Mystery Crash: Monitor Blank, PC Wouldn't Shut Down

[doutee]

Hi

This isn't an urgent issue, as it was a one-time crash which hasn't repeated (occurred about a month ago). However after much searching I can't seem to find any explanation of what might have happened - in fact I can't even find an account of the same kind of crash happening.

A crash occurred where the monitor went blank as if it was receiving no input. What was really strange, was that I also could not turn the computer off. Tried Ctrl-Alt-Del, the reset button on the case, and eventually holding down the power button - none of which worked. Eventually, despite really not wanting to, the only option I had left was to turn off the power at the power supply. The system turned on again with no issues, and there hasn't been a repeat since.

I had very recently (within a week I think) replaced my boot NVME drive (to a WD Blue SN550 1TB), and performed a clean Windows 10 install. I have a suspicion this may be something to do with it as I've never encountered the problem before (had the whole system for nearly 4 years now). I should also mention, that whilst the monitor was blank and before I turned it off at the power supply, I checked all the connections (eg hdmi from graphics card, power cord to monitor etc, all the obvious things) and nothing made any difference. Also at the time of the crash, I wasn't performing anything out of the ordinary, I think just general web browsing - and the screen went blank at a moment when I wasn't actually doing anything like opening a program, think I was just reading some text.

Any ideas what may have caused this? I'm really curious to figure it out, any input gratefully received!


Case
FRACTAL DEFINE R5 BLACK QUIET MID-TOWER CASE
Processor (CPU)
AMD Ryzen 5 1600 Six Core CPU (3.2GHz-3.6GHz/19MB CACHE/AM4)
Motherboard
ASUS® PRIME B350-PLUS (DDR4, 6Gb/s, CrossFireX)
Memory (RAM)
16GB Corsair VENGEANCE DDR4 2133MHz (2 x 8GB)
Graphics Card
8GB AMD RADEON™ RX 580 - HDMI, 3 x DP - DX® 12
1st Storage Drive
2TB SEAGATE BARRACUDA SATA-III 3.5" HDD, 6GB/s, 7200RPM, 256MB CACHE
1st M.2 SSD Drive
256GB SAMSUNG PM961 M.2, PCIe NVMe (up to 2800MB/R, 1100MB/W)
DVD/BLU-RAY Drive
12x BLU-RAY ROM DRIVE, 16x DVD ±R/±RW
Power Supply
CORSAIR 650W CS SERIES™ MODULAR 80 PLUS® GOLD, ULTRA QUIET
Power Cable
1 x 1 Metre UK Power Cable (Kettle Lead)
Processor Cooling
STANDARD AMD CPU COOLER
Thermal Paste
STANDARD THERMAL PASTE FOR SUFFICIENT COOLING
Sound Card
ONBOARD 6 CHANNEL (5.1) HIGH DEF AUDIO (AS STANDARD)
USB/Thunderbolt Options
MIN. 2 x USB 3.0 & 2 x USB 2.0 PORTS @ BACK PANEL + MIN. 2 FRONT PORTS
Operating System
Windows 10 Home 64 Bit - inc. Single Licence
Operating System Language
United Kingdom - English Language
Windows Recovery Media
Windows 10 (64-bit) DVD with paper sleeve
Office Software
NO OFFICE SOFTWARE
Anti-Virus
NO ANTI-VIRUS SOFTWARE
Browser
Google Chrome™
Keyboard & Mouse
PCS S300 USB MEDIA KEYBOARD
Keyboard & Mouse
PCS S300 USB OPTICAL MOUSE
Mouse Pad
ROCCAT™ Taito 2017 Mid Gaming Mousepad
Warranty
3 Year Gold Warranty (2 Year Collect & Return, 2 Year Parts, 3 Year Labour)

 

[Martinr36]

that certainly sounds a strange one, maybe check the update log & see if an update coincided with the crash

 

[doutee]

Thanks for the reply Martin.

So it looks like windows updates were happening the day before, but not immediately before the crash.
Looking at my history, I think the last thing I'd updated was the realtek audio drivers (about 20mins or so before the crash).

 

[Martinr36]

It might have been to do with one of the updates, if it happens again then resurrect this post

 

[ubuysa]

Is there anything in the event logs?

 

[doutee]

Where would I find the event logs?

 

[ubuysa]

Where would I find the event logs?

In the Event Viewer, enter the 'eventvwr' command in the Run command box. Check for Critical and Error log entries in the System and Application logs.

If you can't make sense of the event viewer let me know and I'll tell you how to export the logs and upload them here.

 

[doutee]

Ah there it is, thanks!

So no Critical/Error entries around that time in the Application logs.

There are a few Error entries on the System logs.
They read:
"The previous system shutdown at 21:10:36 on ‎04/‎01/‎2021 was unexpected."
"The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly."

(Weirdly I'm not sure the above shutdown was when the monitor went blank, as I think this occurred around 21:20. That said, there's no entries in the event log between 21:10-21:43. My memory might not be 100% accurate! 2144 is when I had switched off at the power supply and restarted. )

"The previous system shutdown at 21:44:05 on ‎04/‎01/‎2021 was unexpected."
"The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly."

The only other Error entry is from a few hours before the crash, and another a few hours after:
"TP-Link Wireless USB Adapter : Has determined that the network adapter is not functioning properly."

Not sure if this provides any helpful information?

 

[ubuysa]

Ah there it is, thanks!

So no Critical/Error entries around that time in the Application logs.

There are a few Error entries on the System logs.
They read:
"The previous system shutdown at 21:10:36 on ‎04/‎01/‎2021 was unexpected."
"The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly."

(Weirdly I'm not sure the above shutdown was when the monitor went blank, as I think this occurred around 21:20. That said, there's no entries in the event log between 21:10-21:43. My memory might not be 100% accurate! 2144 is when I had switched off at the power supply and restarted. )

"The previous system shutdown at 21:44:05 on ‎04/‎01/‎2021 was unexpected."
"The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly."

The only other Error entry is from a few hours before the crash, and another a few hours after:
"TP-Link Wireless USB Adapter : Has determined that the network adapter is not functioning properly."

Not sure if this provides any helpful information?

These are both caused by the power going off. The 21:44 you know about, the earlier one (21:10) may have been because of some sort of power problem?

If you like you can export the system and application logs so that we can take a look? To do that do the following:

1. Open the Event Viewer again.
2. Expand the Windows Logs section on the left.
3. Right click on the Application entry and select 'Save all events as...'. Choose an output folder of your choice and make the file name Apps (the .evtx extension will be added automatically).
4. Right click on the System entry and select 'Save all events as...'. Choose an output folder of your choice and make the file name Sys (the .evtx extension will be added automatically).
5. Upload the Apps.evtx and Sys.evtx files either here (if they'll fit) or to the cloud with a link to them here.

 

[doutee]

Hi, apologies for the resurrection of this post after 6 months! If anyone is feeling generous and fancies a bit of investigation work to figure out the issue, I'll be hugely grateful!

Some very similar shutdowns/errors (to my original post) have been repeating several times since I last posted. I've kept a log of 9 of these occasions, with a brief description of what happened plus screenshots of the Event Viewer entries around the time of the crash.

The most common pattern is: I'm using Firefox (usually have youtube open on at least one tab, but this could be coincidence), the screen freezes for a few seconds, then goes blank. No inputs from keyboard work. The fans (cpu/gpu, I'm not sure) seem to speed up, and the case power LED remains on. The only option at this point is to long press the power button or reset button, and then things will start up as if nothing happened.

The event viewer usually gives no indication of any errors, other than the "The previous system shutdown at xxx on xxx was unexpected."

There have been a couple of variations on the theme. One where the PC was first turned on, nothing loaded, and the screen displayed: "searching for input sources" didn't find any. Blue circle power button lit up, fans on. Had to long press power button to turn off.

Another occasion did coincide with the the following error:
"A fatal hardware error has occurred.
Reported by component: Processor Core
Error Source: Machine Check Exception
Error Type: Cache Hierarchy Error
Processor APIC ID: 10"
This error also happened one other time that I noticed, with the last line reading: "Processor APIC ID: 13"

The above variations were the rarity though.

Any clues as to what might be going on? My (quite uneducated) guess is it might be a power supply issue? Any suggestions welcome

 

[ubuysa]

Another occasion did coincide with the the following error:
"A fatal hardware error has occurred.
Reported by component: Processor Core
Error Source: Machine Check Exception
Error Type: Cache Hierarchy Error
Processor APIC ID: 10"
This error also happened one other time that I noticed, with the last line reading: "Processor APIC ID: 13"

There should be a kernel memory dump written if there's been a machine check exception, it will be in the file C:\Windows\Memory.dmp. That will be too big to upload direct to the forum, so upload it to the cloud somewhere with a link to it here.

There may also be minidumps in the folder C:\Windows\Minidumps, if there are then upload those too.

It really would be useful for you to upload the entire System and Application logs as described earlier. I appreciate that you see nothing unusual but a second pair of eyes (or several seconds pairs of eyes!) is always a good thing to have.

 

[doutee]

Hi Ubuysa

Thanks for following this up again, much appreciated!

I'm a little cautious about putting anything in the cloud (apologies for possibly unnecessary paranoia!) so would it be possible to message/email you directly with the logs?

Having looked, I can't find the file "C:\Windows\Memory.dmp" or the folder "C:\Windows\Minidumps".

 

[ubuysa]

Hi Ubuysa

Thanks for following this up again, much appreciated!

I'm a little cautious about putting anything in the cloud (apologies for possibly unnecessary paranoia!) so would it be possible to message/email you directly with the logs?

TBH I don't see the difference between storing dumps in the cloud (where they are secure) and emailing them to someone you don't know and have never met?

FWIW All of my user data is in the cloud, and synchronised in real-time too.

Having looked, I can't find the file "C:\Windows\Memory.dmp" or the folder "C:\Windows\Minidumps".

What about the C:\Windows\LiveKernelReports folder, any recent dumps in there?

 

[doutee]

What about the C:\Windows\LiveKernelReports folder, any recent dumps in there?

Thanks for the guidance, yes I see two files here, corresponding to the two times it had those specific errors (machine check exception).

3. Right click on the Application entry and select 'Save all events as...'. Choose an output folder of your choice and make the file name Apps (the .evtx extension will be added automatically).
4. Right click on the System entry and select 'Save all events as...'. Choose an output folder of your choice and make the file name Sys (the .evtx extension will be added automatically).

I've saved the files as you explained; it asked if I want to add "display information", do I need to select that option?


Also, the same familiar crash has happened again today, which makes for 10 of these crashes since May (not including the 2 machine check exception ones).
They seem to happen roughly every two weeks, and usually on a Monday... they don't all follow this pattern exactly. Could this be windows update related? Usually I haven't noticed this coinciding, however today when I rebooted following the crash, it was followed by an update process.

 

[Martinr36]

Thanks for the guidance, yes I see two files here, corresponding to the two times it had those specific errors (machine check exception).



I've saved the files as you explained; it asked if I want to add "display information", do I need to select that option?


Also, the same familiar crash has happened again today, which makes for 10 of these crashes since May (not including the 2 machine check exception ones).
They seem to happen roughly every two weeks, and usually on a Monday... they don't all follow this pattern exactly. Could this be windows update related? Usually I haven't noticed this coinciding, however today when I rebooted following the crash, it was followed by an update process.

Might be worth looking through the update logs to see if it does coincide with anything

 

[doutee]

Might be worth looking through the update logs to see if it does coincide with anything

Is that by looking at "View Update History"?
If so, the only update I can see that happens on the same date as a crash was the one today. So perhaps not related then.

 

[ubuysa]

Thanks for the guidance, yes I see two files here, corresponding to the two times it had those specific errors (machine check exception).

Upload them then please.

I've saved the files as you explained; it asked if I want to add "display information", do I need to select that option?

Display information is not needed as long as the language of your Windows system is English. Please upload the logs.

Also, the same familiar crash has happened again today, which makes for 10 of these crashes since May (not including the 2 machine check exception ones).
They seem to happen roughly every two weeks, and usually on a Monday... they don't all follow this pattern exactly. Could this be windows update related? Usually I haven't noticed this coinciding, however today when I rebooted following the crash, it was followed by an update process.

Monday is a strange day for updates, they're usually pushed out on a Tuesday. It certainly could be a problem update from earlier though.

Open an elevated command prompt or PowerShell session and enter the following command to check your component store for corruptions:

dism /online /cleanup-image /checkhealth

If the output of that says anything other than 'No component store corruption detected' then stop at that point and let us know what is does say.

Assuming the above dism command produced the expected output (No component store corruption detected) then enter the following command to check critical Windows system files:

sfc /scannow

If the output of that says anything other than 'Windows Resource Protection did not find any integrity violations' then let us know what it does say.

 

[doutee]

Display information is not needed as long as the language of your Windows system is English. Please upload the logs.

Will do asap.

dism /online /cleanup-image /checkhealth

If the output of that says anything other than 'No component store corruption detected' then stop at that point and let us know what is does say.

No problems here: 'No component store corruption detected'

sfc /scannow

If the output of that says anything other than 'Windows Resource Protection did not find any integrity violations' then let us know what it does say.

Came up with the following:
"Windows Resource Protection found corrupt files and successfully repaired them.
For online repairs, details are included in the CBS log file located at
windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log. For offline
repairs, details are included in the log file provided by the /OFFLOGFILE flag."

Thanks for the directions!

 

[ubuysa]

No problems here: 'No component store corruption detected'

Perfect

Came up with the following:
"Windows Resource Protection found corrupt files and successfully repaired them.
For online repairs, details are included in the CBS log file located at
windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log. For offline
repairs, details are included in the log file provided by the /OFFLOGFILE flag."

That's OK too, just reboot.

You can upload the cbs.log file if you like and we'll check what it found.