Jump to content

BSOD recurring on win10


Recommended Posts

Hi recently i am experiencing BSOD that attacks intermittently, once it occurs machine will crash repeatedly upon windows loging (BSOD again), only  after logging in safemode and conducting cleanup with CCL, machine will start normally.

Malwarebytes scan=clean

AVG scan = Clean

see attached FRST64 output (in safe mode, before ccl cleanup)

 

please help.

FRST.txt Addition.txt

Link to post
Share on other sites

I suggest turning off fast startup in Windows. Then restart.

https://www.tenforums.com/tutorials/4189-turn-off-fast-startup-windows-10-a.html

Please also refer to this support article which lists several known applications which conflict with the Web Protection in Malwarebytes currently, which includes AVG and Avast.
Link to post
Share on other sites

  • Root Admin

I would recommend you do the following.

Go to Control Panel, Programs, Programs and Features and uninstall the following.

  • Avast Secure Browser
  • AVG AntiVirus FREE
  • CCleaner

Then download the following removal utilities to help clean up the remaining parts of the program

Avast Removal Tool
https://www.avast.com/uninstall-utility

AVG Removal Tool
https://www.avg.com/en-us/avg-remover

 

After all has been removed then Exit out of Malwarebytes and click on Start and type in "Check for updates" and let Windows check for and install Windows updates.

 

Edited by AdvancedSetup
updated information
Link to post
Share on other sites

ok so I did, all of these steps and hopefully came to some stability.

So i guess i cannot use MalwareBytes with AVG, and also the updates were not coming in...

i will report back in two days if this stays stable

 

Thank you so much!

Link to post
Share on other sites

  • Root Admin

We're not done. We'll put stuff back. I just want to get you away from the BSOD and get Windows updated

So did Windows update or what happened?

If you click on Start and  type in WINVER it should show your version. Please do that and post a screenshot

Here is mine

image.png

 

It's after midnight for me, so I'm heading out but will check back on you again in the morning.

Let me get some new logs please.

Run FRST and click on SCAN and attach both new logs please.

 

Link to post
Share on other sites

  • Root Admin

Hello @mosheelm

 

Please download the attached fixlist.txt file and save it to the Desktop or location where you ran FRST from.
NOTE. It's important that both files, FRST or FRST64, and fixlist.txt are in the same location or the fix will not work.

Please make sure you disable any real time antivirus or security software before running this script. Once completed make sure you re-enable it.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system that cannot be undone.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt) or wherever you ran FRST from. Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

NOTE-1:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It will also run a disk check on the restart to ensure disk integrity. Depending on the speed of your computer this fix may take 30 minutes or more.

NOTE-2: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. Also, make sure you know the passwords for all websites as cookies will also be removed. The use of an external password manager is highly recommended instead of using your browser to store passwords.

The following directories are emptied:

  • Windows Temp
  • Users Temp folders
  • Edge, IE, FF, Chrome and Opera caches, HTML5 storages, Cookies and History
  • Recently opened files cache
  • Flash Player cache
  • Java cache
  • Steam HTML cache
  • Explorer thumbnail and icon cache
  • BITS transfer queue (qmgr*.dat files)
  • Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

The system will be rebooted after the fix has run.

fixlist.txt

Thanks

 

Link to post
Share on other sites

BSODs are back :(

Could not log in to win at all, working from Safe Mode only run a scan with MWBites found 10 threats all were moved to quarantine see report.

after removal BSOD will not allow login again (3 times). run Scan again with MWbites.. came clean.

Did another FRST see reports attached.

Addition.txt FRST.txt MB_report05072021_2.txt

Link to post
Share on other sites

  • Root Admin

Please run your Samsung Magician software and have it check the drive for any firmware updates. Also have it do a Diagnostic - Short Scan to look for any problems and let me know what it finds.

The latest version of Samsung Magician is 6.3.0 - please check for an update

Also double check for an NVMe driver update. I believe the latest is now version 3.3

Samsung NVM Express Driver (HKLM-x32\...\{bfb0503a-76b9-415a-b0a3-dd55d2a01ebe}) (Version: 3.0.0.1802 - Samsung Electronics)

Also, run a disk check on your drive. From an elevated Admin command prompt run the following and restart the computer to allow it to run

ECHO Y|CHKDSK C: /F

 

Link to post
Share on other sites

  • Root Admin

Not sure about the NVMe driver. I would open a ticket with Samsung Support for that and see what they have to say.

https://www.samsung.com/semiconductor/minisite/ssd/support/faqs-nvmessd/

https://www.samsung.com/semiconductor/minisite/ssd/support/cs/

 

 

 

Glad to hear the BSOD is no longer happening.

Cheers @mosheelm

 

Link to post
Share on other sites

Like always with this machine, i was too quick to celebrate :(

everything was working perfectly fine, until win update tried to install an update. ever since the restart of this update i have experienced multiple BSOD could not restart even in safemode, at some point the machine woulnt even turn-on (blank display - so i had to unplug the power cord) but still BSOD came - so restored twice to 6 days ago.

I will try to make the fix to the HD.

also installed MWbites, didnt catch anything.

 

is it time to re-install windows?

Link to post
Share on other sites

  • Root Admin

There are currently ongoing programs that are faulting in your Event Logs

Having done a restore back to last week and now doing a Windows Update you probably have a mixed bag of results in the logs.

The big questions is, are you still having or getting BSOD ?

You can probably work on correcting the faults in the Event Logs but if you're experienced and more advanced user you might consider doing a fresh install of Windows 10 from scratch. Getting a clean, working base of Windows 10 fully up to date that runs without issues and a generally clean Event Log and then make an image of the drive to an external USB drive. Then start working on installing software all the while monitoring the system and Event Logs to see if or when something starts causing an issue.

 

Edited by AdvancedSetup
updated information
Link to post
Share on other sites

Right now the BSODs are gone.

i went over the FRST log and did notice it still list some programs that are no longer installed in my machine.

I can do a clean install of WIN10, provided with a guidance document. also about creating an image, i dont think its that difficult, also.

Also which section in the report do you see program that is creating faults? i can compare to what installed and uninstall them.

 

 

Link to post
Share on other sites

  • Root Admin

I'm not saying you have to reinstall Windows, just offering it up if the BSOD was continuing.

Here are the Events that are currently being logged. You can open your EVENTVWR program and filter for Warnings, Errors to find or see more of what's going on.

You can also run the Reliability app to view issues.

 

Application errors:
==================
Error: (05/13/2021 09:26:05 AM) (Source: SideBySide) (EventID: 59) (User: )
Description: Activation context generation failed for "C:\Program Files (x86)\Driver Support\DriverSupport.exe".Error in manifest or policy file "C:\Program Files (x86)\Driver Support\DriverSupport.exe.Config" on line 0.
Invalid Xml syntax.

Error: (05/13/2021 09:20:08 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: 3DXChat.exe, version: 2018.4.29.52450, time stamp: 0x5fa21d54
Faulting module name: GameAssembly.dll, version: 0.0.0.0, time stamp: 0x60056400
Exception code: 0xc0000005
Fault offset: 0x000000000004b8f0
Faulting process id: 0x35d4
Faulting application start time: 0x01d74813d76a8bc8
Faulting application path: C:\Games\3DXChat\3DXChat.exe
Faulting module path: C:\Games\3DXChat\GameAssembly.dll
Report Id: a5add2d7-0374-4be3-b322-2bb308a723e8
Faulting package full name:
Faulting package-relative application ID:

Error: (05/13/2021 09:05:14 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: 3DXChat.exe, version: 2018.4.29.52450, time stamp: 0x5fa21d54
Faulting module name: GameAssembly.dll, version: 0.0.0.0, time stamp: 0x60056400
Exception code: 0xc0000005
Fault offset: 0x000000000004b8f0
Faulting process id: 0x2e2c
Faulting application start time: 0x01d74811c2853a0e
Faulting application path: C:\Games\3DXChat\3DXChat.exe
Faulting module path: C:\Games\3DXChat\GameAssembly.dll
Report Id: 856f95a4-11ad-41c3-9e83-6b270568853a
Faulting package full name:
Faulting package-relative application ID:

Error: (05/13/2021 09:02:51 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: 3DXChat.exe, version: 2018.4.29.52450, time stamp: 0x5fa21d54
Faulting module name: GameAssembly.dll, version: 0.0.0.0, time stamp: 0x60056400
Exception code: 0xc0000005
Fault offset: 0x000000000004b8f0
Faulting process id: 0x2ee0
Faulting application start time: 0x01d748116d31a302
Faulting application path: C:\Games\3DXChat\3DXChat.exe
Faulting module path: C:\Games\3DXChat\GameAssembly.dll
Report Id: 258e6695-5583-47d9-83f1-e7a392e4a180
Faulting package full name:
Faulting package-relative application ID:

Error: (05/13/2021 09:02:19 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: 3DXChat.exe, version: 2018.4.29.52450, time stamp: 0x5fa21d54
Faulting module name: GameAssembly.dll, version: 0.0.0.0, time stamp: 0x60056400
Exception code: 0xc0000005
Fault offset: 0x000000000004b8f0
Faulting process id: 0x31d0
Faulting application start time: 0x01d748115a13c3d1
Faulting application path: C:\Games\3DXChat\3DXChat.exe
Faulting module path: C:\Games\3DXChat\GameAssembly.dll
Report Id: 1b44ffdc-2395-4328-8af5-2af7aa99f7aa
Faulting package full name:
Faulting package-relative application ID:

Error: (05/13/2021 09:01:58 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: 3DXChat.exe, version: 2018.4.29.52450, time stamp: 0x5fa21d54
Faulting module name: GameAssembly.dll, version: 0.0.0.0, time stamp: 0x60056400
Exception code: 0xc0000005
Fault offset: 0x000000000004b8f0
Faulting process id: 0x36cc
Faulting application start time: 0x01d748114d3c0941
Faulting application path: C:\Games\3DXChat\3DXChat.exe
Faulting module path: C:\Games\3DXChat\GameAssembly.dll
Report Id: b61ddb5b-784d-434b-bbc5-889c1a49f95a
Faulting package full name:
Faulting package-relative application ID:

Error: (05/13/2021 07:58:40 AM) (Source: Microsoft-Windows-Defrag) (EventID: 264) (User: )
Description: The storage optimizer couldn't complete re-trim on New Volume (E:) because: The operation requested is not supported by the hardware backing the volume. (0x8900002A)

Error: (05/13/2021 07:58:36 AM) (Source: Microsoft-Windows-Defrag) (EventID: 264) (User: )
Description: The storage optimizer couldn't complete re-trim on \\?\Volume{f613694a-0000-0000-0000-e0eca0010000}\ because: The operation requested is not supported by the hardware backing the volume. (0x8900002A)


System errors:
=============
Error: (05/13/2021 09:24:48 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The cplspcon service terminated with the following error:
Unspecified error

Error: (05/13/2021 07:56:47 AM) (Source: Microsoft-Windows-NDIS) (EventID: 10317) (User: NT AUTHORITY)
Description: Miniport TeamViewer VPN Adapter, {d71651aa-73b3-4663-9794-8b8b3e9a3292}, had event 76

Error: (05/13/2021 07:48:23 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The cplspcon service terminated with the following error:
Unspecified error

Error: (05/13/2021 07:47:53 AM) (Source: DCOM) (EventID: 10005) (User: MOSHE-PC-ROG)
Description: DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "Unavailable" in order to run the server:
{DD522ACC-F821-461A-A407-50B198B896DC}

Error: (05/13/2021 07:47:46 AM) (Source: DCOM) (EventID: 10005) (User: MOSHE-PC-ROG)
Description: DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "Unavailable" in order to run the server:
{DD522ACC-F821-461A-A407-50B198B896DC}

Error: (05/13/2021 07:47:36 AM) (Source: DCOM) (EventID: 10005) (User: MOSHE-PC-ROG)
Description: DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "Unavailable" in order to run the server:
{DD522ACC-F821-461A-A407-50B198B896DC}

Error: (05/13/2021 07:47:30 AM) (Source: DCOM) (EventID: 10005) (User: MOSHE-PC-ROG)
Description: DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "Unavailable" in order to run the server:
{DD522ACC-F821-461A-A407-50B198B896DC}

Error: (05/13/2021 07:47:07 AM) (Source: DCOM) (EventID: 10005) (User: MOSHE-PC-ROG)
Description: DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "Unavailable" in order to run the server:
{DD522ACC-F821-461A-A407-50B198B896DC}


Windows Defender:
================
Date: 2021-05-12 15:20:53
Description:
Microsoft Defender Antivirus scan has been stopped before completion.
Scan Type: Antimalware
Scan Parameters: Quick Scan

Date: 2021-05-11 13:27:59
Description:
Microsoft Defender Antivirus scan has been stopped before completion.
Scan Type: Antimalware
Scan Parameters: Quick Scan

Date: 2021-05-10 10:29:30
Description:
Microsoft Defender Antivirus scan has been stopped before completion.
Scan Type: Antimalware
Scan Parameters: Quick Scan

Date: 2021-05-13 07:51:31
Description:
Microsoft Defender Antivirus has encountered an error trying to load security intelligence and will attempt reverting back to a known-good version.
Security intelligence Attempted: Current
Error Code: 0x80070003
Error description: The system cannot find the path specified.
Security intelligence version: 0.0.0.0;0.0.0.0
Engine version: 0.0.0.0

Date: 2021-05-13 00:32:25
Description:
Microsoft Defender Antivirus Real-Time Protection feature has encountered an error and failed.
Feature: On Access
Error Code: 0x8007043c
Error description: This service cannot be started in Safe Mode
Reason: Antimalware security intelligence has stopped functioning for an unknown reason. In some instances, restarting the service may resolve the problem.

Date: 2021-05-13 00:27:22
Description:
Microsoft Defender Antivirus Real-Time Protection feature has encountered an error and failed.
Feature: On Access
Error Code: 0x8007043c
Error description: This service cannot be started in Safe Mode
Reason: Antimalware security intelligence has stopped functioning for an unknown reason. In some instances, restarting the service may resolve the problem.

Date: 2021-05-13 00:18:35
Description:
Microsoft Defender Antivirus Real-Time Protection feature has encountered an error and failed.
Feature: On Access
Error Code: 0x8007043c
Error description: This service cannot be started in Safe Mode
Reason: Antimalware security intelligence has stopped functioning for an unknown reason. In some instances, restarting the service may resolve the problem.

Date: 2021-05-13 00:16:23
Description:
Microsoft Defender Antivirus Real-Time Protection feature has encountered an error and failed.
Feature: On Access
Error Code: 0x8007043c
Error description: This service cannot be started in Safe Mode
Reason: Antimalware security intelligence has stopped functioning for an unknown reason. In some instances, restarting the service may resolve the problem.

CodeIntegrity:
===============
Date: 2021-05-06 23:07:18
Description:
Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MpCmdRun.exe) attempted to load \Device\HarddiskVolume3\Program Files\AVG\Antivirus\aswAMSI.dll that did not meet the Microsoft signing level requirements.

 

 

Link to post
Share on other sites

Right now there are no BSOD, and windows updated properly,

Thank you for sending this lis, I see issues with :

Apps:

Error: (05/13/2021 07:58:40 AM) (Source: Microsoft-Windows-Defrag) (EventID: 264) (User: )
Description: The storage optimizer couldn't complete re-trim on New Volume (E:) because: The operation requested is not supported by the hardware backing the volume. (0x8900002A)

 

System:

Error: (05/13/2021 09:24:48 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The cplspcon service terminated with the following error:
Unspecified error

Error: (05/13/2021 07:56:47 AM) (Source: Microsoft-Windows-NDIS) (EventID: 10317) (User: NT AUTHORITY)
Description: Miniport TeamViewer VPN Adapter, {d71651aa-73b3-4663-9794-8b8b3e9a3292}, had event 76

 

Error: (05/13/2021 07:47:53 AM) (Source: DCOM) (EventID: 10005) (User: MOSHE-PC-ROG)
Description: DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "Unavailable" in order to run the server:
{DD522ACC-F821-461A-A407-50B198B896DC}

 

Also windows defender is somewhat problematic, but this could be a symptom and not the culprit.

 

Any ideas on how to fix these?

 

Link to post
Share on other sites

  • Root Admin

I would ignore them for now. Reboot a few more times over the next couple of days and see if these or other Event errors or warnings crop up.

What issue are you seeing with Windows Defender? If it were having an issue it should log the error too. Most of those above appear to be older. See if they continue is the concern here, not that they happened.

Thanks

 

 

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.