Threads Exceptions BSOD after Windows reinstall

Anonymous
2023-08-21T17:25:05+00:00

.zip dump file: https://drive.google.com/file/d/1r4i-TIIkrmbFzS6mmtHa9buEZwk8-pJA/view?usp=sharing

I have a lot of BSOD recently from IRQL, Resource not owned, DPC Watchdog, and Kernel Security Check Failure. This started happening occassionally about 2 months ago and become more and more frequent. There is no major update like BIOS or driver that I believe caused the problem

From Windbg, it has been narrowed down to be a thread exception problem where a program tries to access or release a thread it has no access to. I ran verifier for 24 hours to get the same types of BSOD at the same frequency.

There is no driver verifier violation from BSOD and in the dump files (using recommended verifier settings) from windbg, so perhaps the driver is not the issue. Often the debugger say the culprit is various programs from sysinternals, my VPN, or a random .exe process. I did a full reinstall using media creation tool that removes all apps and personal files. I thought this was a problem with corrupted windows file that sfc or dism or chkdsk could not repair or detect. I still have the problem of getting BSOD every few hours (sometimes every few minutes) after the reinstall, but windbg gives a more consistent blame: ntkrnlmp.exe

This is followed with nt!ExpReleaseResourceSharedForThreadLite+(Hex number)

I have the newest bios from HP and windows is up to date

BSOD can happen instantly or is followed by severe lag a few seconds before it happens. There is no overheating by the CPU (hover around 70C, can spike to 90C but drop down to 60C quickly). Did windows memory integrity check, both RAM stick pass. Have not done memtest86 and prefer not to unless there is a strong reason of RAM problem

HP hardware diagnostic did not return any error (the one you run without going into windows)

A good pattern I see is that sfc /scannow ocassionally reports and repairs a corrupted file (but not all the time, even after a BSOD)

The following is the CBS folder with the log. Maybe the file that it repairs can help solve the problem: https://drive.google.com/drive/folders/1XEZLPCoyGIBh0-KF-kHr1eH6SJc8vgcR?usp=sharing

My computer is an HP Laptop about 3 years old, AMD Ryzen 5500u, 32 GB RAM (2 x 16GB Crucial 3200MHz) DDR4, no dedicated GPU, 2TB Crucial SSD (new SSD, no bad sectors.. BSOD also happens before I upgraded my SSD)

BIOS: UEFI
BIOS Version/Date: AMI F.30, 4/21/2023

Processor AMD Ryzen 5 5500U with Radeon Graphics, 2100 Mhz, 6 Core(s), 12 Logical Processor(s)

SMBIOS Version 3.3

Windows Version 10.0.19045 Build 19045 (Windows Home)

System Model HP Laptop 14-fq1xxx

Let me know if any of the links are not working of if the dump file is corrupted

Thx

Windows for home | Windows 10 | Performance and system failures

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments No comments

52 answers

Sort by: Newest
  1. Anonymous
    2023-08-23T06:22:01+00:00

    Uninstalled NordVPN. Double checked ndivert.sys is no longer in the list in device verifier. Currently running the device verifier again and waiting for a few BSODs. Will send v2 log and any minidumps soon. Anything else I should do in the meantime?

    Was this answer helpful?

    0 comments No comments
  2. Anonymous
    2023-08-23T05:17:43+00:00

    Please uninstall Nordvpn (It can be reinstalled at a later time)

    ndivert NordVPN Divert Driver ??\c:\program files\nordvpn\7.11.3.0\drivers\ndivert.sys

    Restart WDV

    Event[6976]:

    Log Name: System

    Source: Service Control Manager

    Date: 2023-08-22T19:52:20.9050000Z

    Event ID: 7034

    Task: N/A

    Level: Error

    Opcode: N/A

    Keyword: Classic

    User: N/A

    User Name: N/A

    Computer: DESKTOP-A8D1DFK

    Description:

    The nordvpn-service service terminated unexpectedly. It has done this 1 time(s).

    Event[6186]:

    Log Name: System

    Source: Service Control Manager

    Date: 2023-08-22T19:21:53.5120000Z

    Event ID: 7034

    Task: N/A

    Level: Error

    Opcode: N/A

    Keyword: Classic

    User: N/A

    User Name: N/A

    Computer: DESKTOP-A8D1DFK

    Description:

    The nordsec-threatprotection-service service terminated unexpectedly. It has done this 1 time(s).

    Event[5641]:

    Log Name: System

    Source: Service Control Manager

    Date: 2023-08-22T18:12:13.8490000Z

    Event ID: 7034

    Task: N/A

    Level: Error

    Opcode: N/A

    Keyword: Classic

    User: N/A

    User Name: N/A

    Computer: DESKTOP-A8D1DFK

    Description:

    The nordsec-threatprotection-service service terminated unexpectedly. It has done this 1 time(s).

    https://nordvpn.com/features/threat-protection/#:~:text=Threat%20Protection%20is%20a%20security,they%20can%20harm%20your%20device.

    Was this answer helpful?

    0 comments No comments
  3. Anonymous
    2023-08-23T03:13:12+00:00

    I have new v2 logs and crash dumps here: https://drive.google.com/drive/folders/1\_bVmWGLtszC4O3ffTS-ZATgXMGdH72tt?usp=sharing

    Let me know if you have any questions

    Was this answer helpful?

    0 comments No comments
  4. Anonymous
    2023-08-23T03:12:27+00:00

    I have a few new dump files. Since the max is 5 minidumps in the folder, I copied it and move it to another folder.

    This includes V2 log collector and the associated dump files.

    Link: https://drive.google.com/drive/folders/1\_bVmWGLtszC4O3ffTS-ZATgXMGdH72tt?usp=sharing

    For context, I ran the verifier and there is an issue everytime I start up nordVPN with Ndivert.sys(one of the drivers tested)

    Not opening up nordVPN still gives me BSOD but for ntkrnl. Oddly enough, I caught Resource monitor (permon.exe) gives me 124% CPU usage (Task manager gives 38%) and lags for a while before BSOD

    • Currently ran the driver verifier with only 1 RAM stick in case mismatched RAM was the issue per the other comment
    • Ran HP UEFI Diagnostic on RAM before turning on verifier. no issue during testing

    Hopefully this is enough info

    Was this answer helpful?

    0 comments No comments
  5. Anonymous
    2023-08-23T01:11:01+00:00

    Would the standard settings be enough? I will check all drivers not from the manufacturer, AMD, or Microsoft

    Was this answer helpful?

    0 comments No comments