blue screen of death

[john_adams123]

I have a Surface Pro3. For the past month or so I have had increasing problems waking it up from sleep, and for the past 3 days I have been getting the blue screen of death, CRITICAL_PROCESS_DIED, every time I turn it on or wake it from sleep, and also at sudden 30-60 minute intervals while I am working. None of the fixes suggested on other sites have worked. I have tried uninstalling the latest pen setting driver and running scannow, dism scanhealth and restorehealth commands.

My computer came with Windows 8.1 but it upgraded to Windows 10 soon after the upgrade came out--last August I think. I have my Windows update settings set on automatic, so it updates regularly and a check of updates shows that it is up to date. Virus and malware scans turn up nothing.

Starting in Safe Mode/Network and looking up device manager I find three items with yellow triangles. These are Generic PnP Monitor, Marvell Network Controller, and Surface Cover Telemetry.The yellow-triangled devices all say that their drivers are updated to the most recent version as well.

Where do I go from here?

 

[leeshor]

Welcome to the forum

Did you scan the system with Defender or do you have some other software installed?

 

[john_adams123]

Defender.

 

[leeshor]

Check the system and application logs to see if anything sticks out as the cause. Right click the start, left click computer management and the info will be under event viewer, Windows logs.

 

[john_adams123]

Not sure what I am looking for. It says:
Application-Administrative-10,838-10.07 MB
Security-Administrative-29,806-20.00 MB
Setup-Operational-91-68 KB
System-Administrative-20,027-10.07 MB
Forwarded Events-Operational-0-0 Bytes

 

[leeshor]

You want to look at the logs under system and under applications and note what errors you find. Especially the ones with the red circles. If you click those items on the left the logs will appear on the right. It may take a few seconds.

 

[john_adams123]

You want to look at the logs under system and under applications and note what errors you find. Especially the ones with the red circles. If you click those items on the left the logs will appear on the right. It may take a few seconds.

No red circles in either the windows or applications logs. The only non-zero in applications log is Microsoft Alerts (432).

 

[leeshor]

Just to be clear, the 2 logs you need to look at are application and system. Did you see any with yellow triangles?

I'm thinking you may want to download Malwarebytes and run a full scan. I personally don't trust Defender if there may indeed be a problem.

 

[john_adams123]

Okay. I have run a Malwarebytes full scan; it showed nothing.

Now I checked Administrative Events, and here I have lots of red circles from today. They are:
The server {784E29F4-5EBE-4279-9948-1E8FE941646D} did not register with DCOM within the required timeout.
Session "ReadyBoot" stopped due to the following error: 0xC0000188
The computer has rebooted from a bugcheck. The bugcheck was: 0x000000ef (0xffffe000e92797c0, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000). A dump was saved in: C:\WINDOWS\MEMORY.DMP. Report Id: 12977366-21d7-421d-84c8-65137541b65e
The MTN Pocket Internet. RunOuc service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.
A timeout was reached (30000 milliseconds) while waiting for the MTN Pocket Internet. RunOuc service to connect.
The Camtel EVDO-Huawei. RunOuc service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.
A timeout was reached (30000 milliseconds) while waiting for the Camtel EVDO-Huawei. RunOuc service to connect.
Audit events have been dropped by the transport. 0
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
The previous system shutdown at 3:39:00 PM on ‎2/‎23/‎2016 was unexpected.
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
The server {784E29F4-5EBE-4279-9948-1E8FE941646D} did not register with DCOM within the required timeout.
The server {784E29F4-5EBE-4279-9948-1E8FE941646D} did not register with DCOM within the required timeout.

Etc.

I'm sending this off to you before the computer shuts off again.

 

[leeshor]

From what I can see/tell from that report Camtel EVDO-Huawei seems to be an issue. I have no idea what that is.

Do you have a microSD card or USB drive attached?

 

[john_adams123]

I have a microSD card, which I have always had. The MTN and the Camtel EVDO-Huawei are for USB modems I have used in Africa. The modems themselves have not been plugged in for many months, however.

 

[leeshor]

Try uninstalling that software and at least temporarily take out the SD card. The SD card may have gotten corrupted or gone bad.