BSODS on a new system

N004Drake · November 26, 2019

Had a virus so I wiped the system. Reinstalled everything it works well but I get random Bsods and can not figure it out or how to understand DMP files. Here is the out put I have but also will attach DMP file if anyone can read it and tell me whats up. I have about 10 Bsods in the last 4 days. Usually all different.

Please also include the following information:

OS - Windows 8.1, 8, 7, Vista ? WIN10Home
x86 (32-bit) or x64 ? X64
What OS was originaly installed on the system? New build
Is the OS an OEM version (came pre-installed on system) or full retail version (YOU purchased it from a retailer)? Full Retail Version
Age of system (hardware) less then 1 week
Age of OS installation - have you re-installed the OS? less then 24 hours
CPU model: Ryzen 7 2700
Video Card model: MSI RX 580 8 GB Armor
MotherBoard - (if NOT a laptop) Asus Prime X370-Pro
Power Supply - brand & wattage (if laptop, skip this) Corsair RM750x
System Manufacturer ME
Exact model number (if OEM or laptop)
Laptop or Desktop? Desktop

Spoiler


Microsoft (R) Windows Debugger Version 10.0.19494.1001 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.

Symbol search path is: srv*
Executable search path is: 
Windows 10 Kernel Version 18362 MP (16 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 18362.1.amd64fre.19h1_release.190318-1202
Machine Name:
Kernel base = 0xfffff803`3b200000 PsLoadedModuleList = 0xfffff803`3b648170
Debug session time: Mon Nov 25 17:58:26.848 2019 (UTC - 8:00)
System Uptime: 0 days 8:33:45.538
Loading Kernel Symbols
...............................................................
................................................................
..............................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 00000068`ceaf6018).  Type ".hh dbgerr001" for details
Loading unloaded module list
.........
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff803`3b3c14e0 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:fffffc85`ca9a1ab0=000000000000003b
4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff68e58235a20, Address of the instruction which caused the bugcheck
Arg3: fffffc85ca9a23e0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.Sec
    Value: 4

    Key  : Analysis.DebugAnalysisProvider.CPP
    Value: Create: 8007007e on DESKTOP-ESIBTQU

    Key  : Analysis.DebugData
    Value: CreateObject

    Key  : Analysis.DebugModel
    Value: CreateObject

    Key  : Analysis.Elapsed.Sec
    Value: 11

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 66

    Key  : Analysis.System
    Value: CreateObject


BUGCHECK_CODE:  3b

BUGCHECK_P1: c0000005

BUGCHECK_P2: fffff68e58235a20

BUGCHECK_P3: fffffc85ca9a23e0

BUGCHECK_P4: 0

CONTEXT:  fffffc85ca9a23e0 -- (.cxr 0xfffffc85ca9a23e0)
rax=00000000fffff6bd rbx=0000000000000000 rcx=fffff6bd007b78a0
rdx=0000004000000000 rsi=0000000000000000 rdi=fffff68e59ba8780
rip=fffff68e58235a20 rsp=fffffc85ca9a2dd0 rbp=fffffc85ca9a2ef0
 r8=000000000004001f  r9=000000000000002f r10=fffff68e599a7aa0
r11=fffffc85ca9a2ac0 r12=fffff6bd0500e9c8 r13=0000003101499700
r14=fffff6bd0500e9c8 r15=fffff6bd05011d90
iopl=0         nv up ei pl nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00050206
win32kfull!EditionPostRawMouseInputMessage+0x160:
fffff68e`58235a20 498b4528        mov     rax,qword ptr [r13+28h] ds:002b:00000031`01499728=????????????????
Resetting default scope

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

PROCESS_NAME:  csrss.exe

STACK_TEXT:  
fffffc85`ca9a2dd0 fffff68e`5823622d : 00000000`00000002 00000047`c597ce85 00000000`01d65c3b fffffc85`ca9a3118 : win32kfull!EditionPostRawMouseInputMessage+0x160
fffffc85`ca9a2eb0 fffff68e`58235891 : fffffc85`ca9a30d0 00000000`00000001 00000000`00000000 ffff8f07`2a455470 : win32kfull!xxxMoveEventAbsolute+0x309
fffffc85`ca9a2fb0 fffff68e`59a228c1 : 00000000`00000000 00000000`00000000 fffffc85`ca9a3118 fffff68e`59a22d82 : win32kfull!EditionCommitMousePosAndMove+0x91
fffffc85`ca9a3020 fffff68e`59a22732 : 00000000`00000001 fffffc85`ca9a3169 00000000`00000000 00000000`00000001 : win32kbase!ApiSetEditionCommitMousePosAndMove+0xd1
fffffc85`ca9a30a0 fffff68e`599ac930 : 00000208`000001d8 fffffc85`ca9a3220 fffff6bd`00677000 fffffc85`ca9a3330 : win32kbase!CMouseProcessor::CommitMousePosAndMoveCursor+0x126
fffffc85`ca9a31d0 fffff68e`59b23662 : 00000208`000001d7 00000208`000001d8 fffff6bd`0325e710 00003ac4`000078d0 : win32kbase!CMouseProcessor::ProcessMouseInputData+0x1a8
fffffc85`ca9a3250 fffff68e`59b182f6 : fffff6bd`006063f0 ffff8f07`2ad4c070 00000000`00000018 fffff6bd`006063f0 : win32kbase!CMouseProcessor::ProcessInput+0x43e
fffffc85`ca9a33e0 fffff68e`59b0a847 : fffff68e`59b630e0 fffffc85`ca9a3520 fffff6bd`006063f0 00000000`00000000 : win32kbase!CMouseSensor::ProcessInput+0x56
fffffc85`ca9a3420 fffff68e`599eaad0 : 00000000`00000040 fffff68e`59b630e0 00000000`00000001 fffff803`3b23b644 : win32kbase!CBaseInput::OnReadNotification+0x467
fffffc85`ca9a3560 fffff68e`599ea832 : ffffffff`ffffffd2 fffff6bd`0069b650 00000000`00000006 ffffccc4`b0312b76 : win32kbase!CBaseInput::OnDispatcherObjectSignaled+0x290
fffffc85`ca9a36d0 fffff68e`599e9efe : 00000000`00000003 00000000`00002000 fffff6bd`00623600 fffff68e`59b9fb10 : win32kbase!CBaseInput::_OnDispatcherObjectSignaled+0x12
fffffc85`ca9a3700 fffff68e`599e9d02 : 00000000`00000006 00000000`00002000 00000000`00000006 fffff803`3b2386da : win32kbase!LegacyInputDispatcher::Dispatch+0x52
fffffc85`ca9a3730 fffff68e`5821ad88 : fffff6bd`00623620 fffff6bd`00623620 00000000`00000004 00000000`00000001 : win32kbase!LegacyInputDispatcher::WaitAndDispatch+0x102
fffffc85`ca9a3860 fffff68e`5821a9c3 : 00000000`00000004 00000000`00000004 00000000`0000000c fffff68e`59ba71e0 : win32kfull!xxxDesktopThreadWaiter+0x130
fffffc85`ca9a38e0 fffff68e`59a2ea0d : ffff8f07`2ad4a080 ffff8f07`2ad4a080 00000000`00000000 00000000`00000005 : win32kfull!xxxDesktopThread+0x403
fffffc85`ca9a39c0 fffff68e`5822afef : ffff8f07`2ad4a080 00000000`00000000 00000000`00000005 00000000`00000000 : win32kbase!xxxCreateSystemThreads+0x22d
fffffc85`ca9a3ad0 fffff803`3b3d2d18 : ffff8f07`2ad4a080 00000000`00000005 0000021a`07804280 00000000`00000404 : win32kfull!NtUserCallNoParam+0x6f
fffffc85`ca9a3b00 00007ffa`3ca31144 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000068`cedffae8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`3ca31144


SYMBOL_NAME:  win32kfull!EditionPostRawMouseInputMessage+160

MODULE_NAME: win32kfull

IMAGE_NAME:  win32kfull.sys

IMAGE_VERSION:  10.0.18362.476

STACK_COMMAND:  .cxr 0xfffffc85ca9a23e0 ; kb

BUCKET_ID_FUNC_OFFSET:  160

FAILURE_BUCKET_ID:  0x3B_c0000005_win32kfull!EditionPostRawMouseInputMessage

OS_VERSION:  10.0.18362.1

BUILDLAB_STR:  19h1_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {6aaa6726-d137-3398-0ceb-0a797d93db01}

Followup:     MachineOwner
---------

4: kd> lmvm win32kfull
Browse full module list
start             end                 module name
fffff68e`58200000 fffff68e`585a1000   win32kfull   (pdb symbols)          C:\ProgramData\Dbg\sym\win32kfull.pdb\6BD86C55D98776F3C950B33BF43382661\win32kfull.pdb
    Loaded symbol image file: win32kfull.sys
    Image path: \SystemRoot\System32\win32kfull.sys
    Image name: win32kfull.sys
    Browse all global symbols  functions  data
    Image was built with /Brepro flag.
    Timestamp:        9E61D72C (This is a reproducible build file hash, not a timestamp)
    CheckSum:         00396A5B
    ImageSize:        003A1000
    File version:     10.0.18362.476
    Product version:  10.0.18362.476
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        3.7 Driver
    File date:        00000000.00000000
    Translations:     0409.04b0
    Information from resource tables:
        CompanyName:      Microsoft Corporation
        ProductName:      Microsoft® Windows® Operating System
        InternalName:     win32kfull.sys
        OriginalFilename: win32kfull.sys
        ProductVersion:   10.0.18362.476
        FileVersion:      10.0.18362.476 (WinBuild.160101.0800)
        FileDescription:  Full/Desktop Win32k Kernel Driver
        LegalCopyright:   © Microsoft Corporation. All rights reserved.

112519-8171-01.dmp

N004Drake · December 2, 2019

I think it is the ram. if i turn off XMP it has no errors when running a memtest 64 for 10 passes where as before it had a few. Im not sure what to do to get this to run at the speed the MB and processor will allow.

N004Drake · December 2, 2019

So I saw a thread with this same Memory to Set XMP, manually type in the first 6 timings, CHange volt to 1.35 (already on that), Set Multiplier to 32x (can not find that only can select DDR4-3200 and obviously others I am thinking this is the same thing?) Tried to do a Memtest64 got 6 errors in 6 passes. moved it to 1.365 V and still got errors, someone mentioned higher V. I have now set all the same except change it to DDR4 3000. And i got no errors on 6 passes. I dont know what to do here.