Jump to content

usasma

BSOD Kernel Dump Expert
  • Content count

    370
  • Joined

  • Last visited

1 Follower

About usasma

  • Rank
    BSOD Kernel Dump Expert

Contact Methods

  • Website URL
    http://www.carrona.org/

Profile Information

  • Location
    At home in front of my computer
  • Interests
    Computers - naturally! :0)

Recent Profile Visitors

5,497 profile views
  1. Uninstall the VB Audio VoiceMeeter program. You can reinstall it once we've found the problem. If the BSOD's continue after it's uninstalled, please run Driver Verifier according to these instructions: http://www.carrona.org/verifier.html Analysis: The following is for information purposes only. The following information contains the relevant information from the blue screen analysis: **************************Sat May 19 03:16:57.388 2018 (UTC - 4:00)************************** Loading Dump File [C:\Users\john\SysnativeBSODApps\051918-29375-01.dmp] Windows 10 Kernel Version 16299 MP (6 procs) Free x64 Built by: 16299.431.amd64fre.rs3_release_svc_escrow.180502-1908 System Uptime:0 days 23:13:02.158 Probably caused by :memory_corruption BugCheck 50, {ffffafe3ac2b11cc, 10, ffffafe3ac2b11cc, 2} BugCheck Info: PAGE_FAULT_IN_NONPAGED_AREA (50) Arguments: Arg1: ffffafe3ac2b11cc, memory referenced. Arg2: 0000000000000010, value 0 = read operation, 1 = write operation. Arg3: ffffafe3ac2b11cc, If non-zero, the instruction address which referenced the bad memory address. Arg4: 0000000000000002, (reserved) BUGCHECK_STR: AV DEFAULT_BUCKET_ID: CODE_CORRUPTION PROCESS_NAME: voicemeeterpro.exe FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE BIOS Version V22.4 BIOS Release Date 12/21/2015 Manufacturer MSI Product Name MS-7693 Baseboard Product 970 GAMING (MS-7693) ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨`` 3rd Party Drivers: The following is for information purposes only. My recommendations were given above. The drivers that follow belong to software or devices that were not developed by Microsoft. You can find links to the driver information and where to update the drivers in the section after the code box: **************************Sat May 19 03:16:57.388 2018 (UTC - 4:00)************************** MpKslb41cf12b.sys Mon Feb 27 20:54:41 1989 (2409FBE1) vbaudio_vmvaio64_win7.sys Mon Apr 21 05:05:09 2014 (5354DF45) vbaudio_vmauxvaio64_win7.sys Sun Jul 6 03:56:06 2014 (53B90116) SteamStreamingSpeakers.sys Thu Jul 20 20:56:15 2017 (5971512F) SteamStreamingMicrophone.sys Fri Jul 28 11:33:15 2017 (597B593B) e2xw10x64.sys Thu Aug 31 17:11:04 2017 (59A87B68) YSDDR0.sys Wed Oct 11 01:50:25 2017 (59DDB121) YSDrv.sys Wed Oct 11 03:00:25 2017 (59DDC189) YSR0.sys Wed Oct 11 03:02:05 2017 (59DDC1ED) nvvad64v.sys Thu Dec 14 00:40:29 2017 (5A320ECD) nvhda64v.sys Fri Dec 15 03:17:43 2017 (5A338527) RfeCo10X64.sys Fri Jan 5 11:16:02 2018 (5A4FA4C2) NvStreamKms.sys Mon Mar 5 01:17:15 2018 (5A9CE0EB) nvlddmkm.sys Fri Mar 23 19:02:22 2018 (5AB5877E) xusb22.sys ***** Invalid 2002 Invalid 2002 Invalid MpKslb41cf12b.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed. http://www.carrona.org/drivers/driver.php?id=vbaudio_vmvaio64_win7.sys vbaudio_vmauxvaio64_win7.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed. SteamStreamingSpeakers.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed. SteamStreamingMicrophone.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed. http://www.carrona.org/drivers/driver.php?id=e2xw10x64.sys YSDDR0.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed. YSDrv.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed. YSR0.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed. http://www.carrona.org/drivers/driver.php?id=nvvad64v.sys http://www.carrona.org/drivers/driver.php?id=nvhda64v.sys RfeCo10X64.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed. http://www.carrona.org/drivers/driver.php?id=NvStreamKms.sys http://www.carrona.org/drivers/driver.php?id=nvlddmkm.sys http://www.carrona.org/drivers/driver.php?id=xusb22.sys
  2. Often the damage caused by malware isn't seen until you start trying to repair it. Today at work I removed malware from a computer and then proceeded to perform some standard Windows fixes. When I rebooted - I got the same problem that you had - except my black screen didn't have the cursor. It was just black. The easiest "repair" is reverting to a previous System Restore Point. You can do this even if you can't boot to Windows - by using a bootable USB drive with Windows 10 on it (you can get that by using the Media Creation Tool for free from here: https://www.microsoft.com/en-us/software-download/windows10 Beyond that, here's what I suggest: NOTE: Try a clean boot to see if the problem clears up that way: http://www.thewindowsclub.com/what-is-clean-boot-state-in-windows If it does, then different troubleshooting steps are called for. Here's some repair/recovery/restore options (in this order). Be sure to backup your stuff if you don't want to take the chance of losing it.: 1 - Startup Repair. Run it 3 times, rebooting in between tries. 2 - System Restore to a point before this started happening. 3 - DISM/SFC repair (DISM doesn't work with W7, although SFC does) - doesn't work if you're not able to boot to Windows (let me know and I'll post a way to do it from Startup Repair) I will post the offline version after these steps. Then please run the following DISM commands to see if there's any problems with the system (from an elevated (Run as administrator) Command Prompt). Press Enter after typing it: Dism /Online /Cleanup-Image /RestoreHealth FYI - I have repaired systems using the last command even though problems weren't found with the first 2 - so I suggest running them all. From this article: http://technet.microsoft.com/en-us/library/hh824869.aspx You can also run sfc.exe /scannow from an elevated (Run as administrator) Command Prompt to check for further corruption. Include the CBS log (located at C:\Windows\Logs\CBS\CBS.log) if you'd like to have a Windows Update expert check it (I don't check them because I can't read them) 4 - RESET using the "Keep My Files" option (W8 calls this a REFRESH; W7 and earlier doesn't have this function) 5 - Repair install of the OS (Thanks to FreeBooter!): "How To Perform a Repair Installation For Windows 8, 8.1 and 10" https://www.winhelp.us/non-destructive-reinstall-of-windows-8-and-8-1.html "How to Do a Repair Install to Fix Windows 7" http://www.sevenforums.com/tutorials/3413-repair-install.html "How To Perform a Repair Installation For Vista" http://www.vistax64.com/tutorials/88236-repair-install-vista.html "Non-destructive reinstall of Windows XP" https://www.winhelp.us/non-destructive-reinstall-of-windows-xp.html 6 - RESET using the "Remove Everything" option (W8 calls this a RESET; W7 and earlier doesn't have this function) If using W7 or earlier, this can be accomplished by resetting the system by use of the recovery partition/recovery disks/recovery drive. If you don't have them, you can usually order them from the OEM manufacturer of your system ( US points of contact here: http://www.carrona.org/recdisc.html ) 7 - Wipe and reinstall from the Recovery Partition (if so equipped) 8 - Wipe and reinstall from Recovery Media - to include deleting all partitions. If you don't have them, you can usually order them from the OEM manufacturer of your system ( US points of contact here: http://www.carrona.org/recdisc.html ) You can also download W7/8.1/10 from Microsoft starting on this page: https://www.microsoft.com/en-us/software-download/ 9 - A clean install of Windows. This is a troubleshooting tool - and as such is slightly different from the previous steps. In short, if it fixes the problem, then the problem was in the software. If it doesn't fix the problem, then the problem is most likely in the hardware. A clean install is: - Windows is installed to a freshly partitioned hard drive with legitimate installation media (W10: https://www.microsoft.com/en-us/software-download/windows10 ). - The installation media is only a copy of Windows, not the OEM recovery disks that you can make on some systems. - Windows is fully updated after it's installed. That's ALL updates - none excepted. - NO 3rd party software is installed. - There are no errors in Device Manager (if you find any, post back for suggestions). This will wipe everything off of the computer, so it's advisable to backup your stuff first. Also, it will wipe out all the special software that the OEM added to the system, so if you rely on any of that - let us know what it is so we can figure out a way to save/download it (the easiest way is to create/obtain the OEM;s recovery media) If unable to find recovery media that has the software (or if you suspect that this is a hardware problem), you can make an image of your system that'll preserve everything in the state that it was in when you made the image. One drawback to this is that you're making an image of a malfunctioning system - so, if there are errors in the system software, you'll have a nice copy of them Another drawback is that the image of the system will be very large - so you'll most likely need a large external drive to store it on. But, this will allow you to save everything on the hard drive (although you'll need an image viewer to get things out of the image). The point here is that, if it's a hardware problem, then you can restore the system to the point it was when you made the image - after you repair the hardware problem. You can obtain more info on imaging in the Backup/Imaging/DiskMgmt forums located here: http://www.bleepingcomputer.com/forums/f/238/backup-imaging-and-disk-management-software/ The point of doing this (the clean install) is to: - rule out Windows as a problem (if the problem continues, it's not a Windows problem as you completely replaced Windows - rule out 3rd party software (if the problem continues, it's not a 3rd party software problem as you didn't install any 3rd party software) - so, if the problem continues, it must be a hardware problem. OTOH, if the problem stops, then it was either a Windows or 3rd party software problem. If the problem doesn't come back, then you've fixed it. Then all that remains is setting the computer back up the way that you'd like it and importing your data from the backup you made. OFFLINE DISM: DISM /Online should only be used when running from within Windows. Run this command instead: Dism /Image:C:\ /Cleanup-Image /RestoreHealth Did you also try doing SFC scan while booting off of Recovery Environment or Install Disk? In those cases, the commands are slightly different: sfc.exe /scannow /offbootdir=c:\ /offwindir=c:\windows
  3. If the D: drive is a separate physical drive from the C: drive - then you can unplug the D: drive and see if the system works normally or, you can rename the folders that you want to delete - and see if the system works without them
  4. Usually there is a Windows.old folder in the root (C:\) that contains those files you can also run cleanmgr.exe from the Run dialog - then select “Clean up system files”
  5. Here's some repair/recovery/restore options (in this order). Be sure to backup your stuff if you don't want to take the chance of losing it.: 1 - Startup Repair. Run it 3 times, rebooting in between tries. 2 - System Restore to a point before this started happening. 3 - DISM/SFC repair (DISM doesn't work with W7, although SFC does) - doesn't work if you're not able to boot to Windows (let me know and I'll post a way to do it from Startup Repair) 4 - RESET using the "Keep My Files" option (W8 calls this a REFRESH; W7 and earlier doesn't have this function) 5 - Repair install of the OS (Thanks to FreeBooter!): "How To Perform a Repair Installation For Windows 8, 8.1 and 10" https://www.winhelp.us/non-destructive-reinstall-of-windows-8-and-8-1.html 6 - RESET using the "Remove Everything" option (W8 calls this a RESET; W7 and earlier doesn't have this function) If using W7 or earlier, this can be accomplished by resetting the system by use of the recovery partition/recovery disks/recovery drive. If you don't have them, you can usually order them from the OEM manufacturer of your system ( US points of contact here: http://www.carrona.org/recdisc.html ) 7 - Wipe and reinstall from the Recovery Partition (if so equipped) 8 - Wipe and reinstall from Recovery Media - to include deleting all partitions. If you don't have them, you can usually order them from the OEM manufacturer of your system ( US points of contact here: http://www.carrona.org/recdisc.html ) You can also download W7/8.1/10 from Microsoft starting on this page: https://www.microsoft.com/en-us/software-download/ 9 - A clean install of Windows. This is a troubleshooting tool - and as such is slightly different from the previous steps. In short, if it fixes the problem, then the problem was in the software. If it doesn't fix the problem, then the problem is most likely in the hardware. A clean install is: - Windows is installed to a freshly partitioned hard drive with legitimate installation media (W10: https://www.microsoft.com/en-us/software-download/windows10 ). - The installation media is only a copy of Windows, not the OEM recovery disks that you can make on some systems. - Windows is fully updated after it's installed. That's ALL updates - none excepted. - NO 3rd party software is installed. - There are no errors in Device Manager (if you find any, post back for suggestions). This will wipe everything off of the computer, so it's advisable to backup your stuff first. Also, it will wipe out all the special software that the OEM added to the system, so if you rely on any of that - let us know what it is so we can figure out a way to save/download it (the easiest way is to create/obtain the OEM;s recovery media) If unable to find recovery media that has the software (or if you suspect that this is a hardware problem), you can make an image of your system that'll preserve everything in the state that it was in when you made the image. One drawback to this is that you're making an image of a malfunctioning system - so, if there are errors in the system software, you'll have a nice copy of them :( Another drawback is that the image of the system will be very large - so you'll most likely need a large external drive to store it on. But, this will allow you to save everything on the hard drive (although you'll need an image viewer to get things out of the image). The point here is that, if it's a hardware problem, then you can restore the system to the point it was when you made the image - after you repair the hardware problem. You can obtain more info on imaging in the Backup/Imaging/DiskMgmt forums located here: http://www.bleepingcomputer.com/forums/f/238/backup-imaging-and-disk-management-software/ The point of doing this (the clean install) is to: - rule out Windows as a problem (if the problem continues, it's not a Windows problem as you completely replaced Windows - rule out 3rd party software (if the problem continues, it's not a 3rd party software problem as you didn't install any 3rd party software) - so, if the problem continues, it must be a hardware problem. OTOH, if the problem stops, then it was either a Windows or 3rd party software problem. If the problem doesn't come back, then you've fixed it. Then all that remains is setting the computer back up the way that you'd like it and importing your data from the backup you made.
  6. usasma

    BSOD 0x0000012b

    Zip up and upload the mini dump from C:/Windows/Minidump What were the results of the hardware diagnostics? Please run Druver Verifier according to these instructions: http://www.carrona.org/verifier.html
  7. usasma

    BSOD 0x0000012b

    Any results from the hardware diagnostics? If so, what were they? Here's a list of the tests that I suggested: Although you appear to have a reasonable number of Windows Update hotfixes for this version of your OS, please double check for any new Windows Updates. It only takes one update to cause a problem, so it's essential that you have all of them. The actual number is not important. Rather it's important that you checked manually, installed any available updates, and didn't experience any errors when checking or updating. You only have 1,259 MB of available Physical Memory (RAM). Please get more memory if the system is able to handle it. While waiting to upgrade the memory, please: - only use one program at a time - go through your startup items and stop those that aren't essential from loading with Windows From the MSINFO32 report - Earlier on the 6th you also had a BSOD due to your Atheros wireless driver (athw8x.sys) Please: - download a fresh copy of the latest, W10 compatible wireless driver from the HP support website for your mode. If there isn't a W10 driver, then try the Windows 8.1 driver package or the Windows 8 package. There is no guarantee that this'll work - but it's the best that we have right now. - then uninstall the current software (through Settings...Apps or appwiz.cpl) - install the freshly downloaded driver - go to Windows Update and let it search for updates to the drivers. If it finds them, let it install them (the system currently has a driver dating from 2016 - so it's likely W10 compatible). - test for further BSOD's Good luck!
  8. usasma

    BSOD 0x0000012b

    Obviously didn't get to the zip file last night - sorry about that. I'm a bit under the weather and collapsed when we got home. I'm off to work right now, but will try to get to it this afternoon after work. Meanwhile, we wait for the next BSOD and see what happens. If the hardware diagnostics pass, then run Driver Verifier if the system BSOD's again.
  9. usasma

    BSOD 0x0000012b

    Update drivers by finding the program that installed them - then download the latest version from the developer and install that. If you can’t find a current version, uninstall the program (you can always reinstall it later on) I'm out for dinner. Will try toget to the zip file later tonight The SgrmAgent.sys driver is OK. No need to update it. Thanks for the screenshot! See if there’s aBIOS update for W8 or 8.1. You can install them in W10. Since HP doesn’t offer W10 drivers, that means it won’t support W10 on your system. This means that if you get compatibility problems - you may not be able to fix them
  10. usasma

    BSOD 0x0000012b

    Please continue with the hardware diagnostics. Once you've finished the hardware diagnostics (if they don't show anything and the BSOD's are continuing), then please try running Driver Verifier according to these instructions: http://www.carrona.org/verifier.html Your UEFI/BIOS (version 80.03) dates from 2013. Please check at the manufacturer's website to see if there are any UEFI/BIOS updates available for your system. If you are able to install the update through Windows (without booting from an external drive), then go ahead and update it. WARNING - if the computer might shut down during this procedure, please don't do it, as this may physically damage the computer and prevent it from booting. FYI - W8 and W10 communicate more with the UEFI/BIOS than previous versions of Windows, so it's important to ensure that the UEFI/BIOS is kept up to date (and the outdated UEFI/BIOS' may be the cause of some compatibility issues). Please update these older drivers. Links are provided in order to assist you with looking up the source of the drivers. If unable to find an update, please uninstall the program that is responsible for that driver. DO NOT manually delete/rename the driver as it may make the system unbootable!!!: BrUsbSIb.sys Mon Nov 2 22:06:35 2009 (4AEF9E3B) Brother Serial USB Driver http://www.brother.com/html/download/index.htm http://www.carrona.org/drivers/driver.php?id=BrUsbSIb.sys CLVirtualDrive.sys Mon Dec 26 08:26:47 2011 (4EF87617) CyberLink Virtual Device Driver http://www.cyberlink.com/downloads/support/index_en_US.html http://www.carrona.org/drivers/driver.php?id=CLVirtualDrive.sys SgrmAgent.sys Thu Feb 2 09:30:36 2012 (4F2A9E0C) Go to C:\Windows\System32\drivers and find this driver Right click on it and select "Properties", then select the Details tab. Check the version - if it's 10.0.17134.1, then it's not a problem Please let us know about this as I'd like to add the driver to the DRT (Driver Reference Table) with an explanation about this. BrSerIb.sys Tue Jul 31 07:54:47 2012 (5017C787) Brother Serial Interface Driver http://www.brother.com/html/download/index.htm http://www.carrona.org/drivers/driver.php?id=BrSerIb.sys RTKVHD64.sys Tue Jun 30 09:33:17 2015 (55929A9D) Realtek High Definition Audio Function Driver http://www.realtek.com.tw/downloads/downloadsView.aspx?Langid=1&PNid=8&PFid=14&Level=3&Conn=2 http://www.carrona.org/drivers/driver.php?id=RTKVHD64.sys rt640x64.sys Thu Jul 23 04:53:50 2015 (55B0AB9E) Realtek NICDRV 8169 PCIe GBE Family Controller driver [br] http://www.realtek.com.tw/downloads/downloadsView.aspx?Langid=1&PNid=13&PFid=5&Level=5&Conn=4&DownTypeID=3&GetDown=false http://www.carrona.org/drivers/driver.php?id=rt640x64.sys RtsP2Stor.sys Thu Aug 6 23:22:30 2015 (55C42476) Realtek Pcie CardReader Driver for 2K/XP/Vista/Win7 http://www.realtek.com.tw/Downloads/downloadsView.aspx?Langid=1&PNid=15&PFid=25&Level=4&Conn=3&DownTypeID=3&GetDown=false http://www.carrona.org/drivers/driver.php?id=RtsP2Stor.sys atikmpag.sys Wed Aug 19 12:39:12 2015 (55D4B130) ATI Video driver (remove the Catalyst Control Center and only install the Display Driver) http://support.amd.com/us/Pages/AMDSupportHub.aspx[br]Get from OEM for laptops http://www.carrona.org/drivers/driver.php?id=atikmpag.sys atikmdag.sys Wed Aug 19 13:03:45 2015 (55D4B6F1) ATI Video driver (remove the Catalyst Control Center and only install the Display Driver) http://support.amd.com/us/Pages/AMDSupportHub.aspx[br]Get from OEM for laptops http://www.carrona.org/drivers/driver.php?id=atikmdag.sys Analysis: The following is for information purposes only. The following information contains the relevant information from the blue screen analysis: **************************Sun May 6 11:08:25.690 2018 (UTC - 4:00)************************** Loading Dump File [C:\Users\john\SysnativeBSODApps\050618-28734-01.dmp] *** WARNING: Unable to verify timestamp for ntoskrnl.exe *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe Windows 10 Kernel Version 17134 MP (4 procs) Free x64 Built by: 17134.1.amd64fre.rs4_release.180410-1804 System Uptime:1 days 13:09:21.728 *** WARNING: Unable to verify timestamp for ntoskrnl.exe *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe Probably caused by :ntoskrnl.wrong.symbols.exe ( nt_wrong_symbols!5ACD8966965000 ) BugCheck 12B, {ffffffffc00002c4, e1, 6a18600, ffffe1801dd2d000} BugCheck Info: FAULTY_HARDWARE_CORRUPTED_PAGE (12b) Arguments: Arg1: ffffffffc00002c4, virtual address mapping the corrupted page Arg2: 00000000000000e1, physical page number Arg3: 0000000006a18600, zero Arg4: ffffe1801dd2d000, zero BUGCHECK_STR: 5ACD8966 PROCESS_NAME: ntoskrnl.wrong.symbols.exe FAILURE_BUCKET_ID: WRONG_SYMBOLS_X64_17134.1.amd64fre.rs4_release.180410-1804_TIMESTAMP_180411-040454_5ACD8966_nt_wrong_symbols!5ACD8966965000 BIOS Version 80.03 BIOS Release Date 05/03/2013 Manufacturer Hewlett-Packard Product Name 23-b237c Baseboard Product 2AFC ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨`` 3rd Party Drivers: The following is for information purposes only. My recommendations were given above. The drivers that follow belong to software or devices that were not developed by Microsoft. You can find links to the driver information and where to update the drivers in the section after the code box: **************************Sun May 6 11:08:25.690 2018 (UTC - 4:00)************************** BrUsbSIb.sys Mon Nov 2 22:06:35 2009 (4AEF9E3B) CLVirtualDrive.sys Mon Dec 26 08:26:47 2011 (4EF87617) SgrmAgent.sys Thu Feb 2 09:30:36 2012 (4F2A9E0C) BrSerIb.sys Tue Jul 31 07:54:47 2012 (5017C787) RTKVHD64.sys Tue Jun 30 09:33:17 2015 (55929A9D) rt640x64.sys Thu Jul 23 04:53:50 2015 (55B0AB9E) RtsP2Stor.sys Thu Aug 6 23:22:30 2015 (55C42476) atikmpag.sys Wed Aug 19 12:39:12 2015 (55D4B130) atikmdag.sys Wed Aug 19 13:03:45 2015 (55D4B6F1) athw8x.sys Thu Jan 28 04:52:54 2016 (56A9E4F6) rzendpt.sys Wed Oct 26 04:12:17 2016 (58106561) rzudd.sys Wed Oct 26 04:12:19 2016 (58106563) mbae64.sys Wed Jan 11 12:08:00 2017 (58766670) afunix.sys Tue Apr 18 10:12:59 2017 (58F61EEB) farflt.sys Wed Mar 7 09:25:24 2018 (5A9FF654) mbamswissarmy.sys Wed Mar 7 10:54:57 2018 (5AA00B51) mbam.sys Wed Mar 7 12:45:05 2018 (5AA02521) rzpmgrk.sys Wed Mar 7 18:45:18 2018 (5AA0798E) MbamChameleon.sys Mon Mar 12 17:30:53 2018 (5AA6F18D) rzpnk.sys Mon Mar 19 14:55:13 2018 (5AB00791) mwac.sys Sat Mar 24 11:27:48 2018 (5AB66E74) http://www.carrona.org/drivers/driver.php?id=BrUsbSIb.sys http://www.carrona.org/drivers/driver.php?id=CLVirtualDrive.sys SgrmAgent.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed. http://www.carrona.org/drivers/driver.php?id=BrSerIb.sys http://www.carrona.org/drivers/driver.php?id=RTKVHD64.sys http://www.carrona.org/drivers/driver.php?id=rt640x64.sys http://www.carrona.org/drivers/driver.php?id=RtsP2Stor.sys http://www.carrona.org/drivers/driver.php?id=atikmpag.sys http://www.carrona.org/drivers/driver.php?id=atikmdag.sys http://www.carrona.org/drivers/driver.php?id=athw8x.sys http://www.carrona.org/drivers/driver.php?id=rzendpt.sys http://www.carrona.org/drivers/driver.php?id=rzudd.sys http://www.carrona.org/drivers/driver.php?id=mbae64.sys afunix.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed. http://www.carrona.org/drivers/driver.php?id=farflt.sys http://www.carrona.org/drivers/driver.php?id=mbamswissarmy.sys http://www.carrona.org/drivers/driver.php?id=mbam.sys http://www.carrona.org/drivers/driver.php?id=rzpmgrk.sys http://www.carrona.org/drivers/driver.php?id=MbamChameleon.sys http://www.carrona.org/drivers/driver.php?id=rzpnk.sys http://www.carrona.org/drivers/driver.php?id=mwac.sys
  11. usasma

    BSOD 0x0000012b

    Please run this report collecting tool so that we can provide a complete analysis: (from the pinned topic at the top of the forum): https://forums.malwarebytes.org/topic/170037-blue-screen-of-death-bsod-posting-instructions-windows-10-81-8-7-vista/ FYI - I don't often use the Perfmon report, so if it doesn't work please just let me know. NOTE: On problem systems it can take up to 20 minutes for the log files to complete. Please be patient and let it run. If you still have problems with it running, there's an alternate tool here (direct download link): https://github.com/blueelvis/BSOD-Inspector/releases/download/1.0.5/BSODInspector-1.0.5.exe NOTE: Please zip up the (.ZIP) files - do not use .RAR, .7z or other compression utilities. .ZIP is the type file that can be uploaded to the forums. While waiting for a reply (it's taking a while to run the memory dump), please start with these free hardware diagnostics: http://www.carrona.org/hwdiag.html Often the STOP 0x12B errors are hardware related.
  12. usasma

    MWAC.SYS BSOD

    TeamViewer (teamviewervpn.sys), MiniTool Partition Wizard (pwdrvio.sys), and the OpenVPN (tap0901.sys) programs probably didn't come with the computer. Please be sure to update these individual programs from their website(s). Beyond that, then we wait to see if that fixes the BSOD's If the BSOD's do come back, then please run Driver Verifier according to these instructions: http://www.carrona.org/verifier.html
  13. usasma

    MWAC.SYS BSOD

    Your UEFI/BIOS (version G1ETB5WW (2.75 )) dates from 2018. Please check at the manufacturer's website to see if there are any UEFI/BIOS updates available for your system. This is just in case there has been a more recent update. FYI - W8 and W10 communicate more with the UEFI/BIOS than previous versions of Windows, so it's important to ensure that the UEFI/BIOS is kept up to date (and that outdated UEFI/BIOS' may be the cause of some compatibility issues). Although you appear to have a reasonable number of Windows Update hotfixes for this version of your OS, please double check for any new Windows Updates. It only takes one update to cause a problem, so it's essential that you have all of them. The actual number is not important. Rather it's important that you checked manually, installed any available updates, and didn't experience any errors when checking or updating. Please update these older drivers. Links are provided in order to assist you with looking up the source of the drivers. If unable to find an update, please uninstall the program that is responsible for that driver. DO NOT manually delete/rename the driver as it may make the system unbootable!!!: teamviewervpn.sys Thu Dec 13 04:22:09 2007 (4760F9C1) TeamViewerVPN Network Adapter http://www.teamviewer.com/en/download/windows.aspx[br][br]http://www.teamviewer.com/download/teamviewer_manual.pdf http://www.carrona.org/drivers/driver.php?id=teamviewervpn.sys pwdrvio.sys Mon Jun 15 21:43:45 2009 (4A36F8D1) MiniTool Partition Wizard http://www.partitionwizard.com/free-partition-manager.html http://www.carrona.org/drivers/driver.php?id=pwdrvio.sys LnvHIDHW.sys Mon Jul 30 03:11:29 2012 (501633A1) Lenovo HID Mini-driver for Hardware Radio Switch http://support.lenovo.com/ http://www.carrona.org/drivers/driver.php?id=LnvHIDHW.sys risdxc64.sys Fri Sep 21 00:35:19 2012 (505BEE87) RICOH SD/MMC Driver OEM - none at http://www.ricoh.com http://www.carrona.org/drivers/driver.php?id=risdxc64.sys IntcDAud.sys Tue Sep 9 08:13:01 2014 (540EEECD) Intel Graphics Media Accelerator HD Driver http://downloadcenter.intel.com/ http://www.carrona.org/drivers/driver.php?id=IntcDAud.sys tap0901.sys Wed Nov 5 08:16:32 2014 (545A2330) TAP-Win32 Adapter V9 or[br]OpenVPN driver or COMODO http://openvpn.net/index.php/open-source/downloads.html or http://forums.comodo.com/index.php?action=dlattach;topic=17220.0;attach=17692 Requires registration http://www.carrona.org/drivers/driver.php?id=tap0901.sys e1c65x64.sys Sun Feb 15 08:39:57 2015 (54E0A1AD) Intel(R) Gigabit Adapter NDIS 6.x drive https://downloadcenter.intel.com/ http://www.carrona.org/drivers/driver.php?id=e1c65x64.sys NETwew01.sys Mon May 4 08:52:24 2015 (55476B88) Intel Wireless WiFi Link Driver OEM[br]or[br]https://downloadcenter.intel.com/ http://www.carrona.org/drivers/driver.php?id=NETwew01.sys iaStorA.sys Fri May 22 09:35:27 2015 (555F309F) Intel RST (Rapid Storage Technology) driver http://downloadcenter.intel.com/Default.aspx XP http://www.carrona.org/drivers/driver.php?id=iaStorA.sys RTKVHD64.sys Tue Sep 15 10:12:36 2015 (55F82754) Realtek High Definition Audio Function Driver http://www.realtek.com.tw/downloads/downloadsView.aspx?Langid=1&PNid=8&PFid=14&Level=3&Conn=2 http://www.carrona.org/drivers/driver.php?id=RTKVHD64.sys TeeDriverW8x64.sys Thu Oct 8 14:13:00 2015 (5616B22C) Intel Management Engine Interface (MEI) driver OEM or http://downloadcenter.intel.com[br][br]Installation instructions - http://www.sysnative.com/forums/windows-10-a/18573-windows-10-error-0x800f081f-source-file-not-found.html#post144391 http://www.carrona.org/drivers/driver.php?id=TeeDriverW8x64.sys If the BSOD's continue after updating these programs - then please run Driver Verifier according to these instructions: http://www.carrona.org/verifier.html Analysis: The following is for information purposes only. The following information contains the relevant information from the blue screen analysis: **************************Thu Apr 26 08:19:09.002 2018 (UTC - 4:00)************************** Loading Dump File [C:\Users\john\SysnativeBSODApps\MEMORY.DMP] Windows 10 Kernel Version 16299 MP (4 procs) Free x64 Built by: 16299.402.amd64fre.rs3_release_svc_escrow_im.180415-0955 System Uptime:0 days 0:45:22.712 *** ERROR: Module load completed but symbols could not be loaded for mwac.sys Probably caused by :mwac.sys ( mwac+3489 ) BugCheck 3B, {c0000005, fffff801d9713489, ffff910856b62c80, 0} BugCheck Info: SYSTEM_SERVICE_EXCEPTION (3b) Arguments: Arg1: 00000000c0000005, Exception code that caused the bugcheck Arg2: fffff801d9713489, Address of the instruction which caused the bugcheck Arg3: ffff910856b62c80, Address of the context record for the exception that caused the bugcheck Arg4: 0000000000000000, zero. BUGCHECK_STR: 0x3B DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT PROCESS_NAME: MBAMService.exe FAILURE_BUCKET_ID: 0x3B_mwac!unknown_function CPUID: "Intel(R) Core(TM) i5-3320M CPU @ 2.60GHz" MaxSpeed: 2600 CurrentSpeed: 2594 BIOS Version G1ETB5WW (2.75 ) BIOS Release Date 03/05/2018 Manufacturer LENOVO Product Name 2347JQ6 ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨`` **************************Thu Apr 26 07:31:25.662 2018 (UTC - 4:00)************************** Loading Dump File [C:\Users\john\SysnativeBSODApps\042618-5671-01.dmp] Windows 10 Kernel Version 16299 MP (4 procs) Free x64 Built by: 16299.402.amd64fre.rs3_release_svc_escrow_im.180415-0955 System Uptime:1 days 1:27:38.366 *** WARNING: Unable to verify timestamp for mwac.sys *** ERROR: Module load completed but symbols could not be loaded for mwac.sys Probably caused by :memory_corruption BugCheck 3B, {c0000005, fffff80567dd3489, ffffd9048d6edc80, 0} BugCheck Info: SYSTEM_SERVICE_EXCEPTION (3b) Arguments: Arg1: 00000000c0000005, Exception code that caused the bugcheck Arg2: fffff80567dd3489, Address of the instruction which caused the bugcheck Arg3: ffffd9048d6edc80, Address of the context record for the exception that caused the bugcheck Arg4: 0000000000000000, zero. BUGCHECK_STR: 0x3B DEFAULT_BUCKET_ID: CODE_CORRUPTION PROCESS_NAME: MBAMService.exe FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE CPUID: "Intel(R) Core(TM) i5-3320M CPU @ 2.60GHz" MaxSpeed: 2600 CurrentSpeed: 2594 BIOS Version G1ETB5WW (2.75 ) BIOS Release Date 03/05/2018 Manufacturer LENOVO Product Name 2347JQ6 ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨`` **************************Wed Apr 25 06:01:07.344 2018 (UTC - 4:00)************************** Loading Dump File [C:\Users\john\SysnativeBSODApps\042518-5265-01.dmp] Windows 10 Kernel Version 16299 MP (4 procs) Free x64 Built by: 16299.402.amd64fre.rs3_release_svc_escrow_im.180415-0955 System Uptime:0 days 13:17:08.373 *** WARNING: Unable to verify timestamp for mwac.sys *** ERROR: Module load completed but symbols could not be loaded for mwac.sys Probably caused by :memory_corruption BugCheck D1, {0, 2, 0, fffff802ebfa83bd} BugCheck Info: DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) Arguments: Arg1: 0000000000000000, memory referenced Arg2: 0000000000000002, IRQL Arg3: 0000000000000000, value 0 = read operation, 1 = write operation Arg4: fffff802ebfa83bd, address which referenced memory BUGCHECK_STR: AV DEFAULT_BUCKET_ID: CODE_CORRUPTION PROCESS_NAME: MBAMService.exe FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE CPUID: "Intel(R) Core(TM) i5-3320M CPU @ 2.60GHz" MaxSpeed: 2600 CurrentSpeed: 2594 BIOS Version G1ETB5WW (2.75 ) BIOS Release Date 03/05/2018 Manufacturer LENOVO Product Name 2347JQ6 ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨`` 3rd Party Drivers: The following is for information purposes only. My recommendations were given above. The drivers that follow belong to software or devices that were not developed by Microsoft. You can find links to the driver information and where to update the drivers in the section after the code box: **************************Thu Apr 26 08:19:09.002 2018 (UTC - 4:00)************************** vmsproxy.sys Sun Dec 19 18:32:20 1971 (03B28E84) vfpext.sys Wed Feb 28 11:42:05 1973 (05F24DDD) MpKsla90462c1.sys Mon Feb 27 20:54:41 1989 (2409FBE1) Synth3dVsp.sys Fri Jan 1 18:09:43 1993 (2B44CF37) LXCORE.SYS Mon Mar 8 09:14:55 2004 (404C7FDF) hvsocketcontrol.sys Sat Jul 21 17:01:12 2007 (46A27418) teamviewervpn.sys Thu Dec 13 04:22:09 2007 (4760F9C1) pwdrvio.sys Mon Jun 15 21:43:45 2009 (4A36F8D1) LnvHIDHW.sys Mon Jul 30 03:11:29 2012 (501633A1) risdxc64.sys Fri Sep 21 00:35:19 2012 (505BEE87) IntcDAud.sys Tue Sep 9 08:13:01 2014 (540EEECD) tap0901.sys Wed Nov 5 08:16:32 2014 (545A2330) e1c65x64.sys Sun Feb 15 08:39:57 2015 (54E0A1AD) NETwew01.sys Mon May 4 08:52:24 2015 (55476B88) iaStorA.sys Fri May 22 09:35:27 2015 (555F309F) RTKVHD64.sys Tue Sep 15 10:12:36 2015 (55F82754) TeeDriverW8x64.sys Thu Oct 8 14:13:00 2015 (5616B22C) iwdbus.sys Thu Nov 19 18:37:42 2015 (564E5D46) igdkmd64.sys Mon Apr 4 13:48:36 2016 (5702A8F4) ApsHM64.sys Mon Mar 13 09:16:44 2017 (58C69BBC) Apsx64.sys Mon Mar 13 09:19:24 2017 (58C69C5C) USBPcap.sys Sun Aug 20 14:11:49 2017 (5999D0E5) ibmpmdrv.sys Wed Nov 1 05:16:41 2017 (59F990F9) pmdrvs.sys Wed Nov 1 05:17:02 2017 (59F9910E) SynTP.sys Fri Jan 5 00:58:54 2018 (5A4F141E) mbamswissarmy.sys Wed Mar 7 10:54:57 2018 (5AA00B51) mbae64.sys Tue Mar 27 11:15:46 2018 (5ABA6022) MbamChameleon.sys Mon Apr 2 17:23:25 2018 (5AC29F4D) mbam.sys Sat Apr 7 14:55:35 2018 (5AC91427) farflt.sys Fri Apr 13 11:15:06 2018 (5AD0C97A) mwac.sys Mon Apr 23 09:40:08 2018 (5ADDE238) lxss.sys ***** Invalid 2004 Invalid 2004 Invalid intelppm.sys ***** Invalid 2014 Invalid 2014 Invalid ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨`` **************************Thu Apr 26 07:31:25.662 2018 (UTC - 4:00)************************** MpKslf39b7d02.sys Mon Feb 27 20:54:41 1989 (2409FBE1) vmsproxy.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed. vfpext.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed. MpKsla90462c1.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed. Synth3dVsp.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed. LXCORE.SYS - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed. hvsocketcontrol.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed. http://www.carrona.org/drivers/driver.php?id=teamviewervpn.sys http://www.carrona.org/drivers/driver.php?id=pwdrvio.sys http://www.carrona.org/drivers/driver.php?id=LnvHIDHW.sys http://www.carrona.org/drivers/driver.php?id=risdxc64.sys http://www.carrona.org/drivers/driver.php?id=IntcDAud.sys http://www.carrona.org/drivers/driver.php?id=tap0901.sys http://www.carrona.org/drivers/driver.php?id=e1c65x64.sys http://www.carrona.org/drivers/driver.php?id=NETwew01.sys http://www.carrona.org/drivers/driver.php?id=iaStorA.sys http://www.carrona.org/drivers/driver.php?id=RTKVHD64.sys http://www.carrona.org/drivers/driver.php?id=TeeDriverW8x64.sys http://www.carrona.org/drivers/driver.php?id=iwdbus.sys http://www.carrona.org/drivers/driver.php?id=igdkmd64.sys http://www.carrona.org/drivers/driver.php?id=ApsHM64.sys http://www.carrona.org/drivers/driver.php?id=Apsx64.sys USBPcap.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed. http://www.carrona.org/drivers/driver.php?id=ibmpmdrv.sys pmdrvs.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed. http://www.carrona.org/drivers/driver.php?id=SynTP.sys http://www.carrona.org/drivers/driver.php?id=mbamswissarmy.sys http://www.carrona.org/drivers/driver.php?id=mbae64.sys http://www.carrona.org/drivers/driver.php?id=MbamChameleon.sys http://www.carrona.org/drivers/driver.php?id=mbam.sys http://www.carrona.org/drivers/driver.php?id=farflt.sys http://www.carrona.org/drivers/driver.php?id=mwac.sys lxss.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed. http://www.carrona.org/drivers/driver.php?id=intelppm.sys MpKslf39b7d02.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
  14. usasma

    BAD_POOL_HEADER BSOD

    OK, let's first discuss how to troubleshoot BSOD's.... The best way is to sit by your computer with a live debugger hooked up and wait for the system to BSOD. This is much better and easier if you can make the system BSOD on demand. It also takes a skilled analyst to work their way through the details of the crash and trying to find the cause (which is often different from what the debugger says. That takes a long time and because of the skill involved is very expensive. So, for more usual conditions, we work on identifying the most likely components and try to test each of them in order to find out which is at fault. This is a game of percentages and of what's more likely and less likely (which is where the experience of a BSOD analyst comes in handy :0) The tweaks make it more difficult - but in this case they are less likely to be at fault than if they had just been done. So, for now, we'll disregard all but the most obvious tweak stuff (those that affects the networking - as the networking is what's to blame in the memory dump. BUT - remember, a single memory dump may be misleading. It may point to another cause just because the error happened to occur when that instruction crashed. This is most often the case with hardware errors, but can also sometimes be attributed to software type errors. Then, also remember that a BSOD can be simple (the cause is pointed to in the memory dump and usually involves only 1 driver/piece of hardware/or a compatibility issue) - or it can be complex (where it involves more than one driver/hardware/compatibility issue). How to tell which is which? Most often it's the result of prolonged analysis of numerous memory dumps. Finally, there's the piece of hardware with no drivers installed. Windows doesn't know what to do with it (and most times ignores it), but it can cause system wide problems (so ALL devices must have up to date drivers installed). So, please install the drivers for the Synaptics device. So, onto my questions: - Have you tested for BSOD's after temporarily removing HitManPro? If so, what were the results? - Did the ISATAP adapters stay removed when you rebooted? - Have you tested the other adapters to see if the BSOD occurs when they are enabled - So, do the networking drivers (to include the MalwareBytes and HitManPro drivers) attempt to access/connect to those devices? Could it be that their attempting to contact (and failing) could at least be contributing to the problem? The simplest way is to temporarily enable them and test to see if the BSOD goes away. Intel(R) Wireless Bluetooth has problems with it's configuration. Please uninstall it's software, then download and reinstall a fresh copy of the latest driver package software from the manufacturer's support website and see if that fixes the error in the Perfmon report. Looked at the Autoruns info - and there's an awful lot of networking stuff disabled. But let's ignore it for now as you didn't relate problems with it previously. The same goes for the services list. FWIW - I'd spoken with Mark Russinovich and Black Viper (years ago) about their work - and am very impressed and respectful of the work that they have done. Beyond that, you can try running Driver Verifier to force crashes (and it may give us a bit more info about the culprit). Please use these instructions and let it crash 3 times so we get a good selection of memory dumps: http://www.carrona.org/verifier.html Good luck!
  15. usasma

    BAD_POOL_HEADER BSOD

    There's a lot of networking issues on your system - as such I think that this is an issue with your system alone, and not a compatibility issue. If this was a compatibility issue (IMO) there would be many more problems with HMP and MalwareBytes - which we're just not seeing here or in other forums. Looking at the perfmon report, the networking section of your Device Manager appears full of problem devices. Right click on all of the problem devices and select "Uninstall". If it prompts you to remove the software, select that box (to remove it). Then reboot the system and check to see if the devices have returned. In particular, the ISATAP will probably not come back. Do the same thing with any of the disabled devices and see if they return. Then generate a new perfmon report (so we can look for the remaining errors) Any devices starting with MpKsl are temporary drivers related to Microsoft Security Essentials. Please ensure that any of these drivers are enabled in Device Manager - then uninstall MSSE. Feel free to download a fresh new copy and install/update that. Only 219 Windows Update hotfixes installed. Most systems with SP1 have 350-400 or more. Please visit Windows Update and get ALL available updates (it may take several trips to get them all). The actual number is not important. Rather it's important that you checked manually, installed any available updates, and didn't experience any errors when checking or updating. Here's a list of problem devices in the MSINFO32 report: The Not Available device is likely a driver for a Synaptics biometric device There are only 7 entries in the WER section of the MSINFO32 report. All date from 13 April 2018. In a system with the OS having been reinstalled in January - there should be many other entries. Have you been tweaking the system, and if so, what did you turn off?
×

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.