Uninstalled NordVPN. Double checked ndivert.sys is no longer in the list in device verifier. Currently running the device verifier again and waiting for a few BSODs. Will send v2 log and any minidumps soon. Anything else I should do in the meantime?
Threads Exceptions BSOD after Windows reinstall
.zip dump file: https://drive.google.com/file/d/1r4i-TIIkrmbFzS6mmtHa9buEZwk8-pJA/view?usp=sharing
I have a lot of BSOD recently from IRQL, Resource not owned, DPC Watchdog, and Kernel Security Check Failure. This started happening occassionally about 2 months ago and become more and more frequent. There is no major update like BIOS or driver that I believe caused the problem
From Windbg, it has been narrowed down to be a thread exception problem where a program tries to access or release a thread it has no access to. I ran verifier for 24 hours to get the same types of BSOD at the same frequency.
There is no driver verifier violation from BSOD and in the dump files (using recommended verifier settings) from windbg, so perhaps the driver is not the issue. Often the debugger say the culprit is various programs from sysinternals, my VPN, or a random .exe process. I did a full reinstall using media creation tool that removes all apps and personal files. I thought this was a problem with corrupted windows file that sfc or dism or chkdsk could not repair or detect. I still have the problem of getting BSOD every few hours (sometimes every few minutes) after the reinstall, but windbg gives a more consistent blame: ntkrnlmp.exe
This is followed with nt!ExpReleaseResourceSharedForThreadLite+(Hex number)
I have the newest bios from HP and windows is up to date
BSOD can happen instantly or is followed by severe lag a few seconds before it happens. There is no overheating by the CPU (hover around 70C, can spike to 90C but drop down to 60C quickly). Did windows memory integrity check, both RAM stick pass. Have not done memtest86 and prefer not to unless there is a strong reason of RAM problem
HP hardware diagnostic did not return any error (the one you run without going into windows)
A good pattern I see is that sfc /scannow ocassionally reports and repairs a corrupted file (but not all the time, even after a BSOD)
The following is the CBS folder with the log. Maybe the file that it repairs can help solve the problem: https://drive.google.com/drive/folders/1XEZLPCoyGIBh0-KF-kHr1eH6SJc8vgcR?usp=sharing
My computer is an HP Laptop about 3 years old, AMD Ryzen 5500u, 32 GB RAM (2 x 16GB Crucial 3200MHz) DDR4, no dedicated GPU, 2TB Crucial SSD (new SSD, no bad sectors.. BSOD also happens before I upgraded my SSD)
BIOS: UEFI
BIOS Version/Date: AMI F.30, 4/21/2023
Processor AMD Ryzen 5 5500U with Radeon Graphics, 2100 Mhz, 6 Core(s), 12 Logical Processor(s)
SMBIOS Version 3.3
Windows Version 10.0.19045 Build 19045 (Windows Home)
System Model HP Laptop 14-fq1xxx
Let me know if any of the links are not working of if the dump file is corrupted
Thx
Windows for home | Windows 10 | Performance and system failures
Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.
52 answers
Sort by: Newest
-
Anonymous
2023-08-23T06:22:01+00:00 -
Anonymous
2023-08-23T05:17:43+00:00 Please uninstall Nordvpn (It can be reinstalled at a later time)
ndivert NordVPN Divert Driver ??\c:\program files\nordvpn\7.11.3.0\drivers\ndivert.sys
Restart WDV
Event[6976]:
Log Name: System
Source: Service Control Manager
Date: 2023-08-22T19:52:20.9050000Z
Event ID: 7034
Task: N/A
Level: Error
Opcode: N/A
Keyword: Classic
User: N/A
User Name: N/A
Computer: DESKTOP-A8D1DFK
Description:
The nordvpn-service service terminated unexpectedly. It has done this 1 time(s).
Event[6186]:
Log Name: System
Source: Service Control Manager
Date: 2023-08-22T19:21:53.5120000Z
Event ID: 7034
Task: N/A
Level: Error
Opcode: N/A
Keyword: Classic
User: N/A
User Name: N/A
Computer: DESKTOP-A8D1DFK
Description:
The nordsec-threatprotection-service service terminated unexpectedly. It has done this 1 time(s).
Event[5641]:
Log Name: System
Source: Service Control Manager
Date: 2023-08-22T18:12:13.8490000Z
Event ID: 7034
Task: N/A
Level: Error
Opcode: N/A
Keyword: Classic
User: N/A
User Name: N/A
Computer: DESKTOP-A8D1DFK
Description:
The nordsec-threatprotection-service service terminated unexpectedly. It has done this 1 time(s).
-
Anonymous
2023-08-23T03:13:12+00:00 I have new v2 logs and crash dumps here: https://drive.google.com/drive/folders/1\_bVmWGLtszC4O3ffTS-ZATgXMGdH72tt?usp=sharing
Let me know if you have any questions
-
Anonymous
2023-08-23T03:12:27+00:00 I have a few new dump files. Since the max is 5 minidumps in the folder, I copied it and move it to another folder.
This includes V2 log collector and the associated dump files.
Link: https://drive.google.com/drive/folders/1\_bVmWGLtszC4O3ffTS-ZATgXMGdH72tt?usp=sharing
For context, I ran the verifier and there is an issue everytime I start up nordVPN with Ndivert.sys(one of the drivers tested)
Not opening up nordVPN still gives me BSOD but for ntkrnl. Oddly enough, I caught Resource monitor (permon.exe) gives me 124% CPU usage (Task manager gives 38%) and lags for a while before BSOD
- Currently ran the driver verifier with only 1 RAM stick in case mismatched RAM was the issue per the other comment
- Ran HP UEFI Diagnostic on RAM before turning on verifier. no issue during testing
Hopefully this is enough info
-
Anonymous
2023-08-23T01:11:01+00:00 Would the standard settings be enough? I will check all drivers not from the manufacturer, AMD, or Microsoft