This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(19.2, 94%, 11%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMF%3C/text%3E%3C/svg%3E)
that was a KERNEL_MODE_HEAP_CORRUPTION, no 3rd party drivers on the call stack.
you should try to uninstall this 3rd party software and try to reproduce. (some chinese antivirus?)
C:\Windows\system32\drivers\AliPaladin64.sys Fri Sep 7 04:14:27 2018
C:\Windows\System32\drivers\Tppwr64v.sys Thu Feb 16 05:57:36 2017
C:\Windows\system32\drivers\TsQBDrv.sys Thu Nov 22 05:27:13 2018
C:\Windows\system32\drivers\xlwfp.sys Fri Mar 23 03:36:33 2018
Multiple instances of the Lenovo Solution Center drivers were unloaded, so you could uninstall that, too.
If the crashes continue: enable driver verifier.
Thank you very much for your suggestions, but my computer is a brand new computer produced in July 2019. Why does the record show the records of 2017 and 2018?
These three drivers are rogue applications from three Chinese companies. I understand that they will always occupy memory in the background (even if the application is closed). I have found a way to uninstall them through the registry. I hope to avoid the next blue screen. Thank you very much
Help me analyze the dump file, you helped me find the key point of this failure.
Hi MinghaoFu-1981
I've worked as Windows Support Engineer on behalf of Microsoft and I can help analyzing the dump file generated during the blue screen to try to find its root cause.
The default location of the dump file is %SystemRoot%memory.dmp. Can you check if the file is there?
If so, please upload do OneDrive so I can download and proceed.
Thanks!
s!AoQSI4tAXyBywYcgtreqvUaR2ca7JA
this is dump files
Please see the attached pdf.
I noticed that you are using Windows 18362 (1903).
There are many known issues that can cause this behavior.
To avoid this known issues, I suggest updating to 18363 (1909) and applying Windows Update to continue.
Can you follow this steps and verify if the issue persists?
Thanks
My computer has been updated in 1909. In the past year, my computer has shown a blue screen twice. The problem you helped me analyze is heap. How can I prevent this from happening again?
Thank you very much for your help
Hi,
Thanks for your quick answer.
Did the computer show a blue screen after the migration to 1909?
Heap corruption can occur for many reasons, but the most frequent is actually a hardware problem or third party software interacting with Windows incorrectly.
If the problem occurred after migrating to Windows 10 1909, I suggest evaluating the health of your hard drives and memory. In a second step, you can completely format your host and see if the problem happens in a clean installation.
Yes, this blue screen happened during the migration to 1909. This computer was purchased on the Thinkpad from Lenovo ’s official website in July last year. I have only used the blue screen problem twice, so I think the probability of hardware problems is not high.
Based on your analysis, I suspect that it is a software problem. If it is a third-party software problem, how do I locate which software is causing the blue screen?
Hi,
Thanks for answering. The BSOD occurred after the 1909 migration too?
The dump file makes clear that the corruption was detected inside svchost.
Since services inside svchost containers shares the same private address space, I couldn't identify exactly what service may be causing this BSOD.
It can be any service on your host...
I've also seen this problem happening in parallel with bad blocks on the disks. Can you perform an hd health check? https://hddscan.com/
Can you ensure that your Windows is fully updated?
Best regards
yes, it's occurred after the 1909 migration, all the updates on my computer are automatically performed by windows10, and the system shows that it has been updated to the latest version. I will accept your suggestion for hard disk testing. Thank you for your patience.
Share the memory dump files
thank you, this is dump files
that are the dates of these drivers.