Windows 10 - randomly appearing BSoDs

[IT_WinSec]

You may remove anything AdwCleaner or ESET found - they are nothing too serious, though. Nothing that can cause BSOD.

I also do not see anything bothersome in the Autoruns logs.

There is nothing so far in the logs to point to a specific problem besides this ci.sys file which I cannot see

I guess you haven't experienced a new BSOD because no new memory dump files have been uploaded ?

• Next suggestions - if BSOD happens, upload kernel memory dump file(s)
• Next suggestion ->uninstall Kaspersky and reboot to rule out 3rd party security program issue. Here is how to do it

1. Download and run Revo Uninstaller Portable app to complete more in-depth removal of the program and its left overs. Download the free or portable version from here >> https://www.revouninstaller.com/revo-uninstaller-free-download/
2. Run its setup
3. Start Revo Uninstaller
4. Find Kaspersky product(s) and proceed to remove it

Note - watch this tutorial about using Revo Uninstaller >> https://www.youtube.com/watch?v=vgSJkd11voM

Make sure that at the end of the program uninstallation you also perform ADVANCED scanning and remove any registry and folders leftovers

6. Restart your computer - here are instructions how to do it >> https://www.digitalcitizen.life/7-ways-shut-down-or-restart-windows-10-pc-or-device

Let me know if any updates come up.

[Paolo18]

Dear IT_WinSec,

Many thanks for your efforts. I have just a few last questions for the moment

1. just to see if I understood: should I tell to AdwCleaner to put everything it found in quarantine?
   Even the preinstalled software from HP?
   I'm a dummy and from the names they look like something important to me.
2. Since the 18th of February I haven't experienced any new BSoD. Informally, I have empirical observation of the fact that keeping the Task Manager open in the background seems to prevent BSoDs. I know that it sounds like dummy alchemy, but I was so frustrated by the behaviour of the laptop and so in need to work that every "working solution" is welcome. If new BSoDs should appear, I will share the kernel dump.
3. You are not the first one who suggests me to remove Kaspersky. May I ask why?
   I have Kaspersky since almost 6/7 years on all my Windows machines and it never gave any problem. Moreover, it always did a great job (for what I may understand) and it is considered a good antivirus. Is it so bad that I need a particular external uninstaller to remove it?
   Which other antivirus may I use in exchange?

Many thanks again and hear you soon,

Paolo

[Paolo18]

Dear IT_WinSec,

Unfortunately, five new BSoD in the last few hours.

Here are all the dmp I managed to save

https://drive.google.com/open?id=1k7ckmc_9ogz0nhpBw6fkWUU5g8ewy2gB

Could you have a look if you may understand something more, please?

Many thanks in advance and all the best,

Paolo

[Paolo18]

Sorry, IT_WinSec,

A new BSoD a few moments ago.

I added the dmp file to the folder

https://drive.google.com/open?id=1k7ckmc_9ogz0nhpBw6fkWUU5g8ewy2gB

I hope that more informations we collect, the easier will be to find the solution.

Best,

Paolo

[IT_WinSec]

---

@Paolo18 wrote:

Dear IT_WinSec,

Many thanks for your efforts. I have just a few last questions for the moment

1. just to see if I understood: should I tell to AdwCleaner to put everything it found in quarantine?
   Even the preinstalled software from HP?
   I'm a dummy and from the names they look like something important to me.
2. Since the 18th of February I haven't experienced any new BSoD. Informally, I have empirical observation of the fact that keeping the Task Manager open in the background seems to prevent BSoDs. I know that it sounds like dummy alchemy, but I was so frustrated by the behaviour of the laptop and so in need to work that every "working solution" is welcome. If new BSoDs should appear, I will share the kernel dump.
3. You are not the first one who suggests me to remove Kaspersky. May I ask why?
   I have Kaspersky since almost 6/7 years on all my Windows machines and it never gave any problem. Moreover, it always did a great job (for what I may understand) and it is considered a good antivirus. Is it so bad that I need a particular external uninstaller to remove it?
   Which other antivirus may I use in exchange?

Many thanks again and hear you soon,

Paolo

---

Hi Paolo,

Apologies if I haven't provided enough information.

- In regards to AdwCleaner

All of the items it has detected are considered potentially unwanted software or potentially unwanted modifications. None of them can cause BSOD but these items most people would not want to have. In regards to the HP preinstalled software, if you like it or if you find value in it, you can keep it. These just came out during the "BSOD investigation" - they are not related to the original problem - it's up to you if you want to keep them or remove

- In regards to Kaspersky

Yes, it is very good antivirus, very good security product. It is able to detect and remove many hidden and persistent threats.

I asked you to remove it (at least temporary) because any antivirus program can cause BSOD - they are 3rd party for the Windows OS and because they have very deep access to the operating system. That is the reason - just to test if it may be the cause. I know it may have been working fine, but Kaspersky is very dynamic - you know, it updates several times per day with definitions and other modules. Also, Kaspersky release patches several times per years. Windows 10 is even more dynamic - Microsoft release drivers updates and Windows updates very frequently... so, I am trying to say that things are changing frequently and anything can happen. If it did not cause you issue 6 years ago, does not guarantee it will never cause you issue today.

If you choose to remove Kaspersky, I would recommend you use another removal (Revo) to ensure all leftovers are gone. With no Kaspersky, we can test for another BSOD. In the mean time, you can practise safe computing and use the built-in Windows Defender (at least temporary)

- With regards to the memory dump files, I am downloading them now and will analyze to see if anything pops up there

[IT_WinSec]

Hi again,

I checked the dump files and nothing specific comes up - the usual things - a unknown driver.

Here are the next steps I would suggest:

• Uninstall Kaspersky, reboot and see what happens for a few days
• Use HP Support Assistant to update your drivers (do not update BIOS/UEFI). Here is a short guide >> https://support.hp.com/bg-en/document/c03467905
• Perform CheckDSK and potential repair on your file system (check disk) - to test your file system, not the HDD itself. Read these articles below, use elevated CMD and schedule a scan during reboot. Eventually, reboot the machine (restart it once or twice) and wait for the scan to complete. The scan may take long time - ensure power/battery and patience

https://appuals.com/run-chkdsk-reboot/

https://appuals.com/how-to-run-chkdsk-on-windows-10/

By doing the above, we will rule out 3rd party security software as a root cause, will cause your file system... You have already checked the hardware.  Final step we may discuss later is to perform some repairs of Windows.

[Paolo18]

Dear IT_WinSec,

Many thanks for the detailed explaination.

1. I have completely removed Kaspersky using Revo software.
   I will keep you updated on possible new issues.
2. I had a look at HP support assistant and this is what it offers me
   

   Which one is good and which one should I avoid, in your opinion?

3. Do to the long time it may take the last point, I think I will wait for the weekend before attempting. I will keep you updated.

Many thanks again.

Paolo

Edit: I don't know if this is connected/useful/meaningful or not, but on the event log I have thousands of errors Event 556 (4087 in the last 7 days, one every 2 minutes more or less) and thousands of warnings Event 6105 (11845 in the last 7 days, one every 2 seconds more or less), plus the strange Event 5038. I added pictures in the folder https://drive.google.com/open?id=1k7ckmc_9ogz0nhpBw6fkWUU5g8ewy2gB

[IT_WinSec]

Hi @Paolo18 

You are welcome !

The Event Viewer events you posted about and included pictures for and not related to the BSOD.

With regards to HPSA - it does not offer you driver updates which means your drivers are updated. BIOS update is offered and updates to some HP apps but I would suggest you do not update them (at least not now). These are not related to your BSOD issue.

• So, basically, I am waiting for you to perform scan with check dsk and to report if any new issues came after removing Kaspersky. Looking forward to your reply
• Thank you for your cooperation!

[Paolo18]

Dear IT_WinSec,

Thanks for your answer. I will open a new thread on Windows community to deal with the Event 556, which is continuing generating hundreds of errors per hour.

In the meanwhile, however, I started reading the instruction to perform the chkdsk and I have a couple of questions:

1. is it dangerous for the computer?
   I mean, if I ask windows to search for damaged disk sections or disk errors and automatically repair them, isn't there the risk that some user data are lost/applications or software will not work properly/windows damages itself?
   (the question is not completely sincere, to be honest: my last before the last laptop "died because of something like chkdsk" in the sense that one day Windows performed a check and repair of the HDD and corrupted the "index section", or something similar. It simply failed the reparation part and the laptop became essentially a brick. I know that that time the cause could have been anything else and the check and repair of the disk just the last "symptom" showing up. But I am a bit worried anyway)
2. you asked me to perform the chkdsk once or twice, isn't it?
   Does this mean that I have to re-schedule the chkdsk the second time from the beginning via cmd panel as instructed in https://appuals.com/run-chkdsk-reboot/?
   Or does it mean that once activated the procedure, it will run the chkdsk at every reboot and I have to turn it off somehow?
3. Last but not the least, in the two references you gave me, there are two slightly different procedure suggested. In https://appuals.com/run-chkdsk-reboot/ it is said to simply type "chkdsk /x /f /r", in https://appuals.com/how-to-run-chkdsk-on-windows-10/ it is said that I need to specify the drive letter as well. Should I use the "chkdsk /x /f /r" procedure or should I specify anything?

Many thanks to you for your support and your patience.

Best,

Paolo

[Paolo18]

I'm sorry IT_WinSec,

New BSoD just a moment ago.

I uploaded the dump file here:

https://drive.google.com/open?id=1k7ckmc_9ogz0nhpBw6fkWUU5g8ewy2gB

Could you have a look at it, please?

Best,

Paolo