Random Crash and Restart

[NoddyPirate]

It could still be the RAM overclock of course, but getting rid of Bit Defender first is a wise move. You can always reinstall it if you find out in the future that it was RAM all along.

I also have 15 Kernel-Power events indication the usual "The system has rebooted without cleanly shutting down first. " with the first one occurring on the very first day with my PC, so the RAM OC would have nothing whatsoever to do with that.

Am I right to assume that such events would have included a system crash and restart that I simply didn't see and wasn't aware of at the time?

 

[ubuysa]

Am I right to assume that such events would have included a system crash and restart that I simply didn't see and wasn't aware of at the time?

Not necessarily. If you switch off by holding the power button down for 5 seconds you'll see one of those errors next boot.

Anytime shutdown is not clean (or not done at all) you'll get that log entry.

 

[NoddyPirate]

Not necessarily. If you switch off by holding the power button down for 5 seconds you'll see one of those errors next boot.

Anytime shutdown is not clean (or not done at all) you'll get that log entry.

Okey dokes - that makes sense.

I’ve never needed a hold down the power button to force a shutdown, but by the sounds of it just an imperfect regular shutdown could cause an event, however unlikely?

 

[NoddyPirate]

Not necessarily. If you switch off by holding the power button down for 5 seconds you'll see one of those errors next boot.

Anytime shutdown is not clean (or not done at all) you'll get that log entry.

Okey dokes - that makes sense.

I’ve never needed a hold down the power button to force a shutdown, but by the sounds of it just an imperfect regular shutdown could cause an event, however unlikely?

 

[NoddyPirate]

Right so - I left the PC running while I was out this morning and there has been three more crashes and reboots while I was away. Three new Minidump files created also.

@ubuysa - will I upload them again here? - or will I move on to the next troubleshooting option which would be to reverse the last thing I did - which was to increase my undervolt. I could revert to the last setting that seemed stable - or just completely remove all OC and UV settings entirely?

What's best for troubleshooting and identifiying the culprit in your opinion?

(UN-EDIT - RAM OC to come first now as suggested.)

 

[ubuysa]

Right so - I left the PC running while I was out this morning and there has been three more crashes and reboots while I was away. Three new Minidump files created also.

@ubuysa - will I upload them again here? - or will I move on to the next troubleshooting option which would be to reverse the last thing I did - which was to increase my undervolt. I could revert to the last setting that seemed stable - or just completely remove all OC and UV settings entirely?

What's best for troubleshooting and identifiying the culprit in your opinion?

I'd reduce the RAM overclock first, quite radically initially.

If it still BSODs then restore the RAM overclock and try dropping the undervolt, again quite radically.

Once you know which one is the issue you can tune that one for stability.

Once it's stable you could consider reinstalling BitDefender.

Always upload any dumps.

 

[NoddyPirate]

I'd reduce the RAM overclock first, quite radically initially.

If it still BSODs then restore the RAM overclock and try dropping the undervolt, again quite radically.

Once you know which one is the issue you can tune that one for stability.

Once it's stable you could consider reinstalling BitDefender.

Always upload any dumps.

Thank you sir. Dumps coming in a mo - they all appear to be the same DRIVER_OVERRAN_STACK_BUFFER events as before.

I'll undo the RAM OC and see how we get on.

A google search suggest Graphics Drivers can cause these DRIVE_OVERRAN thingys frequently. Any use in considering a DDU uninstall and reinstall next if the crashes continue despite the RAM fiddle?

 

[NoddyPirate]

Three minis from this morning - main Memory Dump uploading as I type:

Microsoft OneDrive

1drv.ms

 

[ubuysa]

Thank you sir. Dumps coming in a mo - they all appear to be the same DRIVER_OVERRAN_STACK_BUFFER events as before.

I'll undo the RAM OC and see how we get on.

A google search suggest Graphics Drivers can cause these DRIVE_OVERRAN thingys frequently. Any use in considering a DDU uninstall and reinstall next if the crashes continue despite the RAM fiddle?

One thing at a time. As I said, removing overclock and undervolt is the first thing to do with BSODs, so you need to prove whether it is or isn't one of these before looking elsewhere.

Softly softly catchee monkey.

 

[NoddyPirate]

One thing at a time. As I said, removing overclock and undervolt is the first thing to do with BSODs, so you need to prove whether it is or isn't one of these before looking elsewhere.

Softly softly catchee monkey.

Brillo thanks. I think I'm just distracted by the Event Logs that predate both the OC and UV. But gently gently grabby primate is the way to go indeed....

 

[ubuysa]

Brillo thanks. I think I'm just distracted by the Event Logs that predate both the OC and UV. But gently gently grabby primate is the way to go indeed....

Getting distracted is easy - and usually fatal. Pick one potential cause (the most likely) and test only that. If that's not it then move on to the next potential cause and test only that.

There are no shortcuts.

 

[NoddyPirate]

Right - RAM OC removed - what a fiddly load of messing that involved! Simplest was to put BIOS back to defaults and then reinsert the standard DOCP profile followed by the CPU OC and UV again. Why do we do these things to ourselves!!

Will advise....

Again @ubuysa - thank you so much for your time and effort here. Really appreciated. Who knew troubleshooting a over grands worth of new equipment which is misbehaving because of stupid stuff I did to it could be so much fun!

 

[ubuysa]

Three minis from this morning - main Memory Dump uploading as I type:

Microsoft OneDrive

1drv.ms

I've looked at these three minidumps and they're all incredibly similar, so much so that I now doubt this is undervolt or overclock related.

All three dumps are DRIVER_OVERRAN_STACK_BUFFER and in all three the stack trace shows exactly the same registry function calls. In two of them the process in control is runtimebroker.exe, which we know manages the permissions for UWP apps. The third is sihost.exe, this is the Shell Infrastructure host and it's used to enable UWP applications to run in a windowed interface.

In these three dumps then, and in one of your previous dumps, we have registry errors relating to UWP apps. I wonder whether this could be either a registry error or possibly some sort of Microsoft Store issue? It's hard to see how flaky RAM would produce exactly the same issue in four minidumps?

Something else I've noticed is that MBAM modules are loaded in all three of these dumps. I can see mbamchameleon.sys and mbamswissarmy.sys and both are components of Malwarebyte's Antimalware product - though whether these drivers are related only to Malwarebytes on-demand scanner or the full premium version I don't know. I checked the previous dumps you uploaded and they're not loaded in any of them (which doesn't mean they're not installed).

What Malwarebytes product do you have installed?

Have you ever run a registry cleaner?

What UWP apps do you have installed?

I've changed my feeling about your issues completely now, based on these three dumps. It now seems to be specifically related to UWP apps and the registry rather then a general issues caused by overclocked RAM or an undervolted CPU - but it's not possible to be sure of that.

I now think the wisest course of action would be to remove both the RAM overclock and the CPU undervolt to be certain they are not contributory factors. If you then get further crashes and restarts we'll need to delve deeper into your registry and UWP apps somehow....

 

[NoddyPirate]

I've looked at these three minidumps and they're all incredibly similar, so much so that I now doubt this is undervolt or overclock related.

All three dumps are DRIVER_OVERRAN_STACK_BUFFER and in all three the stack trace shows exactly the same registry function calls. In two of them the process in control is runtimebroker.exe, which we know manages the permissions for UWP apps. The third is sihost.exe, this is the Shell Infrastructure host and it's used to enable UWP applications to run in a windowed interface.

In these three dumps then, and in one of your previous dumps, we have registry errors relating to UWP apps. I wonder whether this could be either a registry error or possibly some sort of Microsoft Store issue? It's hard to see how flaky RAM would produce exactly the same issue in four minidumps?

Something else I've noticed is that MBAM modules are loaded in all three of these dumps. I can see mbamchameleon.sys and mbamswissarmy.sys and both are components of Malwarebyte's Antimalware product - though whether these drivers are related only to Malwarebytes on-demand scanner or the full premium version I don't know. I checked the previous dumps you uploaded and they're not loaded in any of them (which doesn't mean they're not installed).

What Malwarebytes product do you have installed?

Have you ever run a registry cleaner?

What UWP apps do you have installed?

I've changed my feeling about your issues completely now, based on these three dumps. It now seems to be specifically related to UWP apps and the registry rather then a general issues caused by overclocked RAM or an undervolted CPU - but it's not possible to be sure of that.

I now think the wisest course of action would be to remove both the RAM overclock and the CPU undervolt to be certain they are not contributory factors. If you then get further crashes and restarts we'll need to delve deeper into your registry and UWP apps somehow....

Another crash while I was away at lunchtime - no minidump this time - but critical kernel-power event registered nonetheless. So the RAM OC can certainly be ruled out for now. (EDIT - there is a new Memory Dump - uploading now and will share it when it's ready) (EDIT SQUARED - it appears to be the same DRIVER_OVERRAN_STACK_BUFFER again, with the same image name "ntkrnlmp.exe")

I installed MWB this morning after removing BitDefender, just to do a full system sweep to be sure. I didn't have it installed prior to this morning and just have the free version installed.

I have never run a registry cleaner.

Not sure how I can easily find a list of UWP apps?

I will remove the undervolt now and see what happens over the next few hours. Again, it was the last thing I did before all the crashes started to become apparent so I'll start there maybe....

 

[NoddyPirate]

Latest:

Microsoft OneDrive

1drv.ms

 

[Scott]

My guess is it's going to be the OC with a lack of power. I've had this numerous times while trying to tune my Laptop initially. It would run fine through benchmarks & stress testing but for some reason, GTA V was it's nemesis.

I also noted strange behaviours with varying temperature.

My first attempt would be to increase the voltage a little to see if the issue goes away. If it doesn't, it's time to remove the OC and rule that out entirely.

 

[NoddyPirate]

My guess is it's going to be the OC with a lack of power. I've had this numerous times while trying to tune my Laptop initially. It would run fine through benchmarks & stress testing but for some reason, GTA V was it's nemesis.

I also noted strange behaviours with varying temperature.

My first attempt would be to increase the voltage a little to see if the issue goes away. If it doesn't, it's time to remove the OC and rule that out entirely.

Yes agreed @Scott thanks! I've reduced the Undervolt back to what it was first time around.

In many reports I've read the 5600X has been able to handle the maximum undervolt available with the Curve Optimiser in BIOS - so I think I may have pushed my luck a bit by getting greedy recently.

We shall see!

 

[ubuysa]

My guess is it's going to be the OC with a lack of power. I've had this numerous times while trying to tune my Laptop initially. It would run fine through benchmarks & stress testing but for some reason, GTA V was it's nemesis.

I also noted strange behaviours with varying temperature.

My first attempt would be to increase the voltage a little to see if the issue goes away. If it doesn't, it's time to remove the OC and rule that out entirely.

My only concern that it might not be RAM is that all the dumps fail in the exact same way. In addition, and on checking the return addresses of the function calls involved, they're different in each dump. Although these are virtual addresses and could in theory have all been mapped to the same real address, or even the same real address region, I think that's vanishingly unlikely. To me, the only common denominator is the registry and UWP apps. Whatever that means?

You can get a list of the names of the UWP apps installed in your user session by opening an elevated PowerShell session and entering the following command (where username) is your login user name (as it appears in the C:\Users folder):

Get-AppxPackage -User username | Select-Object -Property name

A list of every UWP app installed on the system can be had via the following command:

Get-AppxPackage -AllUsers | Select-Object -Property name

(most of them are apps included with Windows)

Note that if you omit the Select-Object command and you just issue Get-AppxPackage -User username or Get-AppxPackage -AllUsers you'll get all properties for the apps, including where they're installed, any dependencies, and whether they can be uninstalled, etc.

Edit: The kernel dump is identical to all the others. The process is runtimebroker.exe and the stack trace shows a buffer overrrun failure in the nt!CmQueryValueKey function call.

In this dump however there is a failure for MBAM....

ffffee09`8d11efd8  fffff802`49ccdecd Unable to load image \SystemRoot\System32\Drivers\MbamChameleon.sys, Win32 error 0n2
MbamChameleon+0xdecd

...are you sure you're not running the trial of the full premium version? It's unlikely that MBAM is the cause of these issues because you've only just installed it. It's interesting that two security systems have fallen over this issue now? My guess is the issue, whatever it is, is tripping up the security systems - perhaps (I'm just guessing now).

Please uninstall all security products and just use Defender - at least whilst you're troubleshooting.

I still think that removing the overclock and undervolt are essential first steps now.

Later Edit: Just to be on the safe side please open an elevated command prompt or PowerShell session and enter the following commands (in this order)...

dism /online /cleanup-image /scanhealth

If that reports no component store corruptions then move on to the next command.
If that reports component store corruptions that can be corrected then run the command dism /online /cleanup-image /restorehealth and then move on to the next command.
If that reports component store corruptions that could not be corrected then reinstall Windows.

sfc /scannow

If that reports no errors found then all is good.
If that reports errors found but corrected then reboot and seen how things are.
If that reports errors found that could not be corrected then reinstall Windows.

 

[NoddyPirate]

"Get-AppxPackage -AllUsers | Select-Object -Property name" gives me:

Name
----
1527c705-839a-4832-9118-54d4Bd6a0c89
c5e2524a-ea46-4f67-841f-6a9465d9d515
E2A4F912-2574-4A75-9BB0-0D023378592B
F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE
Microsoft.AAD.BrokerPlugin
Microsoft.AccountsControl
Microsoft.AsyncTextService
Microsoft.BioEnrollment
Microsoft.CredDialogHost
Microsoft.ECApp
Microsoft.LockApp
Microsoft.MicrosoftEdgeDevToolsClient
Microsoft.Win32WebViewHost
Microsoft.Windows.Apprep.ChxApp
Microsoft.Windows.CallingShellApp
Microsoft.Windows.CapturePicker
Microsoft.Windows.CloudExperienceHost
Microsoft.Windows.ContentDeliveryManager
Microsoft.Windows.NarratorQuickStart
Microsoft.Windows.OOBENetworkCaptivePortal
Microsoft.Windows.OOBENetworkConnectionFlow
Microsoft.Windows.ParentalControls
Microsoft.Windows.PeopleExperienceHost
Microsoft.Windows.PinningConfirmationDialog
Microsoft.Windows.Search
Microsoft.Windows.SecHealthUI
Microsoft.Windows.ShellExperienceHost
Microsoft.Windows.StartMenuExperienceHost
Microsoft.Windows.XGpuEjectDialog
Microsoft.XboxGameCallableUI
MicrosoftWindows.UndockedDevKit
NcsiUwpApp
Windows.CBSPreview
windows.immersivecontrolpanel
Windows.PrintDialog
Microsoft.MicrosoftOfficeHub
Microsoft.NET.Native.Framework.1.7
Microsoft.NET.Native.Framework.2.2
Microsoft.NET.Native.Runtime.1.7
Microsoft.NET.Native.Runtime.2.2
Microsoft.Services.Store.Engagement
Microsoft.Services.Store.Engagement
Microsoft.UI.Xaml.2.0
Microsoft.Wallet
microsoft.windowscommunicationsapps
Microsoft.Xbox.TCUI
Microsoft.XboxApp
NVIDIACorp.NVIDIAControlPanel
Microsoft.VCLibs.140.00
Microsoft.NET.Native.Framework.2.1
Microsoft.NET.Native.Runtime.2.1
MicrosoftWindows.Client.CBS
AdobeNotificationClient
34791E63.CanonInkjetPrintUtility
Microsoft.VCLibs.140.00
Microsoft.VCLibs.140.00.UWPDesktop
Microsoft.VCLibs.140.00.UWPDesktop
AppleInc.iTunes
Microsoft.NET.Native.Runtime.2.2
Microsoft.NET.Native.Runtime.2.2
Microsoft.UI.Xaml.2.4
Microsoft.UI.Xaml.2.4
Microsoft.NET.Native.Framework.2.2
Microsoft.NET.Native.Framework.2.2
MAXONComputerGmbH.Cinebench
Microsoft.XboxSpeechToTextOverlay
Microsoft.DesktopAppInstaller
Microsoft.UI.Xaml.2.3
Microsoft.UI.Xaml.2.3
Microsoft.MixedReality.Portal
Microsoft.XboxIdentityProvider
Microsoft.SkypeApp
Microsoft.XboxGameOverlay
Microsoft.ScreenSketch
Microsoft.UI.Xaml.2.1
Microsoft.MSPaint
Microsoft.UI.Xaml.2.1
Microsoft.UI.Xaml.2.0
Microsoft.MicrosoftStickyNotes
Microsoft.ZuneMusic
Microsoft.People
Microsoft.Microsoft3DViewer
Microsoft.WebpImageExtension
Microsoft.UI.Xaml.2.5
Microsoft.UI.Xaml.2.5
Microsoft.NET.Native.Runtime.2.1
Microsoft.NET.Native.Framework.2.1
1ED5AEA5.4160926B82DB
Microsoft.Advertising.Xaml
Microsoft.Advertising.Xaml
Microsoft.NET.Native.Framework.1.3
Microsoft.NET.Native.Framework.1.3
Microsoft.WindowsSoundRecorder
Microsoft.NET.Native.Runtime.1.4
Microsoft.NET.Native.Runtime.1.4
Microsoft.WindowsMaps
6918E89D.THECHESSLV.100
Microsoft.WindowsCalculator
4DF9E0F8.Netflix
Microsoft.RawImageExtension
Microsoft.Office.OneNote
Microsoft.ZuneVideo
Microsoft.HEIFImageExtension
Microsoft.WindowsCamera
Microsoft.WindowsAlarms
Microsoft.Windows.Photos
Microsoft.XboxGamingOverlay
Microsoft.VP9VideoExtensions
Microsoft.WindowsFeedbackHub
Microsoft.WebMediaExtensions
Microsoft.WindowsStore
B9ECED6F.ArmouryCrate
B9ECED6F.AURACreator
828B5831.HiddenCityMysteryofShadows
Microsoft.BingWeather
Microsoft.549981C3F5F10
Microsoft.Getstarted
AmazonVideo.PrimeVideo
Microsoft.GetHelp
Microsoft.StorePurchaseApp
Microsoft.MicrosoftEdge
Microsoft.LanguageExperiencePacken-GB
Microsoft.YourPhone
Microsoft.MicrosoftEdge.Stable
Microsoft.MicrosoftSolitaireCollection

 

[NoddyPirate]

Rebooting now......

(EDIT - CBS.log file is here: )

Microsoft OneDrive

1drv.ms

(EDIT SQUARED - Malwarebytes has been uninstalled now also.)