : Dump.Attributes.DiagDataWrittenToHeader
    Value: 1

    Key  : Dump.Attributes.ErrorCode
    Value: 0

    Key  : Dump.Attributes.LastLine
    Value: Dump completed successfully.

    Key  : Dump.Attributes.ProgressPercentage
    Value: 100

    Key  : WER.OS.Branch
    Value: co_release

    Key  : WER.OS.Timestamp
    Value: 2021-06-04T16:28:00Z

    Key  : WER.OS.Version
    Value: 10.0.22000.1

FILE_IN_CAB:  MEMORY.DMP

DUMP_FILE_ATTRIBUTES: 0x1000

BUGCHECK_CODE:  12b

BUGCHECK_P1: ffffffffc00002c4

BUGCHECK_P2: 49b

BUGCHECK_P3: 1d565ceadb0

BUGCHECK_P4: ffffb300d17da000

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

PROCESS_NAME:  MemCompression

STACK_TEXT:  
fffffc88`d43571d8 fffff800`6e7f84d3     : 00000000`0000012b ffffffff`c00002c4 00000000`0000049b 000001d5`65ceadb0 : nt!KeBugCheckEx
fffffc88`d43571e0 fffff800`6e651834     : 00000000`00000200 00000000`00000003 ffffb300`d17da000 000d17d7`0008d9ce : nt!ST_STORE<SM_TRAITS>::StDmPageError+0xfb
fffffc88`d4357230 fffff800`6e590634     : ffffd508`05313e50 00000000`00000001 ffffd507`0000adb0 ffffd507`f3de0050 : nt!ST_STORE<SM_TRAITS>::StDmSinglePageCopy+0xc11d4
fffffc88`d4357300 fffff800`6e5904a6     : 00000000`00000001 00000000`00001981 ffffd507`f2781050 ffffd507`00001000 : nt!ST_STORE<SM_TRAITS>::StDmSinglePageTransfer+0x8c
fffffc88`d4357340 fffff800`6e5902bb     : 00000001`ffffffff ffffd507`f3de0000 fffffc88`d4357420 ffffd508`05313e50 : nt!ST_STORE<SM_TRAITS>::StDmpSinglePageRetrieve+0x172
fffffc88`d43573e0 fffff800`6e59010e     : fffffc88`d4357619 00000000`00000001 ffffb300`c0ea0b30 00000000`00000000 : nt!ST_STORE<SM_TRAITS>::StDmPageRetrieve+0x9f
fffffc88`d4357490 fffff800`6e590011     : ffffd507`f2781000 ffffd508`05313e50 ffffd507`f3de0000 ffffd507`f27829c0 : nt!SMKM_STORE<SM_TRAITS>::SmStDirectReadIssue+0x92
fffffc88`d4357510 fffff800`6e4a3f48     : ffffd507`f5574080 ffffd507`f2781000 00000000`00000000 ffffd507`f3de0000 : nt!SMKM_STORE<SM_TRAITS>::SmStDirectReadCallout+0x21
fffffc88`d4357540 fffff800`6e59261e     : fffff800`6e58fff0 fffffc88`d43575e0 00000000`00000002 00000000`00000000 : nt!KeExpandKernelStackAndCalloutInternal+0x78
fffffc88`d43575b0 fffff800`6e57b983     : fffffc88`d43576b0 00000000`31526d73 00000000`000003ff fffff800`6ef31a00 : nt!SMKM_STORE<SM_TRAITS>::SmStDirectRead+0xbe
fffffc88`d4357680 fffff800`6e57b568     : 00000000`0000000c 00000000`000003ff fffffc88`d4357730 fffff800`6ef31a00 : nt!SMKM_STORE<SM_TRAITS>::SmStWorkItemQueue+0x1a7
fffffc88`d43576d0 fffff800`6e591dc4     : 00000000`0000000c ffffd508`05313e50 00000000`00000001 00000000`00000001 : nt!SMKM_STORE_MGR<SM_TRAITS>::SmIoCtxQueueWork+0xc0
fffffc88`d4357760 fffff800`6e5930fb     : ffffd508`00000001 fffffc88`d4357820 00000000`00000000 ffffd507`f2781000 : nt!SMKM_STORE_MGR<SM_TRAITS>::SmPageRead+0x16c
fffffc88`d43577f0 fffff800`6e4dd1e8     : ffffd507`f824c800 00000000`00000001 ffffd507`f824c8c0 fffff800`6e46d731 : nt!SmPageRead+0x33
fffffc88`d4357840 fffff800`6e4ddb84     : 00000000`00000002 fffffc88`d43578d0 fffffc88`d4357a00 ffffd508`0991a120 : nt!MiIssueHardFaultIo+0x190
fffffc88`d4357890 fffff800`6e46504b     : 00000000`c0033333 00000000`00000001 00000242`a1bb83a0 00000000`00000000 : nt!MiIssueHardFault+0x424
fffffc88`d4357940 fffff800`6e62ba41     : 00000242`a0109468 ffffd507`f89219e0 00000000`00000008 00000000`00000000 : nt!MmAccessFault+0x35b
fffffc88`d4357ae0 00007ffb`f3dc0547     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x341
000000cd`10dfe730 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffb`f3dc0547

SYMBOL_NAME:  nt!ST_STORE<SM_TRAITS>::StDmPageError+fb

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

STACK_COMMAND:  .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET:  fb

FAILURE_BUCKET_ID:  0x12B_c00002c4_StCtDecompressFailed_nt!ST_STORE_SM_TRAITS_::StDmPageError

OS_VERSION:  10.0.22000.1

BUILDLAB_STR:  co_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {c6a6bb4d-3b77-dff6-2d9b-75f5d0f61a50}

Followup:     MachineOwner
---------

3: kd> lmvm nt
Browse full module list
start             end                 module name
fffff800`6e200000 fffff800`6f247000   nt         (pdb symbols)          C:\ProgramData\Dbg\sym\ntkrnlmp.pdb\3D494B8E9FF6FB289E3AA55B3133EF371\ntkrnlmp.pdb
    Loaded symbol image file: ntkrnlmp.exe
    Mapped memory image file: C:\ProgramData\Dbg\sym\ntkrnlmp.exe\D6E46B791047000\ntkrnlmp.exe
    Image path: ntkrnlmp.exe
    Image name: ntkrnlmp.exe
    Browse all global symbols  functions  data
    Image was built with /Brepro flag.
    Timestamp:        D6E46B79 (This is a reproducible build file hash, not a timestamp)
    CheckSum:         00B40E3A
    ImageSize:        01047000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:

Answer 1

One of the mindump files points to "SmbCo10X64.sys". This file is part of Killer network drivers.

I will recommend that you update the driver if it's available. If not, try to uninstall and reinstall it.

I hope this helps. Feel free to ask back any questions and keep me posted.

Answer 2

Thanks Paul - here are a further 4 from later November through to January"

https://1drv.ms/u/s!AgTCubrZ_eFZ2yIuU2jUg6mVl3ZF?e=khoUr7

Answer 3

Hi Kononi,

I'm Paul and I'm here to help you with your concern.

The minidump file didn't name any driver. It only indicated a system kernel driver "ntkrnlmp.exe". Since it's a system file it means something else drove it into a fault. It could be hardware, software, or driver.

We need further analysis.

Can you share other minidump files that you have so that I can analyze them too?

Thanks.