System Freeze results in DPC_WATCHDOG_VIOLATION

I'm not sure it's important, anyway. It's the first I've seen it and my system seems to have one as well. I think it gets generated during a normal shutdown to probably help diagnose issues that happen during a shutdown.

Looking at the MEMORY.DMP, it would appear all of the other cores were idle:
Code: 
[FONT=Verdana]0: kd> !running[/FONT]
[FONT=Verdana]System Processors:  (00000000000000ff)
  Idle Processors:  (00000000000000fe)[/FONT]
[FONT=Verdana]       Prcbs             Current         (pri) Next            (pri) Idle
  0    fffff8034494b180  ffff9b86639b1700 (12) ffff9b8664be8700 (30) fffff8034566e400  ............….[/FONT]
and core 0 was mostly trying to do GPU related work when the timeout occurred after 2 minutes:
Code: 
[FONT=Verdana]0: kd> !thread
THREAD ffff9b86639b1700  Cid 0004.2b64  Teb: 0000000000000000 Win32Thread: 0000000000000000 RUNNING on processor 0
Not impersonating
DeviceMap                 ffffb30da1c18c30
Owning Process            ffff9b8660715440       Image:         System
Attached Process          N/A            Image:         N/A
Wait Start TickCount      6952457        [COLOR=#ff0000]Ticks: 7680 (0:00:02:00.000)[/COLOR]
Context Switch Count      74907          IdealProcessor: 6  NoStackSwap
[COLOR=#008000]UserTime                  00:00:00.000
KernelTime                00:00:42.328[/COLOR]
Win32 Start Address nt!ExpWorkerThread (0xfffff8034525ad40)
Stack Init ffff83050d0b7c10 Current ffff83050d0b77a0
Base ffff83050d0b8000 Limit ffff83050d0b1000 Call 0000000000000000
Priority 12 BasePriority 12 PriorityDecrement 0 IoPriority 2 PagePriority 5
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffff803`4509b358 fffff803`453ff3cb : 00000000`00000133 00000000`00000001 00000000`00001e00 fffff803`45651378 : nt!KeBugCheckEx
fffff803`4509b360 fffff803`452e438a : 0000b4aa`e3f8426e fffff803`4494b180 00000000`00000282 00000000`00000000 : nt!KeAccumulateTicks+0x1186fb
fffff803`4509b3c0 fffff803`45b5a51b : 0000b4aa`e3f8189a 00000000`00000000 00000000`00000000 fffff803`45bb9bb0 : nt!KeClockInterruptNotify+0x9da
fffff803`4509b6d0 fffff803`45330d85 : fffff803`45bb9bb0 00000000`00000000 00000000`006100bc fffff803`4509bb50 : hal!HalpTimerClockIpiRoutine+0x1b
fffff803`4509b700 fffff803`453aec3a : fffff803`4509b810 fffff803`45bb9bb0 00000000`00000000 ffff9b86`62d96830 : nt!KiCallInterruptServiceRoutine+0xa5
fffff803`4509b740 fffff803`453af127 : 00000000`00000000 ffff9b86`69f3a2f0 00000000`00000000 00000000`00000002 : nt!KiInterruptSubDispatchNoLockNoEtw+0xea (TrapFrame @ fffff803`4509b600)
fffff803`4509b790 fffff807`aa62b409 : fffff807`aa64d4a4 ffff9b86`63afc000 00000000`00000000 00000000`00000000 : nt!KiInterruptDispatchNoLockNoEtw+0x37 (TrapFrame @ fffff803`4509b790)
fffff803`4509b928 fffff807`aa64d4a4 : ffff9b86`63afc000 00000000`00000000 00000000`00000000 ffff9b86`62d96830 : nvlddmkm+0x1cb409
fffff803`4509b930 fffff807`aa64d3b9 : 00000000`00000000 00000000`00009100 ffff9b86`63afc000 ffff9b86`63afc000 : nvlddmkm+0x1ed4a4
fffff803`4509b9a0 fffff807`aa741897 : fffff803`4509ba80 fffff803`4509bb50 ffff9b86`63b30000 00000000`4509bb50 : nvlddmkm+0x1ed3b9
fffff803`4509b9e0 fffff807`aa8bfc02 : ffff9b86`63afc000 fffff803`4509bb50 ffff9b86`63b30000 fffff807`00000017 : nvlddmkm+0x2e1897
fffff803`4509ba20 fffff807`aa6293cc : 00000000`00000000 ffff9b86`63acb970 fffff803`4509bac0 00000000`00010006 : nvlddmkm+0x45fc02
fffff803`4509ba80 fffff807`aa62c41b : ffff9b86`00000000 ffff9b86`63afc000 00000000`00000000 00000000`00010006 : nvlddmkm+0x1c93cc
fffff803`4509bb00 fffff807`aa61a530 : 00000000`00000000 00000000`00000000 ffff9b86`63b08660 ffff9b86`63afc000 : nvlddmkm+0x1cc41b
fffff803`4509bd20 fffff807`aa5a34ef : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nvlddmkm+0x1ba530
fffff803`4509bd50 fffff807`aa5a357b : ffff9b86`634dc000 fffff807`aa5a348e 00000000`00000000 00000000`00000000 : nvlddmkm+0x1434ef
fffff803`4509bde0 fffff807`aa57d285 : ffff9b86`634dc000 00000000`00000000 00000000`00000001 00000000`00000001 : nvlddmkm+0x14357b
fffff803`4509be10 fffff807`aa5c7751 : ffff9b86`634dc000 00000000`00000000 00000000`00000000 00000000`00000000 : nvlddmkm+0x11d285
fffff803`4509be40 fffff807`a825968c : fffff807`aa5c76d3 00000000`00000000 ffff9b86`628625d0 ffff9b86`634fd030 : nvlddmkm+0x167751
fffff803`4509bed0 fffff807`a828b4dc : ffffda1b`96743194 ffff8701`bc8445b0 fffff803`4494b180 fffff803`4494b180 : dxgkrnl!DpiFdoMessageInterruptRoutine+0x4c
fffff803`4509bf00 fffff803`45330d85 : ffff8701`bc844780 ffff9b86`63926260 0000b4aa`e2f4104c 00000000`00000000 : dxgkrnl!DpiFdoLineInterruptRoutine+0xc
fffff803`4509bf30 fffff803`453ae83c : ffff8305`0d0b6bc0 ffff8701`bc844780 ffff8701`bc844500 ffff9b86`62d96830 : nt!KiCallInterruptServiceRoutine+0xa5
fffff803`4509bf70 fffff803`453ae4e7 : fffff803`4494b180 ffff8701`bc844780 00000000`0000000e 00000000`00000005 : nt!KiScanInterruptObjectList+0x13c (TrapFrame @ fffff803`4509be70)
ffff8305`0d0b6b40 fffff803`453b40d8 : ffff8701`bc844780 fffff803`45b5a4e6 ffff8305`0d0b6f20 fffff803`453b409f : nt!KiChainedDispatch+0x37 (TrapFrame @ ffff8305`0d0b6b40)
ffff8305`0d0b6cd0 fffff803`453b3a05 : 00000000`0010a1c0 fffff803`453ae561 ffff9b86`63afc000 ffff8701`bc844780 : nt!KiDispatchInterruptContinue+0x8
ffff8305`0d0b6d00 fffff803`453ae561 : ffff9b86`63afc000 ffff8701`bc844780 00000000`00000000 00000000`00000000 : nt!KiDpcInterruptBypass+0x25
ffff8305`0d0b6d10 fffff807`aa64d486 : ffff9b86`63afc000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiChainedDispatch+0xb1 (TrapFrame @ ffff8305`0d0b6d10)
ffff8305`0d0b6ea0 fffff807`aa64d3b9 : 00000000`00000000 00000000`0010a1c0 ffff9b86`63afc000 fffff807`aa8473e0 : nvlddmkm+0x1ed486
ffff8305`0d0b6f10 fffff807`aa847409 : 00000000`00000000 00000000`00000000 ffff9b86`63afc000 00000000`00000000 : nvlddmkm+0x1ed3b9
ffff8305`0d0b6f50 fffff807`aa874286 : 00000000`00000000 00000000`00000000 ffff8305`0d0b755c ffff9b86`63baba10 : nvlddmkm+0x3e7409
ffff8305`0d0b6f90 fffff807`aa873ef4 : 00000000`00000000 00000000`00000000 ffff8305`0d0b755c ffff9b86`63baba10 : nvlddmkm+0x414286
ffff8305`0d0b6fc0 fffff807`aa98c203 : ffff9b86`63afc000 ffff9b86`63ba4ee8 ffff9b86`63baba01 ffff8305`0d0b7480 : nvlddmkm+0x413ef4
ffff8305`0d0b7040 fffff807`aaa346a2 : ffff9b86`63baba10 00000000`00000000 ffff9b86`63bab938 fffff807`aab27572 : nvlddmkm+0x52c203
ffff8305`0d0b7090 fffff807`aaa35765 : ffff9b86`63ba2000 ffff9b86`63afc000 ffff9b86`44010c0e ffff9b86`63ba2000 : nvlddmkm+0x5d46a2
ffff8305`0d0b7120 fffff807`aa7c1641 : 000062cc`e4273468 00000000`00000000 ffff9b86`63afc000 00000000`00000040 : nvlddmkm+0x5d5765
ffff8305`0d0b71d0 fffff807`aaa37566 : ffff9b86`00000070 ffff9b86`63afc000 00000000`00000001 ffff9b86`63ba2000 : nvlddmkm+0x361641
ffff8305`0d0b7230 fffff807`aaa36413 : ffff9b86`63ba2000 ffff9b86`63b30000 ffff9b86`63ba2000 00000000`00000000 : nvlddmkm+0x5d7566
ffff8305`0d0b7290 fffff807`aaa38908 : 00000000`00000000 ffff8305`00028043 ffff8305`0d0b73f1 00000000`00005ab8 : nvlddmkm+0x5d6413
ffff8305`0d0b7300 fffff807`aa9c2d42 : 00000000`00088154 ffff9b86`63badf00 ffff9b86`63afcdf8 fffff807`aa63a844 : nvlddmkm+0x5d8908
ffff8305`0d0b7440 fffff807`aaa208f5 : 00000000`00000000 fffff807`aa7a3fd0 00000002`63b2c001 ffff9b86`00000000 : nvlddmkm+0x562d42[/FONT]
and yet that thread had done work for around 42 seconds (as highlighted in green). It was doing work on occasion but the system was stuck at DPC level for 2 minutes. I think this is basically why we need a trace. We need to see what the system was doing for 2 minutes or so before the timeout. The GPU function calls could simply be what it was up to when the timeout occurred and doesn't necessarily mean the GPU was the culprit.

The DPC list suggests there was GPU, network, audio, and nvme drive I/O pending in the DPC queue so perhaps we should focus on those. It does look like there might be a newer driver available for your network adapter from Intel. You current driver is e1i63x64.sys and has a 2016 timestamp. If you haven't already done so, I'd recommend downloading the appropriate driver from here and running the installer to see if a newer driver is installed.

I'm fairly confident there is a newer driver available for your Realtek audio components but getting and installing the driver is a little involved. The one I'm using is available from the Microsoft Update Catalog and this video gives general directions on how to get it and install it. The latest I was able to find is here with a version number of 6.0.1.8541 (139.7MB).

Please try updating those drivers, reboot the system, and then test to see if the problems continue.
 
Last edited:
Thanks again! I'll update those drivers. It seems a little strange to me that MS holds a newer version and doesn't upgrade it via Windows Update since I didn't disable Windows' automatic driver update feature.

However, your observations match the symptoms the system shows: you can't interact with it for a minute or so and then the watchdog steps in :D
One question: I'm running the SSD with stock MS NVMe drivers, not with the Samsung ones. Should I install them, too?
 
I'd just stick with the stock storage drivers for now. The MS provided drivers may not be the most efficient but they are usually very solid.
 
Hey there,

the system just froze and crashed again. Seems like the drivers we updated yesterday did not cause it.
I attached the new mini dump - if you need another full dump, I'll gladly upload it :r1:


Edit: This time, the DPC list is a little bit shorter:
Code: 
0: kd> !dpcs
CPU Type      KDPC       Function
 0: Normal  : 0xffffbb062b8ed0e0 0xfffff8049290dd8c nvlddmkm
 0: Normal  : 0xfffff802a49ae800 0xfffff802a47205c0 nt!PpmCheckPeriodicStart
 0: Normal  : 0xfffff802a3d6f568 0xfffff802a46a4a50 nt!KiEntropyDpcRoutine
 0: Normal  : 0xfffff802a49ba900 0xfffff802a46a18b0 nt!KiBalanceSetManagerDeferredRoutine
 0: Normal  : 0xffffbb06295a48f0 0xfffff8048dbf1f10 Wdf01000!FxInterrupt::_InterruptDpcThunk
 0: Normal  : 0xffffbb062bad3b38 0xfffff8048e713d80 ndis!ndisInterruptDpc
 

Attachments

Please run the Sysnative collection app again and make the new zip available for download. Did you already try extracting an etl file from the new MEMORY.DMP?
 
It does look like the audio and network drivers were updated. I'd probably next try the Samsung NVMe drivers if they are newer than the MS drivers.
Have you used Samsung Magician to check for firmware updates for your 960?​

It looks like that ETL file has a time inversion problem as well. Unfortunately, I don't know German (at least I think it's German) so the logs aren't likely to be much use for me. People are usually asked to switch to English and run the collector app, if possible, so analysts can use scripts to more easily check the logs. Do you see anything in the logs about the system having trouble reading from a harddisk?

I did notice that all of the dumps you've made available show the system having gone through at least one sleep/wake transition and the shortest system uptime was 8 hours 22 minutes. Do you recall if you've had a 0x133 bugcheck without the system having gone through a sleep/wake cycle previously? If not, a possible workaround could be to prevent the system from going to sleep and turning off Fast startup so the system does an actual full shutdown when shutdown through the menu or physical power button.
 
Hi cwsink,

that's a lot of questions, I'll go through them one by one. Thanks again!
Have you used Samsung Magician to check for firmware updates for your 960?
Click to expand...
Yes, it is the newest firmware available (3B7QCXE7). I'm going to install the NVMe drivers right after finishing this post.
Unfortunately, I don't know German (at least I think it's German) so the logs aren't likely to be much use for me. People are usually asked to switch to English and run the collector app, if possible, so analysts can use scripts to more easily check the logs.
Click to expand...
You're right, it is German. I'm sorry, I wasn't aware of the issue that Windows does this. I've switched my UI language to English and created a new collection. Unfortunately, now it is a weird mixture of German and English so I doubt this is more useful to you than the previous one. I attached it anyway because it contains a new Minidump. Maybe I could change the language Windows uses deep-down by repair-installing Windows with an English image, I just don't now whether it's worth it :roll eyes (sarcasti
Do you see anything in the logs about the system having trouble reading from a harddisk?
Click to expand...
Looking through the logs I noticed that the collection app seems to have difficulties with umlauts, so they aren't even well-readable if you speak German :D Could you give me a hint in which log files I should search for HD issues?
Do you recall if you've had a 0x133 bugcheck without the system having gone through a sleep/wake cycle previously?
Click to expand...
I had that suspicion a while ago, so I disabled fast startup, but the issues persisted. Anyway, as luck would have it, the PC crashed while I was writing this, so now I can offer you a dump where no hibernation or sleep cycle has taken place.
 

Attachments

For example, there's an entry in EvtxSysDump.txt which includes:

Bei einem Auslagerungsvorgang wurde ein Fehler festgestellt. Betroffen ist Gerät \Device\Harddisk4\DR7.
Click to expand...

which seems like it might be suggesting a problem was encountered but it's not clear to me with the translation service I'm using. The service produced the word "outsource" which is not a word I recall seeing in an event log entry before and an alternative word is not obvious to me. I usually search for "harddisk" and see if those entries suggest errors. Another is "block" which is a word that appears if the system has come across a sector it couldn't read.

I've never seen anyone be asked to perform a repair install after setting the system to use English. I wouldn't think it necessary.

I'll have a look at the new dump and logs. Thank you.
 
The Bing translator shows this:
A paging operation encountered an error. Affected Device DeviceHarddisk4DR7.
Click to expand...

as the result. That would suggest to me a drive containing a pagefile the system is using might be having issues. I only see such entries on 29 September, though. Can you see if there are other harddisk related errors which suggest trouble with drive I/O?
 
The translation is solid :D
I'm searching the logs, I'll post in a few minutes if I found something. The thing that baffles me is: I only have HardDisk0 - HardDisk3 in my system (HD3 is the boot SSD) - maybe I had a thumbdrive attached when it crashed yesterday, but paging on a thumbdrive makes no sense to me...
 
So, I searched all files for "HardDisk", "Block" and "Datenträger" (~disk) but only found the lines you mentioned. Four lines from 29 September, all mentioning a paging error on HardDisk 4.
 
The Components -> Storage -> Drives node in the MSInfo32.nfo file suggests you have 4 fixed hard disks. Is that not accurate? I'm not aware of straightforward links between the event viewer moniker for a disk and how it shows up in the various drive management tools in Windows. I'd probably check the Virtual Memory dialog of the System Properties -> Performance Options -> Advanced tab to see which drive and volumes have pagefiles enabled. Mine looks like this, for example. Does that help identify what drive the event log might be referring to?
 
4 Disks is correct - but that's Harddisk0, Harddisk1, Harddisk2 and Harddisk 3 (found with Sysinternals WinObj) which corresponds to the enumeration DiskUtil uses.
The only disk that has pagefiles enabled is C: (which should be \Device\Harddisk3\Partition4)
 
Thank you for the reminder about WinObj. I don't use it very often so it doesn't come readily to mind. I'm not sure why that disk would show up as a drive with a pagefile. Perhaps it's a flash drive enabled for ReadyBoost?

It looks like you've had this problem regardless of whether or not the TV tuner is installed, correct?

Have you tried uninstalling the GPU drivers using DDU in safe mode, rebooting, and then installing the latest driver from Nvidia?

It might be worth checking the latest MEMORY.DMP file for system events that didn't make it to the event log when the system crashed. The WinDbg command would likely be:
Code: 
[LEFT][COLOR=#000000][FONT=inherit]!wmitrace.eventlogdump 0x0a[/FONT][/COLOR][/LEFT]
on your system. That worked when I tried it on the MEMORY.DMP you made available earlier. It suggests the Ethernet card might have been getting reset or reconfigured for some reason at the time of the crash as well as a message about "MMDevAPI: Audio device state changed".
Code: 
0: kd> !wmitrace.eventlogdump 0x0a
WMI Trace Save: Debugger Extension. LoggerId = 10, Save File = 'C:\Users\\AppData\Local\Temp\wmiC7FE.tmp'
    Logger Id 0x0a @ 0xFFFF9B8660C12AC0 Named 'EventLog-System'
      CollectionOn        = 1
      LoggerMode          = 0x10800180 ( secure rt single-str )
      HybridShutdown      = persist
      BufferSize          = 64 KB
      BuffersAvailable    = 2
      MinimumBuffers      = 2
      NumberOfBuffers     = 2
      MaximumBuffers      = 16
      EventsLost          = 0
      LogBuffersLost      = 0
      RealTimeBuffersLost = 0
      LastFlushedBuffer   = 0
      MaximumFileSize     = 100
      FlushTimer          = 1 sec
      LoggerThread        = 0xffff9b8660c11040 (555 context switches)
      PoolType            = NonPaged
      SequenceNumber      = 546
      ClockType           = SystemTime
      EventsLogged        = -1
      Consumer @ 0xffff9b8665285900

      Buffer      Address           Cpu RefCnt State
      ===========================================================================================
      Buffer   1: ffff9b8660c42000 ,  0:   0    Free List          , Offset:      328 ,   0% Used
      Buffer   2: ffff9b8660c52000 ,  0:   0    Free List          , Offset:      360 ,   0% Used
Saved 2 Buffers
Querying C:\Users\\AppData\Local\Temp\wmiC7FE.tmp for all events... 
Event 0 : 
============

 <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
  <System>
   <Provider Name='' Guid='{68fdd900-4a3e-11d1-84f4-0000f80464e3}'/>
   <EventID>     0   </EventID>
   <Version>     2   </Version>
   <Level>     0   </Level>
   <Task>     0   </Task>
   <Opcode>     0   </Opcode>
   <Keywords>     0x0   </Keywords>
   <TimeCreated SystemTime='2018-09-28T07:43:28.895741300Z'/>
   <EventRecordID>     0   </EventRecordID>
   <Correlation/>
   <Execution ProcessID='0' ThreadID='0' ProcessorID='0' KernelTime='0' UserTime='0'/>
   <Channel>   </Channel>
   <Computer>     DESKTOP-SR8ASUL   </Computer>
   <Security/>
  </System>
  <ProcessingErrorData>
   <ErrorCode>     15003   </ErrorCode>
   <DataItemName>   </DataItemName>
   <EventPayload>     000001000A000200EE4200000100000000000000000000005A620200000000000100001000000000010000000800000000000000500D0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000AB5C26F2FE56D4018096980000000000E37769F2FE56D40102000000000000004500760065006E0074004C006F0067002D00530079007300740065006D0000004500760065006E0074004C006F0067002D00530079007300740065006D002E00650074006C000000   </EventPayload>
  </ProcessingErrorData>
 </Event>   

TimeCreated SystemTime='2018-09-28T07:43:28.895741300Z'
Publisher name: 
Failed to get event format size. Error = 3AB3
Event 1 : 
============

 <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
  <System>
   <Provider Name='' Guid='{68fdd900-4a3e-11d1-84f4-0000f80464e3}'/>
   <EventID>     0   </EventID>
   <Version>     2   </Version>
   <Level>     0   </Level>
   <Task>     0   </Task>
   <Opcode>     66   </Opcode>
   <Keywords>     0x0   </Keywords>
   <TimeCreated SystemTime='2018-09-28T07:43:28.895741400Z'/>
   <EventRecordID>     1   </EventRecordID>
   <Correlation/>
   <Execution ProcessID='4294967295' ThreadID='4294967295' ProcessorID='0' KernelTime='0' UserTime='0'/>
   <Channel>   </Channel>
   <Computer>     DESKTOP-SR8ASUL   </Computer>
   <Security/>
  </System>
  <ProcessingErrorData>
   <ErrorCode>     15003   </ErrorCode>
   <DataItemName>   </DataItemName>
   <EventPayload>     31373133342E312E616D6436346672652E7273345F72656C656173652E3138303431302D3138303400   </EventPayload>
  </ProcessingErrorData>
 </Event>   

TimeCreated SystemTime='2018-09-28T07:43:28.895741400Z'
Publisher name: 
Failed to get event format size. Error = 3AB3
Event 2 : 
============

 <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
  <System>
   <Provider Name='' Guid='{68fdd900-4a3e-11d1-84f4-0000f80464e3}'/>
   <EventID>     0   </EventID>
   <Version>     2   </Version>
   <Level>     0   </Level>
   <Task>     0   </Task>
   <Opcode>     66   </Opcode>
   <Keywords>     0x0   </Keywords>
   <TimeCreated SystemTime='2018-09-28T07:43:28.895741400Z'/>
   <EventRecordID>     2   </EventRecordID>
   <Correlation/>
   <Execution ProcessID='4294967295' ThreadID='4294967295' ProcessorID='0' KernelTime='0' UserTime='0'/>
   <Channel>   </Channel>
   <Computer>     DESKTOP-SR8ASUL   </Computer>
   <Security/>
  </System>
  <ProcessingErrorData>
   <ErrorCode>     15003   </ErrorCode>
   <DataItemName>   </DataItemName>
   <EventPayload>     31373133342E312E616D6436346672652E7273345F72656C656173652E3138303431302D3138303400   </EventPayload>
  </ProcessingErrorData>
 </Event>   

TimeCreated SystemTime='2018-09-28T07:43:28.895741400Z'
Publisher name: 
Failed to get event format size. Error = 3AB3
Event 3 : 
============

 <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
  <System>
   <Provider Name='Microsoft-Windows-SMBClient' Guid='{988c59c5-0a1c-45b6-a555-0c62276e327d}'/>
   <EventID>     30810   </EventID>
   <Version>     0   </Version>
   <Level>     4   </Level>
   <Task>     0   </Task>
   <Opcode>     0   </Opcode>
   <Keywords>     0x400000000000040   </Keywords>
   <TimeCreated SystemTime='2018-09-29T13:54:21.524929000Z'/>
   <EventRecordID>     3   </EventRecordID>
   <Correlation/>
   <Execution ProcessID='4' ThreadID='14396' ProcessorID='0' KernelTime='0' UserTime='0'/>
   <Channel>   </Channel>
   <Computer>     DESKTOP-SR8ASUL   </Computer>
   <Security UserID='S-1-5-18'/>
  </System>
  <EventData>
   <Data Name='NameLength'>     8   </Data>
   <Data Name='Name'>     Ethernet   </Data>
   <Data Name='IfIndex'>     9   </Data>
  </EventData>
 </Event>   

TimeCreated SystemTime='2018-09-29T13:54:21.524929000Z'
Publisher name: Microsoft-Windows-SMBClient
Event message:
Added a TCP/IP transport interface.

Name: Ethernet
InterfaceIndex: 0x9

Guidance:
A TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.

==========
Event 4 : 
============

 <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
  <System>
   <Provider Name='Microsoft-Windows-SMBClient' Guid='{988c59c5-0a1c-45b6-a555-0c62276e327d}'/>
   <EventID>     30810   </EventID>
   <Version>     0   </Version>
   <Level>     4   </Level>
   <Task>     0   </Task>
   <Opcode>     0   </Opcode>
   <Keywords>     0x400000000000040   </Keywords>
   <TimeCreated SystemTime='2018-09-29T13:54:21.531624400Z'/>
   <EventRecordID>     4   </EventRecordID>
   <Correlation/>
   <Execution ProcessID='4' ThreadID='14396' ProcessorID='0' KernelTime='0' UserTime='0'/>
   <Channel>   </Channel>
   <Computer>     DESKTOP-SR8ASUL   </Computer>
   <Security UserID='S-1-5-18'/>
  </System>
  <EventData>
   <Data Name='NameLength'>     8   </Data>
   <Data Name='Name'>     Ethernet   </Data>
   <Data Name='IfIndex'>     9   </Data>
  </EventData>
 </Event>   

TimeCreated SystemTime='2018-09-29T13:54:21.531624400Z'
Publisher name: Microsoft-Windows-SMBClient
Event message:
Added a TCP/IP transport interface.

Name: Ethernet
InterfaceIndex: 0x9

Guidance:
A TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.

==========
Event 5 : 
============

 <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
  <System>
   <Provider Name='Microsoft-Windows-Audio' Guid='{ae4bd3be-f36f-45b6-8d21-bdd6fb832853}'/>
   <EventID>     65   </EventID>
   <Version>     0   </Version>
   <Level>     4   </Level>
   <Task>     129   </Task>
   <Opcode>     56   </Opcode>
   <Keywords>     0x4000000000000000   </Keywords>
   <TimeCreated SystemTime='2018-09-29T13:54:36.359650500Z'/>
   <EventRecordID>     5   </EventRecordID>
   <Correlation/>
   <Execution ProcessID='2460' ThreadID='2348' ProcessorID='0' KernelTime='83' UserTime='27'/>
   <Channel>   </Channel>
   <Computer>     DESKTOP-SR8ASUL   </Computer>
   <Security UserID='S-1-5-18'/>
  </System>
  <EventData>
   <Data Name='DeviceName'>     Realtek High Definition Audio   </Data>
   <Data Name='DeviceId'>     {0.0.0.00000000}.{36415dc0-053a-4086-8995-a2121d119cdc}   </Data>
   <Data Name='flow'>     0   </Data>
   <Data Name='NewState'>     8   </Data>
  </EventData>
 </Event>   

TimeCreated SystemTime='2018-09-29T13:54:36.359650500Z'
Publisher name: Microsoft-Windows-Audio
Event message:
MMDevAPI: Audio device state changed

==========
Success all items processed!

Do you see anything of interest in the output of your more recent MEMORY.DMP?
 
Last edited:
ReadyBoost would make sense indeed, but I never used it.
You're right about removing the TV tuner card; I tested that as one of my first attempts, but the system kept crashing. Moreover, the TV card was plugged in when I had the GPU removed - no crashes in three weeks.
When I tested older driver versions, I DDU-uninstalled the old graphics drivers before.

Alright, this is what I got from today's first crash dump:
Code: 
0: kd> !wmitrace.eventlogdump 0x0a
WMI Trace Save: Debugger Extension. LoggerId = 10, Save File = 'C:\Users\Keno\AppData\Local\Temp\wmi826D.tmp'
    Logger Id 0x0a @ 0xFFFFBB0629054040 Named 'EventLog-System'
      CollectionOn        = 1
      LoggerMode          = 0x10800180 ( secure rt single-str )
      HybridShutdown      = persist
      BufferSize          = 64 KB
      BuffersAvailable    = 2
      MinimumBuffers      = 2
      NumberOfBuffers     = 2
      MaximumBuffers      = 16
      EventsLost          = 0
      LogBuffersLost      = 0
      RealTimeBuffersLost = 0
      LastFlushedBuffer   = 0
      MaximumFileSize     = 100
      FlushTimer          = 1 sec
      LoggerThread        = 0xffffbb0629054700 (179 context switches)
      PoolType            = NonPaged
      SequenceNumber      = 170
      ClockType           = SystemTime
      EventsLogged        = -1
      Consumer @ 0xffffbb062d7c5ce0

      Buffer      Address           Cpu RefCnt State
      ===========================================================================================
      Buffer   1: ffffbb0629089000 ,  0:   0    Free List          , Offset:      592 ,   0% Used
      Buffer   2: ffffbb0629099000 ,  0:   0    Free List          , Offset:      400 ,   0% Used
Saved 2 Buffers
Querying C:\Users\Keno\AppData\Local\Temp\wmi826D.tmp for all events... 
Event 0 : 
============

 <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
  <System>
   <Provider Name='' Guid='{68fdd900-4a3e-11d1-84f4-0000f80464e3}'/>
   <EventID>     0   </EventID>
   <Version>     2   </Version>
   <Level>     0   </Level>
   <Task>     0   </Task>
   <Opcode>     0   </Opcode>
   <Keywords>     0x0   </Keywords>
   <TimeCreated SystemTime='2018-09-29T19:48:08.895452000Z'/>
   <EventRecordID>     0   </EventRecordID>
   <Correlation/>
   <Execution ProcessID='0' ThreadID='0' ProcessorID='0' KernelTime='0' UserTime='0'/>
   <Channel>   </Channel>
   <Computer>     Keno-PC   </Computer>
   <Security/>
  </System>
  <ProcessingErrorData>
   <ErrorCode>     15003   </ErrorCode>
   <DataItemName>   </DataItemName>
   <EventPayload>     000001000A000200EE4200000100000000000000000000005A620200000000000100001000000000010000000800000000000000500D00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000993A9582D58D40180969800000000001120ED582D58D40102000000000000004500760065006E0074004C006F0067002D00530079007300740065006D0000004500760065006E0074004C006F0067002D00530079007300740065006D002E00650074006C000000   </EventPayload>
  </ProcessingErrorData>
 </Event>   

TimeCreated SystemTime='2018-09-29T19:48:08.895452000Z'
Publisher name: 
Failed to get event format size. Error = 3AB3
Event 1 : 
============

 <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
  <System>
   <Provider Name='' Guid='{68fdd900-4a3e-11d1-84f4-0000f80464e3}'/>
   <EventID>     0   </EventID>
   <Version>     2   </Version>
   <Level>     0   </Level>
   <Task>     0   </Task>
   <Opcode>     66   </Opcode>
   <Keywords>     0x0   </Keywords>
   <TimeCreated SystemTime='2018-09-29T19:48:08.895452100Z'/>
   <EventRecordID>     1   </EventRecordID>
   <Correlation/>
   <Execution ProcessID='4294967295' ThreadID='4294967295' ProcessorID='0' KernelTime='0' UserTime='0'/>
   <Channel>   </Channel>
   <Computer>     Keno-PC   </Computer>
   <Security/>
  </System>
  <ProcessingErrorData>
   <ErrorCode>     15003   </ErrorCode>
   <DataItemName>   </DataItemName>
   <EventPayload>     31373133342E312E616D6436346672652E7273345F72656C656173652E3138303431302D3138303400   </EventPayload>
  </ProcessingErrorData>
 </Event>   

TimeCreated SystemTime='2018-09-29T19:48:08.895452100Z'
Publisher name: 
Failed to get event format size. Error = 3AB3
Event 2 : 
============

 <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
  <System>
   <Provider Name='' Guid='{68fdd900-4a3e-11d1-84f4-0000f80464e3}'/>
   <EventID>     0   </EventID>
   <Version>     2   </Version>
   <Level>     0   </Level>
   <Task>     0   </Task>
   <Opcode>     66   </Opcode>
   <Keywords>     0x0   </Keywords>
   <TimeCreated SystemTime='2018-09-29T19:48:08.895452100Z'/>
   <EventRecordID>     2   </EventRecordID>
   <Correlation/>
   <Execution ProcessID='4294967295' ThreadID='4294967295' ProcessorID='0' KernelTime='0' UserTime='0'/>
   <Channel>   </Channel>
   <Computer>     Keno-PC   </Computer>
   <Security/>
  </System>
  <ProcessingErrorData>
   <ErrorCode>     15003   </ErrorCode>
   <DataItemName>   </DataItemName>
   <EventPayload>     31373133342E312E616D6436346672652E7273345F72656C656173652E3138303431302D3138303400   </EventPayload>
  </ProcessingErrorData>
 </Event>   

TimeCreated SystemTime='2018-09-29T19:48:08.895452100Z'
Publisher name: 
Failed to get event format size. Error = 3AB3
Event 3 : 
============

 <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
  <System>
   <Provider Name='Service Control Manager'/>
   <EventID Qualifiers='16384'>     7045   </EventID>
   <Level>     4   </Level>
   <Task>     0   </Task>
   <Keywords>     0x8080000000000000   </Keywords>
   <TimeCreated SystemTime='2018-09-30T09:34:34.862054400Z'/>
   <EventRecordID>     3   </EventRecordID>
   <Channel>   </Channel>
   <Computer>     Keno-PC   </Computer>
   <Security UserID='00001A000000120000000000'/>
  </System>
  <EventData>
   <Data>     MpKsl3f83dbe8   </Data>
   <Data>     C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{53FAB0A8-7891-4329-A497-67F3FD6AED0C}\MpKsl3f83dbe8.sys   </Data>
   <Data>     Kernelmodustreiber   </Data>
   <Data>     Systemstart   </Data>
   <Data>   </Data>
  </EventData>
 </Event>   

TimeCreated SystemTime='2018-09-30T09:34:34.862054400Z'
Publisher name: Service Control Manager
Event message:
Im System wurde ein Dienst installiert.

Dienstname:  MpKsl3f83dbe8
Dienstdateiname:  C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{53FAB0A8-7891-4329-A497-67F3FD6AED0C}\MpKsl3f83dbe8.sys
Diensttyp:  Kernelmodustreiber
Dienststarttyp:  Systemstart
Dienstkonto:  

==========
Event 4 : 
============

 <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
  <System>
   <Provider Name='Microsoft-Windows-Windows Defender' Guid='{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}'/>
   <EventID>     1001   </EventID>
   <Version>     0   </Version>
   <Level>     4   </Level>
   <Task>     0   </Task>
   <Opcode>     0   </Opcode>
   <Keywords>     0x8000000000000000   </Keywords>
   <TimeCreated SystemTime='2018-09-30T09:37:11.713470300Z'/>
   <EventRecordID>     4   </EventRecordID>
   <Correlation ActivityID='{4E431D95-A3A9-4A2A-ACFF-86ECBDE70914}'/>
   <Execution ProcessID='5496' ThreadID='6592' ProcessorID='0' KernelTime='2712' UserTime='6769'/>
   <Channel>   </Channel>
   <Computer>     Keno-PC   </Computer>
   <Security UserID='S-1-5-18'/>
  </System>
  <EventData>
   <Data Name='Product Name'>     %%827   </Data>
   <Data Name='Product Version'>     4.18.1809.2   </Data>
   <Data Name='Scan ID'>     {08D50398-8F31-46D8-863D-8A4075496F70}   </Data>
   <Data Name='Scan Type Index'>     1   </Data>
   <Data Name='Scan Type'>     %%802   </Data>
   <Data Name='Scan Parameters Index'>     1   </Data>
   <Data Name='Scan Parameters'>     %%806   </Data>
   <Data Name='Domain'>     NT-AUTORITÄT   </Data>
   <Data Name='User'>     SYSTEM   </Data>
   <Data Name='SID'>     S-1-5-18   </Data>
   <Data Name='Scan Time Hours'>     0   </Data>
   <Data Name='Scan Time Minutes'>     05   </Data>
   <Data Name='Scan Time Seconds'>     05   </Data>
  </EventData>
 </Event>   

TimeCreated SystemTime='2018-09-30T09:37:11.713470300Z'
Publisher name: Microsoft-Windows-Windows Defender
Event message:
Die Windows Defender Antivirus-Überprüfung wurde fertig gestellt.
     Überprüfungs-ID: {08D50398-8F31-46D8-863D-8A4075496F70}
     Überprüfungstyp: Antimalware
     Überprüfungsparameter: Schnellüberprüfung
     Benutzer: NT-AUTORITÄT\SYSTEM
     Überprüfungszeit: 0:05:05

==========
Success all items processed!
This doesn't look too interesting, more like usual Windows Defender stuff:
Event 3 says "a new system service was installed" (looks like a definition update)
Event 4 says "a quick scan was completed successfully"


But this is what I got from the second crash dump (the one with no sleep cycles):
Code: 
0: kd> !wmitrace.eventlogdump 0x0a
WMI Trace Save: Debugger Extension. LoggerId = 10, Save File = 'C:\Users\Keno\AppData\Local\Temp\wmi985E.tmp'
    Logger Id 0x0a @ 0xFFFF810342814040 Named 'EventLog-System'
      CollectionOn        = 1
      LoggerMode          = 0x10800180 ( secure rt single-str )
      HybridShutdown      = persist
      BufferSize          = 64 KB
      BuffersAvailable    = 2
      MinimumBuffers      = 2
      NumberOfBuffers     = 2
      MaximumBuffers      = 16
      EventsLost          = 0
      LogBuffersLost      = 0
      RealTimeBuffersLost = 0
      LastFlushedBuffer   = 0
      MaximumFileSize     = 100
      FlushTimer          = 1 sec
      LoggerThread        = 0xffff810342814700 (154 context switches)
      PoolType            = NonPaged
      SequenceNumber      = 152
      ClockType           = SystemTime
      EventsLogged        = -1
      Consumer @ 0xffff810346e83f60

      Buffer      Address           Cpu RefCnt State
      ===========================================================================================
      Buffer   1: ffff810342842000 ,  0:   0    Free List          , Offset:     1048 ,   1% Used
      Buffer   2: ffff810342d85000 ,  0:   0    Free List          , Offset:      656 ,   1% Used
Saved 2 Buffers
Querying C:\Users\Keno\AppData\Local\Temp\wmi985E.tmp for all events... 
Event 0 : 
============

 <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
  <System>
   <Provider Name='' Guid='{68fdd900-4a3e-11d1-84f4-0000f80464e3}'/>
   <EventID>     0   </EventID>
   <Version>     2   </Version>
   <Level>     0   </Level>
   <Task>     0   </Task>
   <Opcode>     0   </Opcode>
   <Keywords>     0x0   </Keywords>
   <TimeCreated SystemTime='2018-09-30T16:05:35.754899500Z'/>
   <EventRecordID>     0   </EventRecordID>
   <Correlation/>
   <Execution ProcessID='0' ThreadID='0' ProcessorID='0' KernelTime='0' UserTime='0'/>
   <Channel>   </Channel>
   <Computer>     Keno-PC   </Computer>
   <Security/>
  </System>
  <ProcessingErrorData>
   <ErrorCode>     15003   </ErrorCode>
   <DataItemName>   </DataItemName>
   <EventPayload>     000001000A000200EE4200000100000000000000000000005A620200000000000100001000000000010000000800000000000000500D00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000F3A116CD758D401809698000000000039CC3D6CD758D40102000000000000004500760065006E0074004C006F0067002D00530079007300740065006D0000004500760065006E0074004C006F0067002D00530079007300740065006D002E00650074006C000000   </EventPayload>
  </ProcessingErrorData>
 </Event>   

TimeCreated SystemTime='2018-09-30T16:05:35.754899500Z'
Publisher name: 
Failed to get event format size. Error = 3AB3
Event 1 : 
============

 <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
  <System>
   <Provider Name='' Guid='{68fdd900-4a3e-11d1-84f4-0000f80464e3}'/>
   <EventID>     0   </EventID>
   <Version>     2   </Version>
   <Level>     0   </Level>
   <Task>     0   </Task>
   <Opcode>     66   </Opcode>
   <Keywords>     0x0   </Keywords>
   <TimeCreated SystemTime='2018-09-30T16:05:35.754899600Z'/>
   <EventRecordID>     1   </EventRecordID>
   <Correlation/>
   <Execution ProcessID='4294967295' ThreadID='4294967295' ProcessorID='0' KernelTime='0' UserTime='0'/>
   <Channel>   </Channel>
   <Computer>     Keno-PC   </Computer>
   <Security/>
  </System>
  <ProcessingErrorData>
   <ErrorCode>     15003   </ErrorCode>
   <DataItemName>   </DataItemName>
   <EventPayload>     31373133342E312E616D6436346672652E7273345F72656C656173652E3138303431302D3138303400   </EventPayload>
  </ProcessingErrorData>
 </Event>   

TimeCreated SystemTime='2018-09-30T16:05:35.754899600Z'
Publisher name: 
Failed to get event format size. Error = 3AB3
Event 2 : 
============

 <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
  <System>
   <Provider Name='' Guid='{68fdd900-4a3e-11d1-84f4-0000f80464e3}'/>
   <EventID>     0   </EventID>
   <Version>     2   </Version>
   <Level>     0   </Level>
   <Task>     0   </Task>
   <Opcode>     66   </Opcode>
   <Keywords>     0x0   </Keywords>
   <TimeCreated SystemTime='2018-09-30T16:05:35.754899600Z'/>
   <EventRecordID>     2   </EventRecordID>
   <Correlation/>
   <Execution ProcessID='4294967295' ThreadID='4294967295' ProcessorID='0' KernelTime='0' UserTime='0'/>
   <Channel>   </Channel>
   <Computer>     Keno-PC   </Computer>
   <Security/>
  </System>
  <ProcessingErrorData>
   <ErrorCode>     15003   </ErrorCode>
   <DataItemName>   </DataItemName>
   <EventPayload>     31373133342E312E616D6436346672652E7273345F72656C656173652E3138303431302D3138303400   </EventPayload>
  </ProcessingErrorData>
 </Event>   

TimeCreated SystemTime='2018-09-30T16:05:35.754899600Z'
Publisher name: 
Failed to get event format size. Error = 3AB3
Event 3 : 
============

 <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
  <System>
   <Provider Name='Microsoft-Windows-SMBClient' Guid='{988c59c5-0a1c-45b6-a555-0c62276e327d}'/>
   <EventID>     30813   </EventID>
   <Version>     0   </Version>
   <Level>     4   </Level>
   <Task>     0   </Task>
   <Opcode>     0   </Opcode>
   <Keywords>     0x400000000000040   </Keywords>
   <TimeCreated SystemTime='2018-09-30T16:48:30.686626300Z'/>
   <EventRecordID>     3   </EventRecordID>
   <Correlation/>
   <Execution ProcessID='4' ThreadID='3896' ProcessorID='0' KernelTime='5' UserTime='0'/>
   <Channel>   </Channel>
   <Computer>     Keno-PC   </Computer>
   <Security UserID='S-1-5-18'/>
  </System>
  <EventData>
   <Data Name='ServerNameLength'>     58   </Data>
   <Data Name='ServerName'>     \Device\NetBT_Tcpip_{8021CD4F-6CDB-47B1-ACAC-62054DDCCD50}   </Data>
  </EventData>
 </Event>   

TimeCreated SystemTime='2018-09-30T16:48:30.686626300Z'
Publisher name: Microsoft-Windows-SMBClient
Event message:
Eine TDI-Transportschnittstelle wurde gelöscht.

Name: \Device\NetBT_Tcpip_{8021CD4F-6CDB-47B1-ACAC-62054DDCCD50}

Erläuterung:
Eine TDI (NetBIOS)-Bindung wurde auf dem angegebenen Netzwerkadapter für den SMB-Client entfernt. Dieses Ereignis tritt auf, wenn ein Computer heruntergefahren wird oder wenn ein zuvor aktivierter Netzwerkadapter deaktiviert wird. Es ist keine Benutzeraktion erforderlich.

==========
Event 4 : 
============

 <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
  <System>
   <Provider Name='Microsoft-Windows-SMBServer' Guid='{d48ce617-33a2-4bc3-a5c7-11aa4f29619e}'/>
   <EventID>     1011   </EventID>
   <Version>     0   </Version>
   <Level>     4   </Level>
   <Task>     1011   </Task>
   <Opcode>     0   </Opcode>
   <Keywords>     0x2000000000000008   </Keywords>
   <TimeCreated SystemTime='2018-09-30T16:48:30.687496200Z'/>
   <EventRecordID>     4   </EventRecordID>
   <Correlation/>
   <Execution ProcessID='4' ThreadID='8080' ProcessorID='0' KernelTime='1' UserTime='0'/>
   <Channel>   </Channel>
   <Computer>     Keno-PC   </Computer>
   <Security UserID='S-1-5-18'/>
  </System>
  <UserData>
   <EventData xmlns='Smb2Namespace'>
    <NameLength>      0    </NameLength>
    <Name>    </Name>
    <DomainNameLength>      0    </DomainNameLength>
    <DomainName>    </DomainName>
    <TransportNameLength>      58    </TransportNameLength>
    <TransportName>      \Device\NetBT_Tcpip_{8021CD4F-6CDB-47B1-ACAC-62054DDCCD50}    </TransportName>
   </EventData>
  </UserData>
 </Event>   

TimeCreated SystemTime='2018-09-30T16:48:30.687496200Z'
Publisher name: Microsoft-Windows-SMBServer
Event message:
Ein Endpunkt wurde entfernt.

Name: 
Domänenname: 
Transportname: \Device\NetBT_Tcpip_{8021CD4F-6CDB-47B1-ACAC-62054DDCCD50}

Erläuterung:

Dieser Fehler kann auftreten, wenn der Server die Überwachung einer Schnittstelle beendet, wie beispielsweise beim Herunterfahren oder beim Deaktivieren eines Netzwerkadapters. Es ist keine Benutzeraktion erforderlich.

==========
Event 5 : 
============

 <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
  <System>
   <Provider Name='Microsoft-Windows-SMBClient' Guid='{988c59c5-0a1c-45b6-a555-0c62276e327d}'/>
   <EventID>     30810   </EventID>
   <Version>     0   </Version>
   <Level>     4   </Level>
   <Task>     0   </Task>
   <Opcode>     0   </Opcode>
   <Keywords>     0x400000000000040   </Keywords>
   <TimeCreated SystemTime='2018-09-30T16:48:30.782256800Z'/>
   <EventRecordID>     5   </EventRecordID>
   <Correlation/>
   <Execution ProcessID='4' ThreadID='232' ProcessorID='0' KernelTime='136' UserTime='0'/>
   <Channel>   </Channel>
   <Computer>     Keno-PC   </Computer>
   <Security UserID='S-1-5-18'/>
  </System>
  <EventData>
   <Data Name='NameLength'>     8   </Data>
   <Data Name='Name'>     Ethernet   </Data>
   <Data Name='IfIndex'>     9   </Data>
  </EventData>
 </Event>   

TimeCreated SystemTime='2018-09-30T16:48:30.782256800Z'
Publisher name: Microsoft-Windows-SMBClient
Event message:
Eine TCP/IP-Transportschnittstelle wurde hinzugefügt.

Name: Ethernet
InterfaceIndex: 0x9

Erläuterung:
Eine TCP/IP-Bindung wurde dem angegebenen Netzwerknetwork für den SMB-Client hinzugefügt. Der SMB-Client kann nun SMB-Datenverkehr auf diesem Netzwerkadapter mithilfe von TCP/IP senden und empfangen. Dieses Ereignis tritt auf, wenn ein Computer neu gestartet wird oder wenn ein zuvor deaktivierter Netzwerkadapter erneut aktiviert wird. Es ist keine Benutzeraktion erforderlich.

==========
Event 6 : 
============

 <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
  <System>
   <Provider Name='Microsoft-Windows-SMBClient' Guid='{988c59c5-0a1c-45b6-a555-0c62276e327d}'/>
   <EventID>     30810   </EventID>
   <Version>     0   </Version>
   <Level>     4   </Level>
   <Task>     0   </Task>
   <Opcode>     0   </Opcode>
   <Keywords>     0x400000000000040   </Keywords>
   <TimeCreated SystemTime='2018-09-30T16:48:30.790154700Z'/>
   <EventRecordID>     6   </EventRecordID>
   <Correlation/>
   <Execution ProcessID='4' ThreadID='232' ProcessorID='0' KernelTime='136' UserTime='0'/>
   <Channel>   </Channel>
   <Computer>     Keno-PC   </Computer>
   <Security UserID='S-1-5-18'/>
  </System>
  <EventData>
   <Data Name='NameLength'>     8   </Data>
   <Data Name='Name'>     Ethernet   </Data>
   <Data Name='IfIndex'>     9   </Data>
  </EventData>
 </Event>   

TimeCreated SystemTime='2018-09-30T16:48:30.790154700Z'
Publisher name: Microsoft-Windows-SMBClient
Event message:
Eine TCP/IP-Transportschnittstelle wurde hinzugefügt.

Name: Ethernet
InterfaceIndex: 0x9

Erläuterung:
Eine TCP/IP-Bindung wurde dem angegebenen Netzwerknetwork für den SMB-Client hinzugefügt. Der SMB-Client kann nun SMB-Datenverkehr auf diesem Netzwerkadapter mithilfe von TCP/IP senden und empfangen. Dieses Ereignis tritt auf, wenn ein Computer neu gestartet wird oder wenn ein zuvor deaktivierter Netzwerkadapter erneut aktiviert wird. Es ist keine Benutzeraktion erforderlich.

==========
Event 7 : 
============

 <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
  <System>
   <Provider Name='Microsoft-Windows-DNS-Client' Guid='{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}'/>
   <EventID>     1014   </EventID>
   <Version>     0   </Version>
   <Level>     3   </Level>
   <Task>     1014   </Task>
   <Opcode>     0   </Opcode>
   <Keywords>     0x4000000010000000   </Keywords>
   <TimeCreated SystemTime='2018-09-30T16:48:31.612251800Z'/>
   <EventRecordID>     7   </EventRecordID>
   <Correlation/>
   <Execution ProcessID='548' ThreadID='10764' ProcessorID='0' KernelTime='8' UserTime='2'/>
   <Channel>   </Channel>
   <Computer>     Keno-PC   </Computer>
   <Security UserID='S-1-5-20'/>
  </System>
  <EventData>
   <Data Name='QueryName'>     www.apple.com   </Data>
   <Data Name='AddressLength'>     128   </Data>
   <Data Name='Address'>     02000000C0A8B201000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000   </Data>
  </EventData>
 </Event>   

TimeCreated SystemTime='2018-09-30T16:48:31.612251800Z'
Publisher name: Microsoft-Windows-DNS-Client
Event message:
Zeitüberschreitung bei der Namensauflösung für den Namen www.apple.com, nachdem keiner der konfigurierten DNS-Server geantwortet hat.

==========
Event 8 : 
============

 <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
  <System>
   <Provider Name='Microsoft-Windows-NDIS' Guid='{cdead503-17f5-4a3e-b7ae-df8cc2902eb9}'/>
   <EventID>     10400   </EventID>
   <Version>     0   </Version>
   <Level>     3   </Level>
   <Task>     0   </Task>
   <Opcode>     0   </Opcode>
   <Keywords>     0x2000000000000000   </Keywords>
   <TimeCreated SystemTime='2018-09-30T16:48:29.618967500Z'/>
   <EventRecordID>     8   </EventRecordID>
   <Correlation ActivityID='{8021CD4F-6CDB-47B1-ACAC-62054DDCCD50}'/>
   <Execution ProcessID='4' ThreadID='7092' ProcessorID='0' KernelTime='129' UserTime='0'/>
   <Channel>   </Channel>
   <Computer>     Keno-PC   </Computer>
   <Security/>
  </System>
  <EventData>
   <Data Name='IfGuid'>     {8021CD4F-6CDB-47B1-ACAC-62054DDCCD50}   </Data>
   <Data Name='IfIndex'>     9   </Data>
   <Data Name='IfLuid'>     1689399632855040   </Data>
   <Data Name='AdapterName'>     Intel(R) Ethernet Connection (2) I219-V   </Data>
   <Data Name='ResetReason'>     2   </Data>
   <Data Name='ResetCount'>     3   </Data>
  </EventData>
 </Event>   

TimeCreated SystemTime='2018-09-30T16:48:29.618967500Z'
Publisher name: Microsoft-Windows-NDIS
Event message:
Für die Netzwerkschnittstelle Intel(R) Ethernet Connection (2) I219-V wurde ein Zurücksetzungsvorgang eingeleitet. Während die Hardware zurückgesetzt wird, sind Netzwerkverbindungen vorübergehend unterbrochen. Ursache: The network driver detected that its hardware has stopped responding to commands. Diese Netzwerkschnittstelle wurde seit der letzten Initialisierung 3 Mal zurückgesetzt.

==========
Event 9 : 
============

 <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
  <System>
   <Provider Name='e1dexpress'/>
   <EventID Qualifiers='40964'>     27   </EventID>
   <Level>     3   </Level>
   <Task>     0   </Task>
   <Keywords>     0x80000000000000   </Keywords>
   <TimeCreated SystemTime='2018-09-30T16:48:29.618833600Z'/>
   <EventRecordID>     9   </EventRecordID>
   <Channel>   </Channel>
   <Computer>     Keno-PC   </Computer>
   <Security/>
  </System>
  <EventData>
   <Data>   </Data>
   <Data>     Intel(R) Ethernet Connection (2) I219-V   </Data>
   <Binary>     0000040002003000000000001B0004A00000000000000000000000000000000000000000000000001B0004A0   </Binary>
  </EventData>
 </Event>   

TimeCreated SystemTime='2018-09-30T16:48:29.618833600Z'
Publisher name: e1dexpress
Event message:
Intel(R) Ethernet Connection (2) I219-V
 Netzwerkverbindung wurde unterbrochen.


==========
Event 10 : 
============

 <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
  <System>
   <Provider Name='Microsoft-Windows-SMBClient' Guid='{988c59c5-0a1c-45b6-a555-0c62276e327d}'/>
   <EventID>     30810   </EventID>
   <Version>     0   </Version>
   <Level>     4   </Level>
   <Task>     0   </Task>
   <Opcode>     0   </Opcode>
   <Keywords>     0x400000000000040   </Keywords>
   <TimeCreated SystemTime='2018-09-30T16:48:29.622348900Z'/>
   <EventRecordID>     10   </EventRecordID>
   <Correlation/>
   <Execution ProcessID='4' ThreadID='232' ProcessorID='0' KernelTime='136' UserTime='0'/>
   <Channel>   </Channel>
   <Computer>     Keno-PC   </Computer>
   <Security UserID='S-1-5-18'/>
  </System>
  <EventData>
   <Data Name='NameLength'>     8   </Data>
   <Data Name='Name'>     Ethernet   </Data>
   <Data Name='IfIndex'>     9   </Data>
  </EventData>
 </Event>   

TimeCreated SystemTime='2018-09-30T16:48:29.622348900Z'
Publisher name: Microsoft-Windows-SMBClient
Event message:
Eine TCP/IP-Transportschnittstelle wurde hinzugefügt.

Name: Ethernet
InterfaceIndex: 0x9

Erläuterung:
Eine TCP/IP-Bindung wurde dem angegebenen Netzwerknetwork für den SMB-Client hinzugefügt. Der SMB-Client kann nun SMB-Datenverkehr auf diesem Netzwerkadapter mithilfe von TCP/IP senden und empfangen. Dieses Ereignis tritt auf, wenn ein Computer neu gestartet wird oder wenn ein zuvor deaktivierter Netzwerkadapter erneut aktiviert wird. Es ist keine Benutzeraktion erforderlich.

==========
Success all items processed!
We have multiple network-related events. I think we can leave out the SMB stuff, what's left is:
Event 7: Timeout in the DNS system while resolving www.apple.com
Event 8: The network interface Intel bla bla has been reset. (english part: ...because the hardware stopped responding...) The connection was reset 3 times since initialization.
Event 9: Network connection interrupted

Might be interesting, but there was no network related stuff in the first dump. Does this make any sense to you?
 
If an event made it to disk before the crash it wouldn't show up in the MEMORY.DMP. Do you see any network adapter reset events in Event Viewer shortly before the crash which doesn't have any network related events pending in the MEMORY.DMP?

Disconnecting from the Internet and disabling the Ethernet adapter in the BIOS would be something I'd try assuming disconnecting from the Internet doesn't make the computer completely useless. I'm not sure why the problem would go away with the GPU removed, though, if it was the Ethernet adapter unless they are sharing an interrupt... perhaps.
 
Screenshot from my event viewer:
Screenshot_crop.png
There are 2 reset events taking place about 2 minutes before the stop error occured, so that'd be plausible.
The event below my blue mark is from yesterday and also occured about 2 mins before the crash.
But there is no such event before today's first crash (which occured at 11:46:37 local time) :roll eyes (sarcasti

The PC becomes kind of useless indeed - maybe I'll try disabling it and then let the computer idle for a longer time. In the end this would mean the mainboard is broken, doesn't it?
 
Yes but a failed Ethernet adapter is something that can be replaced with an expansion card or USB adapter. I'd want to replace the mainboard if it was pretty much any other component but a failed Ethernet adapter is typically an isolated problem that doesn't suggest other components might start failing, in my experience.
 
Last edited:

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top