Jump to content

jcgriff2

BSOD Kernel Dump Expert
  • Content Count

    50
  • Joined

  • Last visited

About jcgriff2

  • Rank
    BSOD Kernel Dump Expert

Contact Methods

  • Website URL
    https://www.sysnative.com

Profile Information

  • Location
    New Jersey Shore
  • Interests
    Microsoft MVP (2009-2016)
    Microsoft Windows Insider MVP (2018 - Present)

Recent Profile Visitors

1,590 profile views
  1. Hi. . . @bsodeath My apologies for the late reply. Almost always, when critical Windows system services and Windows executables die suddenly without explanation, a hard drive is involved. What typically happens is that during Superfetch/Prefetch or paging operations, kernel data from the hard drive gets loaded into RAM and during this process corruption occurs; the system service or Windows executable suddenly dies. Run Hard Drive diagnostics on ALL drives connected to the system, even if one or more is a simple USB stick. Run SeaTools for DOS, LONG test - https://www.sysnative.com/forums/threads/hard-drive-hdd-diagnostics-sea-tools-for-dos-ssd-test.4072/ Regards. . . jcgriff2
  2. Hi. . . Be sure to update your MBAM installation to the most recent version. Regards. . . jcgriff2
  3. Hi again. . . Would you please run through our BSOD Posting Instructions? The output may yield some clues. Regards. . . jcgriff2
  4. Are you in fact running the most recent version of MBAM? I would suggest that you install the current available version to be certain - https://www.malwarebytes.com/ Regards. .. jcgriff2
  5. Hi. . . I ran all 6 dumps and the cause of the BSODs is in fact Malwarebytes. MBAMSwissArmy MBAMSwissArmy.sys Wed Jul 29 00:26:01 2015 (55B855D9) As you can see the driver is from 2015. I'm also finding other MBAM drivers dated 2015. When is the last time that you updated your Malwarebytes installation? I suggest that you update it now - https://www.malwarebytes.com/ Regards. . . jcgriff2 Loading Dump File [C:\Users\PalmDesert\_jcgriff2_\dbug\__Kernel__\032019-26140-01.dmp] Built by: 17763.1.amd64fre.rs5_release.180914-1434 Debug session time: Wed Mar 20 02:33:32.528 2019 (UTC - 4:00) System Uptime: 0 days 0:03:12.744 *** WARNING: Unable to verify timestamp for MBAMSwissArmy.sys *** ERROR: Module load completed but symbols could not be loaded for MBAMSwissArmy.sys Probably caused by : MBAMSwissArmy.sys ( MBAMSwissArmy+ce90 ) DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT BUGCHECK_STR: AV PROCESS_NAME: mbam.exe FAILURE_BUCKET_ID: AV_R_INVALID_MBAMSwissArmy!unknown_function Bugcheck code 00000050 Arguments ffff8184`7b66f000 00000000`00000000 fffff806`3ad0ce90 00000000`00000000 BiosVersion = 1.51116.218 BiosReleaseDate = 03/09/2015 SystemManufacturer = Microsoft Corporation SystemProductName = Surface 3 MaxSpeed: 1600 CurrentSpeed: 1600 ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨`` Loading Dump File [C:\Users\PalmDesert\_jcgriff2_\dbug\__Kernel__\032019-32296-01.dmp] Built by: 17763.1.amd64fre.rs5_release.180914-1434 Debug session time: Wed Mar 20 02:27:25.923 2019 (UTC - 4:00) System Uptime: 2 days 20:51:47.840 *** WARNING: Unable to verify timestamp for MBAMSwissArmy.sys *** ERROR: Module load completed but symbols could not be loaded for MBAMSwissArmy.sys Probably caused by : MBAMSwissArmy.sys ( MBAMSwissArmy+ce90 ) DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT BUGCHECK_STR: AV PROCESS_NAME: mbam.exe FAILURE_BUCKET_ID: AV_R_INVALID_MBAMSwissArmy!unknown_function Bugcheck code 00000050 Arguments ffffa406`33e6f000 00000000`00000000 fffff807`6434ce90 00000000`00000000 BiosVersion = 1.51116.218 BiosReleaseDate = 03/09/2015 SystemManufacturer = Microsoft Corporation SystemProductName = Surface 3 MaxSpeed: 1600 CurrentSpeed: 1600 ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨`` Loading Dump File [C:\Users\PalmDesert\_jcgriff2_\dbug\__Kernel__\033119-13375-01.dmp] Built by: 17763.1.amd64fre.rs5_release.180914-1434 Debug session time: Sun Mar 31 16:18:39.365 2019 (UTC - 4:00) System Uptime: 0 days 0:04:48.655 *** WARNING: Unable to verify timestamp for MBAMSwissArmy.sys *** ERROR: Module load completed but symbols could not be loaded for MBAMSwissArmy.sys Probably caused by : MBAMSwissArmy.sys ( MBAMSwissArmy+ce90 ) DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT BUGCHECK_STR: AV PROCESS_NAME: mbam.exe FAILURE_BUCKET_ID: AV_R_INVALID_MBAMSwissArmy!unknown_function Bugcheck code 00000050 Arguments ffffae0a`13c6f000 00000000`00000000 fffff805`10e3ce90 00000000`00000000 BiosVersion = 1.51116.218 BiosReleaseDate = 03/09/2015 SystemManufacturer = Microsoft Corporation SystemProductName = Surface 3 MaxSpeed: 1600 CurrentSpeed: 1600 ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨`` Loading Dump File [C:\Users\PalmDesert\_jcgriff2_\dbug\__Kernel__\033119-15562-01.dmp] Built by: 17763.1.amd64fre.rs5_release.180914-1434 Debug session time: Sun Mar 31 16:13:02.162 2019 (UTC - 4:00) System Uptime: 0 days 0:01:42.451 *** WARNING: Unable to verify timestamp for MBAMSwissArmy.sys *** ERROR: Module load completed but symbols could not be loaded for MBAMSwissArmy.sys Probably caused by : MBAMSwissArmy.sys ( MBAMSwissArmy+ce90 ) DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT BUGCHECK_STR: AV PROCESS_NAME: mbam.exe FAILURE_BUCKET_ID: AV_R_INVALID_MBAMSwissArmy!unknown_function Bugcheck code 00000050 Arguments ffff9506`1366f000 00000000`00000000 fffff805`4f88ce90 00000000`00000000 BiosVersion = 1.51116.218 BiosReleaseDate = 03/09/2015 SystemManufacturer = Microsoft Corporation SystemProductName = Surface 3 MaxSpeed: 1600 CurrentSpeed: 1600 ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨`` Loading Dump File [C:\Users\PalmDesert\_jcgriff2_\dbug\__Kernel__\033119-26046-01.dmp] Built by: 17763.1.amd64fre.rs5_release.180914-1434 Debug session time: Sun Mar 31 17:04:51.699 2019 (UTC - 4:00) System Uptime: 0 days 0:04:33.918 *** WARNING: Unable to verify timestamp for MBAMSwissArmy.sys *** ERROR: Module load completed but symbols could not be loaded for MBAMSwissArmy.sys Probably caused by : MBAMSwissArmy.sys ( MBAMSwissArmy+ce90 ) DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT BUGCHECK_STR: AV PROCESS_NAME: mbam.exe FAILURE_BUCKET_ID: AV_R_INVALID_MBAMSwissArmy!unknown_function Bugcheck code 00000050 Arguments ffffd98b`3886f000 00000000`00000000 fffff801`58ffce90 00000000`00000000 BiosVersion = 1.51116.218 BiosReleaseDate = 03/09/2015 SystemManufacturer = Microsoft Corporation SystemProductName = Surface 3 MaxSpeed: 1600 CurrentSpeed: 1600 ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨`` Loading Dump File [C:\Users\PalmDesert\_jcgriff2_\dbug\__Kernel__\032019-22796-01.dmp] Built by: 17763.1.amd64fre.rs5_release.180914-1434 Debug session time: Wed Mar 20 02:42:54.544 2019 (UTC - 4:00) System Uptime: 0 days 0:01:32.653 *** WARNING: Unable to verify timestamp for MBAMSwissArmy.sys *** ERROR: Module load completed but symbols could not be loaded for MBAMSwissArmy.sys Probably caused by : MBAMSwissArmy.sys ( MBAMSwissArmy+ce90 ) DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT BUGCHECK_STR: AV PROCESS_NAME: mbam.exe FAILURE_BUCKET_ID: AV_R_INVALID_MBAMSwissArmy!unknown_function Bugcheck code 00000050 Arguments ffffcb8f`8c06f000 00000000`00000000 fffff801`7711ce90 00000000`00000000 BiosVersion = 1.51116.218 BiosReleaseDate = 03/09/2015 SystemManufacturer = Microsoft Corporation SystemProductName = Surface 3 MaxSpeed: 1600 CurrentSpeed: 1600 ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
  6. Turn Driver Verifier off. The fact that Driver Verifier did not BSOD your system means that more than likely, the cause of your BSODs is unknown hardware failure. Driver Verifier ran, stress-tested all of your 3rd party drivers and found no problems or issues with them. Regards. . . jcgriff2
  7. Take the chance so that you can remove the [likely] one bad RAM stick. Be careful when handling RAM. Touch some metal first to drain any electric shock out of yourself.
  8. Hi. . . I am assisting usasma until his eyesight recovers. I re-ran the original dump and did in fact see the 0x3b bugcheck (system service threw an exception); the exception error code is - 0xc0000094 - Integer division by zero -- meaning that a variable in ntfs.sys attempted to divide a number by zero, which is illegal. I assume that ntfs.sys was involved (as was NT - the Windows kernel) because it is the last driver identified on the stack (scroll to right - you'll see ntfs.sys about 3/4 of the way across starting on the 9th line down - # Child-SP RetAddr : Args to Child : Call Site 00 fffff108`9bb0e5a8 fffff804`42a60c69 : 00000000`0000003b 00000000`c0000094 fffff809`272f39c0 fffff108`9bb0eee0 : nt!KeBugCheckEx 01 fffff108`9bb0e5b0 fffff804`42a600bc : fffff108`9bb0f698 fffff108`9bb0eee0 fffff108`9bb0f698 00000000`00000000 : nt!KiBugCheckDispatch+0x69 02 fffff108`9bb0e6f0 fffff804`42a57f2f : fffff804`42d7f000 fffff804`4289c000 0005be48`00a6f000 00000000`00000000 : nt!KiSystemServiceHandler+0x7c 03 fffff108`9bb0e730 fffff804`428c2b20 : fffff108`9bb0ed80 00000000`00000000 fffff108`9bb0eca0 fffff804`42c35ce8 : nt!RtlpExecuteHandlerForException+0xf 04 fffff108`9bb0e760 fffff804`42907e74 : fffff108`9bb0f698 fffff108`9bb0f3e0 fffff108`9bb0f698 00000000`000047f0 : nt!RtlDispatchException+0x430 05 fffff108`9bb0eeb0 fffff804`42a60d42 : fffff108`9bb0f880 fffff108`9bb0f6b0 00000000`00000200 fffff108`9bb0f720 : nt!KiDispatchException+0x144 06 fffff108`9bb0f560 fffff804`42a59def : ffffe105`bddb8db0 fffff804`00000000 00000000`00000001 00000000`00000001 : nt!KiExceptionDispatch+0xc2 07 fffff108`9bb0f740 fffff809`272f39c0 : ffffe105`cdbe69a8 ffffe105`bdd6cf70 00000000`00012000 00000000`00000000 : nt!KiDivideErrorFault+0x2ef (TrapFrame @ fffff108`9bb0f740) 08 fffff108`9bb0f8d0 fffff809`272f342e : ffffe105`cdbe69a8 00000000`00000000 fffff108`9bb0fa90 ffff8100`00001000 : Ntfs!NtfsAllocateRecord+0x3e4 09 fffff108`9bb0fa30 fffff809`272f089b : ffffe105`cdbe69a8 ffffe105`bddbb180 ffffe105`c167f010 ffff0000`cdbe69a8 : Ntfs!NtfsAllocateMftRecord+0xba 0a fffff108`9bb0fb10 fffff809`2733097a : 00000000`00000400 00000000`00000008 ffffe105`cdbe69a8 ffffe105`cea05010 : Ntfs!NtfsCreateNewFile+0x7bb 0b fffff108`9bb0fea0 fffff809`27333e1d : ffffe105`cea05010 fffff108`9bb10170 ffffe105`cea05010 00000000`00000000 : Ntfs!NtfsCommonCreate+0x1bfa 0c fffff108`9bb10090 fffff804`429540d9 : ffffe105`bddbb030 ffffe105`cea05010 ffffe105`6d34f000 ffffe105`c04b1550 : Ntfs!NtfsFsdCreate+0x1cd 0d fffff108`9bb102f0 fffff809`26406219 : ffffe105`cea05010 ffffe105`c04b1550 ffffe105`cea057a0 ffffe105`6ff47ab0 : nt!IofCallDriver+0x59 0e fffff108`9bb10330 fffff809`2643d559 : fffff108`9bb103e0 ffffe105`c04b1550 00000000`000000c0 00000000`00000000 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x289 0f fffff108`9bb103a0 fffff804`429540d9 : ffffe105`c04b1500 ffffe105`cdb61010 00000000`00000000 fffff108`00000030 : FLTMGR!FltpCreate+0x2f9 10 fffff108`9bb10450 fffff804`429554b4 : ffffe105`6d80e470 00000000`00000000 ffffe105`c8b4e6f0 fffff804`42ac49d2 : nt!IofCallDriver+0x59 11 fffff108`9bb10490 fffff804`42f10d92 : 00000000`00000005 ffffe105`cdb61010 00000000`00000005 ffffe105`bdd9c840 : nt!IoCallDriverWithTracing+0x34 12 fffff108`9bb104e0 fffff804`42f35fb9 : ffffe105`bdd9c840 ffffe105`bdd9c800 ffffe105`c167f010 ffff8100`5b5c0b01 : nt!IopParseDevice+0x632 13 fffff108`9bb10650 fffff804`42f345bf : ffffe105`c167f000 fffff108`9bb108b8 ffffe105`00000040 ffffe105`604f3a60 : nt!ObpLookupObjectName+0x719 14 fffff108`9bb10820 fffff804`42e8a924 : 00000000`00000001 00000000`00000000 00000000`00000000 00000000`00000028 : nt!ObOpenObjectByNameEx+0x1df 15 fffff108`9bb10960 fffff804`42e8a509 : 00000069`1ab7d568 00000000`00000000 00000069`1ab7d850 00000069`1ab7d6d0 : nt!IopCreateFile+0x404 16 fffff108`9bb10a00 fffff804`42a60685 : 00000000`00000000 00000069`1ab7d6d0 00000069`1ab7d780 00000000`00000004 : nt!NtCreateFile+0x79 17 fffff108`9bb10a90 00007ffe`01a80114 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25 (TrapFrame @ fffff108`9bb10b00) 18 00000069`1ab7d4c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffe`01a80114 A stack is read from the bottom --> up So we see "NT", which is the Windows kernel doing some operations, then we see fltmgr.sys, which is a Microsoft File System Filter Manager driver followed by ntfs.sys, which is a Microsoft NT File System driver then we see "NT" again. Microsoft drivers are considered sacrosanct and 99.9% of the time are never the cause of a BSOD. When a Microsoft driver is named, unknown hardware failure is the likely cause. But let's stay with software for the moment and I'd like for you to run Driver Verifier - https://www.sysnative.com/forums/threads/driver-verifier-bsod-related-windows-10-8-1-8-7-vista.29/ Allow Driver Verifier to run in the background (you can continue to use your system), but save work/files very often because if Driver Verifier detects a driver violation, it will BSOD your system immediately. If you get a VERIFIER_ENABLED BSOD, please get the dump from \windows\minidump (file name = the date); copy it out to Documents or Desktop, zip it up and attach to your next post. Windows will not allow you to zip files in the \windows directory itself. You mentioned in your last post that you experienced another BSOD. Please get the dump for that BSOD and attach the zip file to your next post. If easier, you can just re-run the jcgriff2/Sysnative app from step #1 - .... and attach the output zip file like you did in post #1. Regards. . . jcgriff2
  9. How many RAM sticks do you have? Did you run memtest 1 stick at a time or all sticks together? Point being - only 1 stick of RAM is likely bad. Remove that from your system and run on less RAM. Regards. . . jcgriff2
  10. I don't believe the other tests are necessary at this point since you found bad RAM. If after the new RAM is installed you get BSODs, then post back and we'll figure out what to do next. Regards. . . jcgriff2
  11. I know.... it is not exactly cheap. Good luck to you... jcgriff2
  12. The RAM failed: Report Date 2019-03-07 23:30:44 Generated by MemTest86 V8.1 Free (64-bit) Result FAIL Time for new RAM. Regards. . . jcgriff2
  13. What does that mean exactly.... that the mobo was replaced or was not? That is normal for BSODs! Here are your system up-times -- ranging from 2 hours of use up to 16.75 hours of continuous use - System Uptime: 0 days 2:06:00.810 System Uptime: 0 days 16:43:54.001 System Uptime: 0 days 4:26:21.794
  14. 6 of the BSODs are recent - starting on 4 March 2019. There are 2 BSODs (empty dump files) from 2 June 2018 as well. No idea what caused the Summer 2018 BSODs. Nothing at all changed ~3 days ago -- i.e., the BSODs just began suddenly, then you had 6 of them.
  15. I unfortunately am no hardware expert. The extent of my hardware knowledge is replacing RAM and one HDD in one of my many OEM laptops.
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.