What is causing my computer to BSOD at random times?

Hello Alex,

Your MeasuredBoot log file shows that "Secure Boot" is not turned on. It is enabled on my system and gives me some peace of mind:

You can read about it here: Secure boot | Microsoft Learn

Since reinstalling operating systems is quite a labour intensive task, it would be good to identify the source of the problem before embarking on such steps. Unfortunately, there is no guarantee that we will be able to identify the source. Enabling and testing Secure Boot would hopefully eliminate a class of malware types.

Gary

Hi Gary and vivs_lunchtime,

I only noticed one file from my most recent boot, which I uploaded to the folder. There was no json or other logs aside from the one I uploaded. Also thank you vivs_lunchtime for the heads up about the full dump file, I didn't realize it could contain sensitive data. I deleted it from my google drive right after reading that.

In terms of the crashes, worst case scenario I can turn on core isolation if we can't figure out what's wrong with my system. There are still a couple of things I would still like to try, however. I just ran the driver verifier for a bit to see if it would cause a crash. A few weeks ago when I had bad RAM, turning on driver verifier caused my PC to BSoD around 30 seconds after booting, repeatedly. This behavior evidently has gone away since replacing my RAM.

When I reinstalled windows I used an external hard drive to restore some folders that had data in them. I used Windows back-up service and then I restored those files using File History. I don't know if that may have allowed the malware (or potentially poorly written software) to carry over into my fresh installation of Windows. I intend to refresh Windows one more time and hold off on restoring those files to see if it will still BSoD. My other thoughts are that if its malware rooted in the motherboard software, could I flash my BIOS to get rid of it?

Thank you both for all your help,

Alex J

Hello Alex,

There is another set of data that you could perhaps provide - some logs of the boot process.

The logs are in a "hidden" (system) folder. One way of zipping the logs is as follows:

Enable the "Show hidden files, folders and drives" option in Explorer and then view the folder \Windows\Logs\MeasuredBoot.

My last boot was the 555 (yours will be different). Select all of those files for your last boot and send them to a compressed file ("Compress to..." context menu option); finally, share that compressed file.

This Microsoft article discusses this topic: Decode Measured Boot logs to track PCR changes - Windows Client | Microsoft Learn

Gary

Hello vivs_lunchtime,

That number where you wrote "look here" (0ABCC77118461CEFDh, 0xABCC77118461CEFD) is probably not a random number - it appears in quite a few libraries. Here is an example: Fast power-of-10 division using multiply and shift magic constants in a look-up table instead of a costly division operation.

Gary

Hello vivs_lunchtime,

A key question for me is how did this code get loaded? Alex said that he reinstalled Windows and the key applications that he uses (hopefully from trustworthy sources) and the problem persists. Perhaps the virus is outside the Windows partition and loaded at boot time - then contiguous physical pages would be expected...

Gary