Jump to content

jcgriff2

BSOD Kernel Dump Expert
  • Posts

    57
  • Joined

  • Last visited

Reputation

1 Neutral

Contact Methods

  • Website URL
    https://www.sysnative.com

Profile Information

  • Location
    New Jersey Shore
  • Interests
    Microsoft MVP (2009-2016)
    Microsoft Windows Insider MVP (2018 - Present)

Recent Profile Visitors

4,212 profile views
  1. Hi @knightng . . . I'd like to get a look at the BSOD kernel memory dump file(s), please. Please run steps 1 and 2 found in this sticky thread - Blue Screen of Death (BSOD) Posting Instructions - Windows - BSOD, Crashes, Kernel Debugging - Malwarebytes Forums Attach the resulting zip file to your next post. Thank you. Regards. . . jcgriff2
  2. Folder Guard (driver = fguard64.sys) is the probable cause listed in your second screenshot. I suggest that you either update the software or remove it from your system. Regards. . . jcgriff2
  3. Hi. . . Unfortunately, there are no BSOD dump files in your attached zip file for me to take a look at. I do see an exception error code on your screen - 0xc0000098 - either you have the wrong driver installed for your internal drive or you are having boot configuration issues. I just had a Boot Config error on my laptop and had to reinstall Windows. Then I bought a new laptop! I also see hal.dll mentioned on the screen, which is the Hardware Abstract Layer, indicative that there is a likely hardware issue. Run SeaTools for DOS, LONG test on your internal drive - (7) Hard Drive (HDD) Diagnostics (Sea Tools for DOS) & SSD Test | Sysnative Forums Regards. . . jcgriff2
  4. Hi. . . Apologies for the late reply. You have had your share of BSODs - 14 of them going back to August 2019. You even had one on New Year's Day that had the same bugcheck (0x133 - DPC_WATCHDOG_VIOLATION ) as the four BSODs that I've processed that occurred recently. Same goes for your very first BSOD last August - 0x133 bugcheck. "WATCHDOG" in Windows usually refers to video, but not always. I'm seeing a lot of "Unknown_Image" and "Unknown_Module" listings in the dumps, which should be driver names, not UNKNOWN whatever. This is usually a problem related to RAM or the hard drive. Keep in mind when I mention RAM that it could be RAM itself or some other underlying issue (like heat) or perhaps other unknown hardware failure (like PSU; motherboard) that is affecting RAM's ability to properly hold kernel code. Bottom line is that your BSODs could be affected by RAM for many reasons. I'd like you to run hardware diagnostics for RAM and your hard drive. RAM - run memtest86 one stick at a time; alternate the slots so you'll be testing each RAM stick in each slot by itself. I know this may seem long and daunting, but it is the most prudent way to test RAM. I believe that memtest86 free version allows 4 passes, so do all 4 passes. Hard Drive - if an SSD, check the SSD manufacturer's site for a firmware upgrade. This is uber-important to do. Diagnostic test - Run SeaTools for DOS, LONG test on ALL internal drives - https://www.sysnative.com/forums/threads/hard-drive-hdd-diagnostics-sea-tools-for-dos-ssd-test.4072/ Also, apologies about the Sysnative app that I wrote - if you have a huge number of WERCON (Windows Error Reporting) entries, the "waiting for systeminfo" message will repeat and repeat for a very long time (hours, even days!). It is generated by the Windows app msinfo32 so there is nothing that I can do about it (i.e., I cannot fix the Microsoft Windows source code). It rarely occurs. Even though the Sysnative app did not finish, there should still be a Sysnative folder located in Documents with about 25-30 files in it. If you can, please zip it up and attach to your next post. Thank you. I DO NOT find your BSODs to be a driver issue, however, please make sure that your NVIDIA driver is up to date - https://www.sysnative.com/drivers/driver.php?id=nvlddmkm.sys Good luck with the testing. Regards. . . jcgriff2 BUGCHECK SUMMARY BugCheck 133, {1, 1e00, fffff80364a52378, 0} Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE ) ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨`` BugCheck 133, {1, 1e00, fffff801b3667378, 0} Probably caused by : nvlddmkm.sys ( nvlddmkm+11a648 ) ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨`` BugCheck 133, {1, 1e00, fffff80204ee0378, 0} Probably caused by : ntkrnlmp.exe ( nt!KeAccumulateTicks+103631 ) ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨`` BugCheck 133, {1, 1e00, fffff801818fc378, 0} Probably caused by : nvlddmkm.sys ( nvlddmkm+3caf61 ) ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
  5. Hi. . . I have processed the 5 BSOD mini kernel dumps and do believe that we are likely dealing with unknown hardware failure here because of the different bugchecks as well as the dump content. Furthermore, 2 of the dumps contain Unknown_Image in place of driver names, which tells me that some type of memory corruption is occurring. Memory corruption can be caused by a number of factors from bad RAM to a faulty hard drive; heat; over-clocking; motherboard failure; PSU problems, etc.. -- basically anything that could destabilize RAM - while a module is being loaded from the hard drive into RAM (which must occur prior to execution) or the unloading of the module from RAM and written back to the hard drive. Summary - BugCheck 139, {3, fffff98470925980, fffff984709258d8, 0} Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE ) ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨`` BugCheck C2, {d, ffff9e8ca537ead8, ffff9e8c, 19acf420486f9129} Probably caused by : NETIO.SYS ( NETIO!NetioFreeMdl+28225 ) ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨`` BugCheck C2, {d, ffffe700144465b8, ffffe700, c3275eaade03b256} Probably caused by : NETIO.SYS ( NETIO!NetioFreeMdl+28225 ) ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨`` BugCheck 1E, {ffffffffc0000005, fffff80241bc7be7, ffff8d0ce3c35ec8, ffff8d0ce3c35710} Probably caused by : NETIO.SYS ( NETIO!PplGenericAllocateFunction+1c ) ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨`` BugCheck C2, {d, ffffcc0f30f39378, ffffcc0f, c19326b543a35f6d} Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE ) ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨`` Malwarebytes itself was listed as the probable cause in 2 of the dumps. Please be sure that you have the most recent version of MBAM installed. Your Intel(R) I211 Gigabit Network Connection driver was mentioned in one dump. I know that it appears to be rather new, but please check for an update - e1r68x64.sys Thu May 23 21:02:52 2019 (5CE76CEC) http://downloadcenter.intel.com/ Run Driver Verifier - https://www.sysnative.com/forums/threads/driver-verifier-bsod-related-windows-10-8-1-8-7-vista.29/ It must run in the background for at least 24 hours minimum. Run memtest86+ - one stick at a time and alternate the slots - https://www.sysnative.com/forums/threads/test-ram-with-memtest-org-memtest86.24316/ Just for clarification purposes - you did reinstall Windows after the hardware changes? Was it a copy of Windows that came with the system or did you buy it (full retail edition)? Regards. . . jcgriff2 Loading Dump File [C:\Users\PalmDesert\_jcgriff2_\dbug\__Kernel__\091019-13406-01.dmp] *** WARNING: Unable to verify timestamp for Unknown_Module_00000000`00000000 Debug session time: Tue Sep 10 21:24:36.330 2019 (UTC - 4:00) System Uptime: 0 days 1:00:23.952 *** WARNING: Unable to verify timestamp for Unknown_Module_00000000`00000000 *** WARNING: Unable to verify timestamp for Unknown_Module_00000000`00000000 Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE ) BUGCHECK_STR: 0x139 DEFAULT_BUCKET_ID: CORRUPT_MODULELIST_0x139 FAILURE_BUCKET_ID: CORRUPT_MODULELIST_0x139 Bugcheck code 00000139 Arguments 00000000`00000003 fffff984`70925980 fffff984`709258d8 00000000`00000000 ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨`` Loading Dump File [C:\Users\PalmDesert\_jcgriff2_\dbug\__Kernel__\091019-13812-01.dmp] Built by: 18362.1.amd64fre.19h1_release.190318-1202 Debug session time: Tue Sep 10 20:22:56.097 2019 (UTC - 4:00) System Uptime: 0 days 9:46:12.720 *** WARNING: Unable to verify timestamp for mwac.sys *** ERROR: Module load completed but symbols could not be loaded for mwac.sys Probably caused by : NETIO.SYS ( NETIO!NetioFreeMdl+28225 ) BUGCHECK_STR: 0xc2_d DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT PROCESS_NAME: MBAMService.exe FAILURE_BUCKET_ID: 0xc2_d_NETIO!NetioFreeMdl Bugcheck code 000000C2 Arguments 00000000`0000000d ffff9e8c`a537ead8 00000000`ffff9e8c 19acf420`486f9129 ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨`` Loading Dump File [C:\Users\PalmDesert\_jcgriff2_\dbug\__Kernel__\091119-13375-01.dmp] Built by: 18362.1.amd64fre.19h1_release.190318-1202 Debug session time: Wed Sep 11 16:30:42.680 2019 (UTC - 4:00) System Uptime: 0 days 5:45:09.303 *** WARNING: Unable to verify timestamp for mwac.sys *** ERROR: Module load completed but symbols could not be loaded for mwac.sys Probably caused by : NETIO.SYS ( NETIO!NetioFreeMdl+28225 ) BUGCHECK_STR: 0xc2_d DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT PROCESS_NAME: MBAMService.exe FAILURE_BUCKET_ID: 0xc2_d_NETIO!NetioFreeMdl Bugcheck code 000000C2 Arguments 00000000`0000000d ffffe700`144465b8 00000000`ffffe700 c3275eaa`de03b256 ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨`` Loading Dump File [C:\Users\PalmDesert\_jcgriff2_\dbug\__Kernel__\091119-13562-01.dmp] Built by: 18362.1.amd64fre.19h1_release.190318-1202 Debug session time: Wed Sep 11 10:30:16.440 2019 (UTC - 4:00) System Uptime: 0 days 13:04:47.062 *** WARNING: Unable to verify timestamp for e1r68x64.sys *** ERROR: Module load completed but symbols could not be loaded for e1r68x64.sys *** WARNING: Unable to verify timestamp for win32k.sys *** ERROR: Module load completed but symbols could not be loaded for win32k.sys Probably caused by : NETIO.SYS ( NETIO!PplGenericAllocateFunction+1c ) BUGCHECK_STR: 0x1E_c0000005 DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT PROCESS_NAME: System FAILURE_BUCKET_ID: 0x1E_c0000005_NETIO!PplGenericAllocateFunction Bugcheck code 0000001E Arguments ffffffff`c0000005 fffff802`41bc7be7 ffff8d0c`e3c35ec8 ffff8d0c`e3c35710 ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨`` Loading Dump File [C:\Users\PalmDesert\_jcgriff2_\dbug\__Kernel__\090719-13296-01.dmp] *** WARNING: Unable to verify timestamp for Unknown_Module_00000000`00000000 Debug session time: Sat Sep 7 13:12:04.963 2019 (UTC - 4:00) System Uptime: 0 days 1:51:12.585 *** WARNING: Unable to verify timestamp for Unknown_Module_00000000`00000000 *** WARNING: Unable to verify timestamp for Unknown_Module_00000000`00000000 Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE ) BUGCHECK_STR: 0xc2_d DEFAULT_BUCKET_ID: CORRUPT_MODULELIST_0xc2_d FAILURE_BUCKET_ID: CORRUPT_MODULELIST_0xc2_d Bugcheck code 000000C2 Arguments 00000000`0000000d ffffcc0f`30f39378 00000000`ffffcc0f c19326b5`43a35f6d ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
  6. Hi. . . I am a BSOD Analyst and there are no dumps in your zip file. I am not a hardware expert, either. I sit on the software/app side of the fence. All that I can advise you to do is to run tests for RAM and hard drive as I do believe that unknown hardware failure is occurring. RAM - memtest86+ - run 1 stick at a time; alternate the slots - https://www.sysnative.com/forums/hardware-tutorials/3909-test-ram-memtest86.html HDD - SeaTools for DOS, LONG test - https://www.sysnative.com/forums/hardware-tutorials/4072-hard-drive-hdd-diagnostics-sea-tools-dos-ssd-test.html Regards. . . jcgriff2
  7. Hi. . . Please run the BSOD Posting Instructions - The resulting zip file will contain the mini-kernel memory dumps + about 25 system related files. Once I have the dumps specifically, I can process them and hopefully they will yield a clue. With all this new hardware - are your hard drives new? Did you reinstall Windows after the hardware changes, or did you just take the old hard drives from the old system, put them in the new system and boot-up? If you did not reinstall Windows, you must do so because of the new hardware. Also, you must own a "full retail" copy of Windows because if the version of Windows on your old system came with the system, that copy of Windows cannot be used on the new system. Please run the BSOD Posting Instructions and in the interim, test your hard drives with SeaTools for DOS (LONG Test) because off the top of my head, it sure sounds like there is a hard drive issue given the never-ending churning of your drives. https://www.sysnative.com/forums/threads/hard-drive-hdd-diagnostics-sea-tools-for-dos-ssd-test.4072/ Regards. . . jcgriff2
  8. Hi. . . @bsodeath My apologies for the late reply. Almost always, when critical Windows system services and Windows executables die suddenly without explanation, a hard drive is involved. What typically happens is that during Superfetch/Prefetch or paging operations, kernel data from the hard drive gets loaded into RAM and during this process corruption occurs; the system service or Windows executable suddenly dies. Run Hard Drive diagnostics on ALL drives connected to the system, even if one or more is a simple USB stick. Run SeaTools for DOS, LONG test - https://www.sysnative.com/forums/threads/hard-drive-hdd-diagnostics-sea-tools-for-dos-ssd-test.4072/ Regards. . . jcgriff2
  9. Hi. . . Be sure to update your MBAM installation to the most recent version. Regards. . . jcgriff2
  10. Hi again. . . Would you please run through our BSOD Posting Instructions? The output may yield some clues. Regards. . . jcgriff2
  11. Are you in fact running the most recent version of MBAM? I would suggest that you install the current available version to be certain - https://www.malwarebytes.com/ Regards. .. jcgriff2
  12. Hi. . . I ran all 6 dumps and the cause of the BSODs is in fact Malwarebytes. MBAMSwissArmy MBAMSwissArmy.sys Wed Jul 29 00:26:01 2015 (55B855D9) As you can see the driver is from 2015. I'm also finding other MBAM drivers dated 2015. When is the last time that you updated your Malwarebytes installation? I suggest that you update it now - https://www.malwarebytes.com/ Regards. . . jcgriff2 Loading Dump File [C:\Users\PalmDesert\_jcgriff2_\dbug\__Kernel__\032019-26140-01.dmp] Built by: 17763.1.amd64fre.rs5_release.180914-1434 Debug session time: Wed Mar 20 02:33:32.528 2019 (UTC - 4:00) System Uptime: 0 days 0:03:12.744 *** WARNING: Unable to verify timestamp for MBAMSwissArmy.sys *** ERROR: Module load completed but symbols could not be loaded for MBAMSwissArmy.sys Probably caused by : MBAMSwissArmy.sys ( MBAMSwissArmy+ce90 ) DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT BUGCHECK_STR: AV PROCESS_NAME: mbam.exe FAILURE_BUCKET_ID: AV_R_INVALID_MBAMSwissArmy!unknown_function Bugcheck code 00000050 Arguments ffff8184`7b66f000 00000000`00000000 fffff806`3ad0ce90 00000000`00000000 BiosVersion = 1.51116.218 BiosReleaseDate = 03/09/2015 SystemManufacturer = Microsoft Corporation SystemProductName = Surface 3 MaxSpeed: 1600 CurrentSpeed: 1600 ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨`` Loading Dump File [C:\Users\PalmDesert\_jcgriff2_\dbug\__Kernel__\032019-32296-01.dmp] Built by: 17763.1.amd64fre.rs5_release.180914-1434 Debug session time: Wed Mar 20 02:27:25.923 2019 (UTC - 4:00) System Uptime: 2 days 20:51:47.840 *** WARNING: Unable to verify timestamp for MBAMSwissArmy.sys *** ERROR: Module load completed but symbols could not be loaded for MBAMSwissArmy.sys Probably caused by : MBAMSwissArmy.sys ( MBAMSwissArmy+ce90 ) DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT BUGCHECK_STR: AV PROCESS_NAME: mbam.exe FAILURE_BUCKET_ID: AV_R_INVALID_MBAMSwissArmy!unknown_function Bugcheck code 00000050 Arguments ffffa406`33e6f000 00000000`00000000 fffff807`6434ce90 00000000`00000000 BiosVersion = 1.51116.218 BiosReleaseDate = 03/09/2015 SystemManufacturer = Microsoft Corporation SystemProductName = Surface 3 MaxSpeed: 1600 CurrentSpeed: 1600 ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨`` Loading Dump File [C:\Users\PalmDesert\_jcgriff2_\dbug\__Kernel__\033119-13375-01.dmp] Built by: 17763.1.amd64fre.rs5_release.180914-1434 Debug session time: Sun Mar 31 16:18:39.365 2019 (UTC - 4:00) System Uptime: 0 days 0:04:48.655 *** WARNING: Unable to verify timestamp for MBAMSwissArmy.sys *** ERROR: Module load completed but symbols could not be loaded for MBAMSwissArmy.sys Probably caused by : MBAMSwissArmy.sys ( MBAMSwissArmy+ce90 ) DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT BUGCHECK_STR: AV PROCESS_NAME: mbam.exe FAILURE_BUCKET_ID: AV_R_INVALID_MBAMSwissArmy!unknown_function Bugcheck code 00000050 Arguments ffffae0a`13c6f000 00000000`00000000 fffff805`10e3ce90 00000000`00000000 BiosVersion = 1.51116.218 BiosReleaseDate = 03/09/2015 SystemManufacturer = Microsoft Corporation SystemProductName = Surface 3 MaxSpeed: 1600 CurrentSpeed: 1600 ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨`` Loading Dump File [C:\Users\PalmDesert\_jcgriff2_\dbug\__Kernel__\033119-15562-01.dmp] Built by: 17763.1.amd64fre.rs5_release.180914-1434 Debug session time: Sun Mar 31 16:13:02.162 2019 (UTC - 4:00) System Uptime: 0 days 0:01:42.451 *** WARNING: Unable to verify timestamp for MBAMSwissArmy.sys *** ERROR: Module load completed but symbols could not be loaded for MBAMSwissArmy.sys Probably caused by : MBAMSwissArmy.sys ( MBAMSwissArmy+ce90 ) DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT BUGCHECK_STR: AV PROCESS_NAME: mbam.exe FAILURE_BUCKET_ID: AV_R_INVALID_MBAMSwissArmy!unknown_function Bugcheck code 00000050 Arguments ffff9506`1366f000 00000000`00000000 fffff805`4f88ce90 00000000`00000000 BiosVersion = 1.51116.218 BiosReleaseDate = 03/09/2015 SystemManufacturer = Microsoft Corporation SystemProductName = Surface 3 MaxSpeed: 1600 CurrentSpeed: 1600 ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨`` Loading Dump File [C:\Users\PalmDesert\_jcgriff2_\dbug\__Kernel__\033119-26046-01.dmp] Built by: 17763.1.amd64fre.rs5_release.180914-1434 Debug session time: Sun Mar 31 17:04:51.699 2019 (UTC - 4:00) System Uptime: 0 days 0:04:33.918 *** WARNING: Unable to verify timestamp for MBAMSwissArmy.sys *** ERROR: Module load completed but symbols could not be loaded for MBAMSwissArmy.sys Probably caused by : MBAMSwissArmy.sys ( MBAMSwissArmy+ce90 ) DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT BUGCHECK_STR: AV PROCESS_NAME: mbam.exe FAILURE_BUCKET_ID: AV_R_INVALID_MBAMSwissArmy!unknown_function Bugcheck code 00000050 Arguments ffffd98b`3886f000 00000000`00000000 fffff801`58ffce90 00000000`00000000 BiosVersion = 1.51116.218 BiosReleaseDate = 03/09/2015 SystemManufacturer = Microsoft Corporation SystemProductName = Surface 3 MaxSpeed: 1600 CurrentSpeed: 1600 ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨`` Loading Dump File [C:\Users\PalmDesert\_jcgriff2_\dbug\__Kernel__\032019-22796-01.dmp] Built by: 17763.1.amd64fre.rs5_release.180914-1434 Debug session time: Wed Mar 20 02:42:54.544 2019 (UTC - 4:00) System Uptime: 0 days 0:01:32.653 *** WARNING: Unable to verify timestamp for MBAMSwissArmy.sys *** ERROR: Module load completed but symbols could not be loaded for MBAMSwissArmy.sys Probably caused by : MBAMSwissArmy.sys ( MBAMSwissArmy+ce90 ) DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT BUGCHECK_STR: AV PROCESS_NAME: mbam.exe FAILURE_BUCKET_ID: AV_R_INVALID_MBAMSwissArmy!unknown_function Bugcheck code 00000050 Arguments ffffcb8f`8c06f000 00000000`00000000 fffff801`7711ce90 00000000`00000000 BiosVersion = 1.51116.218 BiosReleaseDate = 03/09/2015 SystemManufacturer = Microsoft Corporation SystemProductName = Surface 3 MaxSpeed: 1600 CurrentSpeed: 1600 ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
  13. Turn Driver Verifier off. The fact that Driver Verifier did not BSOD your system means that more than likely, the cause of your BSODs is unknown hardware failure. Driver Verifier ran, stress-tested all of your 3rd party drivers and found no problems or issues with them. Regards. . . jcgriff2
  14. Take the chance so that you can remove the [likely] one bad RAM stick. Be careful when handling RAM. Touch some metal first to drain any electric shock out of yourself.
  15. Hi. . . I am assisting usasma until his eyesight recovers. I re-ran the original dump and did in fact see the 0x3b bugcheck (system service threw an exception); the exception error code is - 0xc0000094 - Integer division by zero -- meaning that a variable in ntfs.sys attempted to divide a number by zero, which is illegal. I assume that ntfs.sys was involved (as was NT - the Windows kernel) because it is the last driver identified on the stack (scroll to right - you'll see ntfs.sys about 3/4 of the way across starting on the 9th line down - # Child-SP RetAddr : Args to Child : Call Site 00 fffff108`9bb0e5a8 fffff804`42a60c69 : 00000000`0000003b 00000000`c0000094 fffff809`272f39c0 fffff108`9bb0eee0 : nt!KeBugCheckEx 01 fffff108`9bb0e5b0 fffff804`42a600bc : fffff108`9bb0f698 fffff108`9bb0eee0 fffff108`9bb0f698 00000000`00000000 : nt!KiBugCheckDispatch+0x69 02 fffff108`9bb0e6f0 fffff804`42a57f2f : fffff804`42d7f000 fffff804`4289c000 0005be48`00a6f000 00000000`00000000 : nt!KiSystemServiceHandler+0x7c 03 fffff108`9bb0e730 fffff804`428c2b20 : fffff108`9bb0ed80 00000000`00000000 fffff108`9bb0eca0 fffff804`42c35ce8 : nt!RtlpExecuteHandlerForException+0xf 04 fffff108`9bb0e760 fffff804`42907e74 : fffff108`9bb0f698 fffff108`9bb0f3e0 fffff108`9bb0f698 00000000`000047f0 : nt!RtlDispatchException+0x430 05 fffff108`9bb0eeb0 fffff804`42a60d42 : fffff108`9bb0f880 fffff108`9bb0f6b0 00000000`00000200 fffff108`9bb0f720 : nt!KiDispatchException+0x144 06 fffff108`9bb0f560 fffff804`42a59def : ffffe105`bddb8db0 fffff804`00000000 00000000`00000001 00000000`00000001 : nt!KiExceptionDispatch+0xc2 07 fffff108`9bb0f740 fffff809`272f39c0 : ffffe105`cdbe69a8 ffffe105`bdd6cf70 00000000`00012000 00000000`00000000 : nt!KiDivideErrorFault+0x2ef (TrapFrame @ fffff108`9bb0f740) 08 fffff108`9bb0f8d0 fffff809`272f342e : ffffe105`cdbe69a8 00000000`00000000 fffff108`9bb0fa90 ffff8100`00001000 : Ntfs!NtfsAllocateRecord+0x3e4 09 fffff108`9bb0fa30 fffff809`272f089b : ffffe105`cdbe69a8 ffffe105`bddbb180 ffffe105`c167f010 ffff0000`cdbe69a8 : Ntfs!NtfsAllocateMftRecord+0xba 0a fffff108`9bb0fb10 fffff809`2733097a : 00000000`00000400 00000000`00000008 ffffe105`cdbe69a8 ffffe105`cea05010 : Ntfs!NtfsCreateNewFile+0x7bb 0b fffff108`9bb0fea0 fffff809`27333e1d : ffffe105`cea05010 fffff108`9bb10170 ffffe105`cea05010 00000000`00000000 : Ntfs!NtfsCommonCreate+0x1bfa 0c fffff108`9bb10090 fffff804`429540d9 : ffffe105`bddbb030 ffffe105`cea05010 ffffe105`6d34f000 ffffe105`c04b1550 : Ntfs!NtfsFsdCreate+0x1cd 0d fffff108`9bb102f0 fffff809`26406219 : ffffe105`cea05010 ffffe105`c04b1550 ffffe105`cea057a0 ffffe105`6ff47ab0 : nt!IofCallDriver+0x59 0e fffff108`9bb10330 fffff809`2643d559 : fffff108`9bb103e0 ffffe105`c04b1550 00000000`000000c0 00000000`00000000 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x289 0f fffff108`9bb103a0 fffff804`429540d9 : ffffe105`c04b1500 ffffe105`cdb61010 00000000`00000000 fffff108`00000030 : FLTMGR!FltpCreate+0x2f9 10 fffff108`9bb10450 fffff804`429554b4 : ffffe105`6d80e470 00000000`00000000 ffffe105`c8b4e6f0 fffff804`42ac49d2 : nt!IofCallDriver+0x59 11 fffff108`9bb10490 fffff804`42f10d92 : 00000000`00000005 ffffe105`cdb61010 00000000`00000005 ffffe105`bdd9c840 : nt!IoCallDriverWithTracing+0x34 12 fffff108`9bb104e0 fffff804`42f35fb9 : ffffe105`bdd9c840 ffffe105`bdd9c800 ffffe105`c167f010 ffff8100`5b5c0b01 : nt!IopParseDevice+0x632 13 fffff108`9bb10650 fffff804`42f345bf : ffffe105`c167f000 fffff108`9bb108b8 ffffe105`00000040 ffffe105`604f3a60 : nt!ObpLookupObjectName+0x719 14 fffff108`9bb10820 fffff804`42e8a924 : 00000000`00000001 00000000`00000000 00000000`00000000 00000000`00000028 : nt!ObOpenObjectByNameEx+0x1df 15 fffff108`9bb10960 fffff804`42e8a509 : 00000069`1ab7d568 00000000`00000000 00000069`1ab7d850 00000069`1ab7d6d0 : nt!IopCreateFile+0x404 16 fffff108`9bb10a00 fffff804`42a60685 : 00000000`00000000 00000069`1ab7d6d0 00000069`1ab7d780 00000000`00000004 : nt!NtCreateFile+0x79 17 fffff108`9bb10a90 00007ffe`01a80114 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25 (TrapFrame @ fffff108`9bb10b00) 18 00000069`1ab7d4c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffe`01a80114 A stack is read from the bottom --> up So we see "NT", which is the Windows kernel doing some operations, then we see fltmgr.sys, which is a Microsoft File System Filter Manager driver followed by ntfs.sys, which is a Microsoft NT File System driver then we see "NT" again. Microsoft drivers are considered sacrosanct and 99.9% of the time are never the cause of a BSOD. When a Microsoft driver is named, unknown hardware failure is the likely cause. But let's stay with software for the moment and I'd like for you to run Driver Verifier - https://www.sysnative.com/forums/threads/driver-verifier-bsod-related-windows-10-8-1-8-7-vista.29/ Allow Driver Verifier to run in the background (you can continue to use your system), but save work/files very often because if Driver Verifier detects a driver violation, it will BSOD your system immediately. If you get a VERIFIER_ENABLED BSOD, please get the dump from \windows\minidump (file name = the date); copy it out to Documents or Desktop, zip it up and attach to your next post. Windows will not allow you to zip files in the \windows directory itself. You mentioned in your last post that you experienced another BSOD. Please get the dump for that BSOD and attach the zip file to your next post. If easier, you can just re-run the jcgriff2/Sysnative app from step #1 - .... and attach the output zip file like you did in post #1. Regards. . . jcgriff2
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.