Re: Tutorial creating & using Hirens Boot CD & MemTest86 diagnostic stress testing tools for USB boot to Windows 10 PE & WinXPmini on BIOS & UEFI

UPDATE: 
a. I was able to get Windows to create crash logs finally (it's not intuitive)
b. The crash logs (or BSOD messages) tentatively implicate 3 specific files:
   c:\windows\system32\drivers\fltmgr.sys (implicated in crash logs)
   c:\windows\system32\ntoskrnl.exe (secondarily indicated in crash logs)
   c:\windows\system32\win32kbase.sys (implicated in BSOD screen message)
c. All three files test good.
   sfc /verifyfile=c:\windows\system32\drivers\fltmgr.sys (runs in a second)
   sfc /verifyfile=c:\windows\system32\ntoskrnl.exe (takes a second to run)
   sfc /verifyfile=c:\windows\system32\win32kbase.sys (runs in a second)

Technical questions that resulted are:
1. How can we tell exactly which restore point Windows finally ended up with?
2. How can we update all the outdated hardware drivers at once?

Gory Details (written so that many others can follow in our footsteps):

Last I reported yesterday afternoon, I had scheduled a checkdisk to run 
on boot at about 9:20 PM after running sfc and dism cleanup operations:
o <https://i.postimg.cc/PrNVbMsw/newbsod01.jpg>
o <https://i.postimg.cc/tCfSBVpm/newbsod02.jpg>
o <https://i.postimg.cc/52CPTNt9/newbsod03.jpg>
o <https://i.postimg.cc/YSBXHK46/newbsod04.jpg>
o <https://i.postimg.cc/nrxjF24w/newbsod05.jpg>
o <https://i.postimg.cc/hPyfZYzY/newbsod06.jpg>
o <https://i.postimg.cc/1377tygK/newbsod07.jpg>

Just my luck that it BSOD'd during that checkdisk operation at about 9:26 PM:
o <https://i.postimg.cc/BnkhdZKy/newbsod08.jpg>
  Your device ran into a problem and needs to restart.
  We're just collecting some error info, and then you can restart.
  0% complete
  System Thread Exception Not Handled

Then, it BSOD'd instantly on the very next reboot at about 9:28 PM.
o <https://i.postimg.cc/vZJz0qRw/newbsod09.jpg>
  Your device ran into a problem and needs to restart.
  We're just collecting some error info, and then you can restart.
  100% complete
  Kernel Mode Heap Corruption
 
  Note that the log file appears to have been created 100%.

o The third reboot then brought up the POST screen, which is a good sign:
  <https://i.postimg.cc/nhbj56L2/newbsod10.jpg>

o Then came the obligatory "Preparing Automatic Repair" & ferris dots:
  <https://i.postimg.cc/2S7Qxzxh/newbsod11.jpg>

o And then the "Diagnosing your PC" and ferris dots:
  <https://i.postimg.cc/QNKcygbX/newbsod12.jpg>

o And the always inevitable "Windows couldn't load correctly":
  <https://i.postimg.cc/j5pnb9XR/newbsod13.jpg>
  To which I pressed [Restore]
  
o Which brought us to the "Attempting repairs" screen with ferris dots:
  <https://i.postimg.cc/9QL4Mzp8/newbsod14.jpg>

o After a flag, ferris dots, & a flag with ferris dots, "Please wait":
  <https://i.postimg.cc/j5PdzjHr/newbsod15.jpg>
  
o Once booted, I noticed from my menus Windows had reverted to an old 
  restore point, but I can't figure out how to tell which one it used.
  (You'd think it's the last but it's not always the last one, particularly 
  when it takes many reboots to finally get to the login screen.)

o I ran the Windows Reliability Monitor which finally had some information:
  <https://i.postimg.cc/dQgpbBcn/newbsod16.jpg>
  Win+R > perfmon /rel
  Control Panel > System & Security > Security & Maintenance 

o The first of two logged failures was not all that informatively useful:
  <https://i.postimg.cc/9FVtwRdC/newbsod17.jpg>
  Control Panel > System & Security > Security & Maintenance > Problem Details
  Date:  9/25/2020 9:38 PM
  Problem: Windows failed to start because of missing system files 
  Description: Windows was unable to determine the problem.
               Error code: 0x13a
 
o The second of two logged failures was only slightly more informative:
  <https://i.postimg.cc/3R5DMV9Y/newbsod18.jpg>
  Control Panel > System & Security > Security & Maintenance > Problem Details

  This is the first of two entries at 9:39 PM:
  Problem: Windows stopped working 9/25/2020 9:39 PM
  Description
  The computer has rebooted from a bugcheck.  
  The bugcheck was: 0x0000013a 
  (0x0000000000000012, 0xffffca0853202100, 0xffffca0858beb000, 0x0000000000000000)
  A dump was saved in: C:\Windows\MEMORY.DMP. 
  Report Id: ba013a5c-613d-4fae-9d5a-a26f9ab3b1af.
 
  This is the second of two entries at 9:39 PM:

  Problem: Shut down unexpectedly 9/25/2020 9:39 PM
  Problem signature
   Problem Event Name: BlueScreen
   Code: 13a
   Parameter 1: 12
   Parameter 2: ffffca0853202100
   Parameter 3: ffffca0858beb000
   Parameter 4: 0
   OS version: 10_0_19041
   Service Pack: 0_0
   Product: 256_1
   OS Version: 10.0.19041.2.0.0.256.48
   Locale ID: 1033

o Than I ran the Windows System Event Viewer:
  <https://i.postimg.cc/LsBZpvWP/newbsod19.jpg>
  Win+R > eventvwr.msc
  EventViewer (Local) > Windows Logs > System > (right click)
  Filter Current Log > Event IDs = 41, 1074, 6006, 6008

  Information: 9/25/2020 9:24:30 PM Source=User32 EventID=1074 Task=None
  General: The process C:\Windows\Explorer.EXE (pcname) has initiated 
  the restart of computer pcname on behalf of user pcname\username 
  for the following reason: Other (Unplanned)
  Reason Code: 0x0
  Shutdown Type: restart
  Comment: 
  General:
   Log Name: System 
   Source: User32
   Event ID: 1074
   Level: Information
   User: pcname\username
   OpCode: Info
   Logged: 9/25/2020 9:24:30 PM
   Task Category: None
   Keywords: Classic
   Computer: pcname

  Information: 9/25/2020 9:24:36 PM Source=EventLog EventID=6006 Task=None
  General: The Event log service was stopped.
   Log Name: System 
   Source: EventLog
   Event ID: 6006
   Level: Information
   User: N/A
   OpCode: Info
   Logged: 9/25/2020 9:24:36 PM
   Task Category: None
   Keywords: Classic
   Computer: pcname

o Then I ran "WhoCrashed" which implicated "fltmgr.sys" & "ntoskrnl.exe":
  <https://i.postimg.cc/Y28Z9HFn/newbsod20.jpg>

  On Fri 9/25/2020 9:28:05 PM your computer crashed or a problem was reported
  crash dump file: C:\Windows\MEMORY.DMP
  This was probably caused by the following module: fltmgr.sys 
  (FLTMGR!FltCbdqInitialize+0x2EC2) 
  Bugcheck code: 0x13A (0x12, 0xFFFFCA0853202100, 0xFFFFCA0858BEB000, 0x0)
  Error: KERNEL_MODE_HEAP_CORRUPTION
  file path: C:\Windows\system32\drivers\fltmgr.sys
  product: Microsoft(c) Windows(c) Operating System
  company: Microsoft Corporation
  description: Microsoft Filesystem Filter Manager
  Bug check description: This indicates that the kernel mode heap manager has detected corruption in a heap. 
  This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. 
  The crash took place in a file system driver. Since there is no other responsible driver detected, 
  this could be pointing to a malfunctioning drive or corrupted disk. 
  It's suggested that you run CHKDSK.

  On Fri 9/25/2020 9:28:05 PM your computer crashed or a problem was reported
  crash dump file: C:\Windows\Minidump\092520-31906-01.dmp
  This was probably caused by the following module: ntoskrnl.exe (nt+0x3F3EA0) 
  Bugcheck code: 0x13A (0x12, 0xFFFFCA0853202100, 0xFFFFCA0858BEB000, 0x0)
  Error: KERNEL_MODE_HEAP_CORRUPTION
  file path: C:\Windows\system32\ntoskrnl.exe
  product: Microsoft(c) Windows(c) Operating System
  company: Microsoft Corporation
  description: NT Kernel & System
  Bug check description: This indicates that the kernel mode heap manager has detected corruption in a heap. 
  This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. 
  The crash took place in the Windows kernel. 
  Possibly this problem is caused by another driver that cannot be identified at this time. 

 Conclusion
  2 crash dumps have been found and analyzed. 
  No offending third party drivers have been found. 
  Connsider [sic] using WhoCrashed Professional which offers more detailed 
  analysis using symbol resolution. 
  Also configuring your system to produce a full memory dump may help you. 

o Time to check the hash for these three implicated files:
   Name: fltMgr.sys
   Size: 430392 bytes (420 KiB)
   SHA256: 6390C3D54E955C42E73B74B1FDFB7BA45965DCBA273B34EDADAC265ADCDD9731
   (Implicated by the crash logs.)

   Name: ntoskrnl.exe
   Size: 10847552 bytes (10 MiB)
   SHA256: A577850D67D1B4DF94E64B3309169E20F3850D4BFA54C40DC9F4F09722E2F5EA
   (Implicated by the crash logs.)

   Name: win32kbase.sys
   Size: 2951680 bytes (2882 KiB)
   SHA256: 0BE65ECF2983B13A8C25687A5695A2542D184DEC45DD28C7D38190F25C06B3DF
   (Implicated by an earlier BSOD message.) 

o But nothing seems to be wrong with those the implicated files:
  Win+R > cmd {control+shift+enter}
   sfc /verifyfile=c:\windows\system32\drivers\fltmgr.sys (runs in a second)
   sfc /verifyfile=c:\windows\system32\ntoskrnl.exe (takes a second to run)
   sfc /verifyfile=c:\windows\system32\win32kbase.sys (runs in a second)

o I also ran the following commands, all of which came up clean:
   sfc /scannow (mine took about 10 minutes for the first run) 
   sfc /scannow (mine took about 4 minutes for the second run)
   sfc /scannow (mine took about 4 minutes for the third run)
   Dism /Online /Cleanup-Image /CheckHealth (mine took five seconds)
   Dism /Online /Cleanup-Image /ScanHealth (mine took thirteen minutes)
   Dism /Online /Cleanup-Image /RestoreHealth (mine took about ten minutes)
   sfc /scannow (mine took about seven minutes for this last run)

o Ran BlueScreenView which used C:\Windows\MiniDump implicating the same files:
  <https://i.postimg.cc/nhkfvD9x/newbsod21.jpg>

  Dump File: 092520-31906-01.dmp
  Crash Time: 9/25/2020 9:28:05 PM
  Bug Check Code: 0x0000013a
  Parameter 1: 00000000'00000012
  Parameter 2: ffffca08'53202100
  Parameter 3: ffffca08'58beb000
  Parameter 4: 00000000'00000000
  Caused by Driver: FLTMGR.SYS
  Caused by Address: FLTMGR.SYS+aa2f
  Processor: x64
  Crash Address: ntoskrnl.exe+3f3ea0 
  Full Path: C:\Windows\Minidump\092520-31906-01.dmp
  Processors Count: 4
  Major Version:  15
  Minor Version: 19041
  Dump File Size: 602,252
  Dump File Time: 9/25/2020 9:39:31 PM

o Googling for what fltmgr.sys is, a problem is every scam on the planet 
  tells you a teeny tiny bit about the file, and then tries to sell you 
  their driver fixit tools.
  o What Is Fltmgr.sys? 
  <https://www.partitionwizard.com/disk-recovery/fltmgr-sys.html>
  It's a MS Windows file related to the file system filter manager.
  It's used to make sure all files stay in their proper locations.
  
  o What Is Fltmgr?
  <https://www.file.net/process/fltmgr.sys.html>
  Microsoft Filesystem Filter Manager is an essential Windows process 
  that allows installed files to be placed into their respective directories. 
  This utility is installed with the Windows OS, and is only triggered 
  when a minifilter driver is loaded. The Filter manager then connects 
  with the files system stack for a target volume. 

  o What causees FltMgr.sys Errors?
  <https://www.personalcomputerfixes.com/how-to-prevent-fltmgr-sys-blue-screen-errors/>
  The fltmgr.sys error is caused when Windows cannot read or process files 
  that are on the hard drive, usually because the File System Manager is 
  damaged or unreadable. If this is the case, it can cause hard drives 
  to stop working and the blue screen to appear.

o Googling for what ntoskrnl is, 

o Googling for what win32kbase.sys is, I find the same scam tactics:
  o ntoskrnl.exe (Wikipedia)
  <https://en.wikipedia.org/wiki/Ntoskrnl.exe>
   In computing ntoskrnl.exe (short for Windows NT operating system kernel 
   executable), also known as kernel image, provides the kernel and 
   executive layers of the Microsoft Windows NT kernel space.

  o Fix Ntoskrnl.exe BSOD on WIndows 10
  <https://www.partitionwizard.com/disk-recovery/ntoskrnlexe-bsod.html>

  o What causes the ntoskrnl.exe error?
  <https://www.auslogics.com/en/articles/fix-ntoskrnl-exe-bsod/>
   There's no one thing that could be said to be the cause. 
   The issue could be software or hardware related. 
   But the possible factors include:
    Your device drivers are outdated, corrupt, or incompatible. 
    Faulty RAM. 
    Your RAM and local storage may be inadequate.
    You overclocked your devices.
    Some of your system files are corrupt.

o I checked my driver update which says I'm updated just fine:
  Win+I > Update & Security > Windows Update > [Check for updates]

o I bit and tried the "auslogics driver update"  but it will only update
  three drivers every 4 hours (go figure).

  <https://www.auslogics.com/en/articles/fix-ntoskrnl-exe-bsod/>
  <https://downloads.auslogics.com/en/driver-updater/driver-updater-setup.exe>

  Name: driver-updater-setup.exe
  Size: 12768144 bytes (12 MiB)
  SHA256: A9A07BCDF2D9663FC54B42DC2E754BD9AADABD8DA9D7CF428618808B7F076F81
  C:\Program Files (x86)\Auslogics\Driver Updater
  C:\app\hardware\driver\auslogic_driver_updater

  When I ran the crippleware, it said:
  ATTENTION: 10 drivers on your PC are either outdated or corrupt.

  AMD SMBus Installed 8/30/2017 Available 9/25/2018 Outdated
  PCI Standard ISA Bridge Installed 6/21/2006 Available 7/16/2012 Outdated
  HID-compliant mouse Installed 6/21/2006 Available 4/24/2010 Outdated
  Disk drive Installed 6/21/2006 Available 8/11/2013 Outdated
  Microsoft iSCSI Initiator Installed 6/21/2006 Available 11/13/2008 Outdated
  Standard Dual Channel PCI IDE Controller Installed 6/21/2006 Available 6/28/2013 Outdated
  Standard Dual Channel PCI IDE Controller Installed 6/21/2006 Available 6/28/2013 Outdated
  Realtek USB 2.0 Card Reader Installed 3/15/2018 Available 4/1/2019 Outdated
  Realtek PCIe GbE Family Controller Installed 4/10/2015 Available 12/6/2018 Outdated
  Generic PnP Monitor Installed 6/21/2006 Available 9/16/2010 Outdated

o I tried to update the remaining 7 device drivers manually:
  Win+R > devmgmt.msc
  And then I right clicked > Update Drivers - HID-Compliant Mouse > 
  Search automatically for drivers (but all I tested simply reported):
   "The best drivers for your device are already installed"

  What I'll do is every four hours, I'll update another 3 drivers.

o Googling for a good free driver update tool, I find this article:
  o 11 Best Free Driver Updater Tools 
  <https://www.lifewire.com/free-driver-updater-tools-2619206>
  1. Driver Booster 
  2. DriverPack Solution 
  3. Snappy Driver Installer 
  4. Driver Talent 
  5. DriversCloud 
  6. DriverIdentifier
  7. Free Driver Scout 
  8. Driver Easy 
  9. Device Doctor 
  10. DriverHub 
  11. DriverMax

  Where I opened a thread on what's the best update driver software:
  o What's the one free Windows 10 driver update tool you prefer most and why? 
  <https://groups.google.com/forum/#!topic/alt.comp.freeware/zhWjvKgDBt4>
  <https://groups.google.com/forum/#!topic/alt.comp.microsoft.windows/-yDz26GC6zA>
-- 
I'm determined to find out what is causing this BSOD but it's not easy!