[TheArtieChoke]

Hey there,

First post so hopefully I give all information.

So this mainly happens when the system boots and it will BSOD around 3 or more times before actually booting. I disabled most of the start-up options in CCleaner.

This also seems to only happen at my work, when I bring the computer home, it doesn't BSOD at all. So I can only think of the modem or printer causing the BSOD but it doesn't always BSOD on start-up so it Is hard to debug by just unplugging them.

I ran Windows Verifier for 3rd party drivers and 0 faults were found.


Speccy: http://speccy.pirifo...M5hiRpEyhltMcOm
Minidumps attached

Thanks for any help
 

 

EDIT: I have also ran memtest with 0 errors, the Intel error checker thing which all passed, and chkdsk which passed. Also ran sfc /scannow and it said there was corrupt files so I am continuing to run that

 

Attached Files

•  Dumps.zip   750.88KB   371 downloads

Edited by TheArtieChoke, 15 May 2015 - 05:33 PM.

[Advertisements]

    TheArtieChoke,

 

There are various causes of the crashes, they include the AV, corrupted memory, explorer.exe, and csrss.exe to name just four of them.

 

Suggestions to begin with, run SFC at least 3 or 4 times to see it all errors are repaired and disable the following scheduled updates;

 

Scheduler

16/05/2015 10:22 AM;: GoogleUpdateTaskMachineUA

16/05/2015 11:59 AM;: AutoPico Daily Restart

16/05/2015 3:55 PM;: ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d

16/05/2015 7:22 PM;: GoogleUpdateTaskMachineCore

Adobe Acrobat Update Task

CCleanerSkipUAC

ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon

Optimize Start Menu Cache Files-S-1-5-21-4046617586-1747845561-1028137369-1001

 

When you post back with an update can you tell us how the computer connects to the internet at work as in wireless router or an ethernet cable and what do the following scheduled updates relate to;

 

17/05/2015 2:50 AM;: Create OLD Daily

19/05/2015 3:00 AM;: BackUp Monday

19/05/2015 3:05 AM;: BackUp OD Monday

20/05/2015 3:00 AM;: BackUp Tuesday

20/05/2015 3:05 AM;: BackUp OD Tuesday

21/05/2015 3:00 AM;: BackUp Wednesday

21/05/2015 3:05 AM;: BackUp OD Wednesday

22/05/2015 3:00 AM;: BackUp Thursday

22/05/2015 3:05 AM;: BackUp OD Thursday

23/05/2015 3:00 AM;: BackUp Friday

23/05/2015 3:05 AM;: BackUp OD Friday

 

[phillpower2]

    TheArtieChoke,

 

There are various causes of the crashes, they include the AV, corrupted memory, explorer.exe, and csrss.exe to name just four of them.

 

Suggestions to begin with, run SFC at least 3 or 4 times to see it all errors are repaired and disable the following scheduled updates;

 

Scheduler

16/05/2015 10:22 AM;: GoogleUpdateTaskMachineUA

16/05/2015 11:59 AM;: AutoPico Daily Restart

16/05/2015 3:55 PM;: ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d

16/05/2015 7:22 PM;: GoogleUpdateTaskMachineCore

Adobe Acrobat Update Task

CCleanerSkipUAC

ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon

Optimize Start Menu Cache Files-S-1-5-21-4046617586-1747845561-1028137369-1001

 

When you post back with an update can you tell us how the computer connects to the internet at work as in wireless router or an ethernet cable and what do the following scheduled updates relate to;

 

17/05/2015 2:50 AM;: Create OLD Daily

19/05/2015 3:00 AM;: BackUp Monday

19/05/2015 3:05 AM;: BackUp OD Monday

20/05/2015 3:00 AM;: BackUp Tuesday

20/05/2015 3:05 AM;: BackUp OD Tuesday

21/05/2015 3:00 AM;: BackUp Wednesday

21/05/2015 3:05 AM;: BackUp OD Wednesday

22/05/2015 3:00 AM;: BackUp Thursday

22/05/2015 3:05 AM;: BackUp OD Thursday

23/05/2015 3:00 AM;: BackUp Friday

23/05/2015 3:05 AM;: BackUp OD Friday

 

[TheArtieChoke]

Hi, thanks for the reply.

 

So I disabled all requested schedules. The Back Up files just move files around using SyncToy. The ones with OD in it move the selected folder to OneDrive and the other one sends the folder to another computer on the network. Create Old just runs a script to create the backup file.


I will continue to run SFC /scannow for the while but I can't even get DISM ... /RestoreHealth to use a local source to get files, let alone download them from Windows Update.

 

I ran Memtest+ another 2 passes and returned 0 errors and chkdsk /r which ran at startup and this caused another BSOD so I am not sure when drivers are loaded but that could help.

Thanks again


EDIT: The computer is connected via Ethernet at work and home. I should mention that the BSOD are happening at home now as well

Attached Files

•  More Dumps.zip   104.33KB   350 downloads

Edited by TheArtieChoke, 16 May 2015 - 05:51 AM.

[phillpower2]

SyncToy information acknowledged 

As the issue is now happening at home this is less likely but not impossible to be the cause, while I look at the latest dumps some info for you below.

 

If you are presently running SFC allow it to finish then run the Windows all in one repair tool, details below;

 

To see if this is a Windows issue download then run the All in One Repair from here, disregard the malware guidance but follow the other steps to the letter and in particular ensuring that you first create a new restore point and perform a proper Windows clean boot before running the repair, details for the clean boot here.

 

 

NB: There is nothing at present to suggest that there is an issue with the Ram, it may at some point though be necessary to test each stick individually.

 

You are welcome btw 

[TheArtieChoke]

So I ran the Repair Tool, did the clean boot as well as running in Safe Mode with Networking. Only thing that failed was the sfc as it still reports errors. 

 

I have two identical computers at work. The only real difference is the schedules and SyncToy. Also the other computer uses wifi and connects to different printer. But never thought that SyncToy could be a problem. 

So I guess I will let the computer run all night and see if it BSODs

[phillpower2]

If SFC is still reporting errors the OS may be corrupt or alternatively the HDD may have issues, the latter can sometimes be reported as a memory issue in the mini dumps which incidentally your last crash dump suggested bad memory, see what I have highlighted in red below;

 

SYSTEM_SERVICE_EXCEPTION (3b)

An exception happened while executing a system service routine.

Arguments:

Arg1: 00000000c0000005, Exception code that caused the bugcheck

Arg2: fffff80057065df9, Address of the instruction which caused the bugcheck

Arg3: ffffd00020313db0, Address of the context record for the exception that caused the bugcheck

Arg4: 0000000000000000, zero.

 

Debugging Details:

------------------

 

TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2

 

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

 

FAULTING_IP: 

nt!MiProtectPrivateMemory+b1

fffff800`57065df9 4c89442450      mov     qword ptr [rsp+50h],r8

 

CONTEXT:  ffffd00020313db0 -- (.cxr 0xffffd00020313db0)

rax=fffff6803e765cc8 rbx=0000007cecb99000 rcx=0000098000000000

rdx=0000007ffffffff8 rsi=0000000000000001 rdi=0000000000000000

rip=fffff80057065df9 rsp=ffffd000203147e0 rbp=ffffd000203148e0

 r8=0000007cecb99fff  r9=0000000000000001 r10=0000070000000000

r11=0000007fffffffff r12=ffffe00084368080 r13=ffffe0008325b640

r14=fffff6803e765cc8 r15=ffffe00084047ec0

iopl=0         nv up ei pl zr na po nc

cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246

nt!MiProtectPrivateMemory+0xb1:

fffff800`57065df9 4c89442450      mov     qword ptr [rsp+50h],r8 ss:0018:ffffd000`20314830=0000000000000000

Resetting default scope

 

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

 

BUGCHECK_STR:  0x3B

 

PROCESS_NAME:  svchost.exe

 

CURRENT_IRQL:  0

 

LAST_CONTROL_TRANSFER:  from fffff800574c454f to fffff80057065df9

 

STACK_TEXT:  

ffffd000`203147e0 fffff800`574c454f : 00000000`07cecb99 ffffd000`20314a28 00000000`00000000 7fffffff`fffffffc : nt!MiProtectPrivateMemory+0xb1

ffffd000`203149c0 fffff800`573b7b91 : ffffe000`84368080 ffffe000`84368080 ffffd000`20314b18 ffffd000`20314b08 : nt!MiProtectVirtualMemory+0x52f

ffffd000`20314ac0 fffff800`571774b3 : ffffd000`00000000 0000007c`000003e8 00000000`00000000 0000007c`eb44dc18 : nt!NtProtectVirtualMemory+0x155

ffffd000`20314b90 00007ffe`703b16ca : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13

0000007c`eb44dbf8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7ffe`703b16ca

 

 

FOLLOWUP_IP: 

nt!MiProtectPrivateMemory+b1

fffff800`57065df9 4c89442450      mov     qword ptr [rsp+50h],r8

 

SYMBOL_STACK_INDEX:  0

 

SYMBOL_NAME:  nt!MiProtectPrivateMemory+b1

 

FOLLOWUP_NAME:  MachineOwner

 

MODULE_NAME: nt

 

DEBUG_FLR_IMAGE_TIMESTAMP:  550f41a6

 

STACK_COMMAND:  .cxr 0xffffd00020313db0 ; kb

 

IMAGE_NAME:  memory_corruption

 

FAILURE_BUCKET_ID:  X64_0x3B_nt!MiProtectPrivateMemory+b1

 

BUCKET_ID:  X64_0x3B_nt!MiProtectPrivateMemory+b1

 

Followup: MachineOwner

 

Worth mentioning is that the reported PROCESS_NAME:  svchost.exe is not telling us anything helpful about the crash as it does not name a specific service as the cause

 

Can you check to see is a CBS log has been created by the last SFC, see below;

 

Navigate to C:\Windows\Logs\CBS folder. You'll see CBS.log file.

The file may be large so upload it to http://www.mediafire.com/ and then post the download link here.

 

How to use mediafire  http://en.kioskea.ne...es-to-mediafire

 

Once the above has been done test the HDD with Seatools for Windows, if available do both the short and extended tests please, details here


 

[TheArtieChoke]

Yeah SFC is still reporting errors. Mediafire isn't behaving properly and isn't starting the upload so I zipped up CBS and uploaded it here.

 

First short task with Seagate returned back okay, will do extended now
 

Attached Files

•  CBS.zip   310.95KB   332 downloads

[phillpower2]

I still see a lot of errors in the log  if neither of the two suggestions below help it may be necessary to do a system refresh, a refresh is intended to repair Windows without affecting your personal data or system settings.

 

Method 1: Run the Windows Update troubleshooter

1. A.- Open the Windows Update troubleshooter by swiping in from the right edge of the screen, tapping Search (or if you're using a mouse, pointing to the upper-right corner of the screen, moving the mouse pointer down, and then clicking Search), entering Troubleshooting in the search box, tapping or clicking Settings, and then tapping or clicking Troubleshooting. Under System and Security, tap or click Fix problems with Windows Update.

2. B. - Run the troubleshooter, then open Windows Update and try to install any important updates again.

 

Method 2: Run the DISM tool

1. A.- Swipe in from the right edge of the screen, and then tap Search.
   (If you're using a mouse, point to the upper-right corner of the screen, move the mouse pointer down, and then click Search.)

2. B.- Enter command prompt in the search box.

3. C.- In the list of results, swipe down on or right-click Command Prompt, and then tap or click Run as administrator.

4. D.- In the Administrator: Command Prompt window, type the following commands. Press the Enter key after each command:

   DISM.exe /Online /Cleanup-image /Scanhealth

   DISM.exe /Online /Cleanup-image /Restorehealth

5. E.- To close the Administrator: Command Prompt window, type Exit, and then press Enter.

6. F.- Run Windows Update again.

HDD short test details acknowledged 

[TheArtieChoke]

Alright will do

While the DISM task runs, I will let you know that I have tried to do a Refresh but it fails each time, either from booting into the troubleshooter or from running setup during Windows. Just says it cant be completed. Is this due to having all the Updates installed? Should I uninstall all Windows Updates and try again?

Or is this a case of Windows is that corrupt that it has given up all hope of living again?

The option to clean install is there since I am reliant on one program really and that is an easy install but rather save myself the hassle if possible

Thanks


 

[phillpower2]

A fresh install is always a last resort for us to suggest unless it is blindingly obvious that it is what is required, I am concerned as to how Windows has come to be in this state and now that we know that a refresh has not worked previously I am leaning towards the possibility that you may need the malware forum/s.

 

Let us know how the extended HDD test goes/went and likewise for the DISM tool please.

 

You are welcome 

[TheArtieChoke]

So the extended HDD check passed.

 

DISM ... /Scanhealth came back saying it is repairable so I ran DISM ... /Restorehealth but gave error 0x800f0906 basically meaning it cant download required files. Ran it against my install disc as a source but still got an error

 

[TheArtieChoke]

Alright,

 

So I have fixed the corruption issues. This article and the provided downloads did it for me: http://thetechcookbo...-corrupt-files/

So now I am just cleaning the computer all up for work tomorrow to see if it BSODs still but hopefully since sfc comes back all clear now, it will be fine. Thank you so much for your help, I will mark as solved after a few days of continued running without BSOD but you have been a huge help
 

 

EDIT: I attached the output of attached script to show what it did, I get what it did basically but for anyone following this or if someone stumbles across

 

Attached Files

•  SFCFix.txt   4.54KB   424 downloads

Edited by TheArtieChoke, 17 May 2015 - 02:06 AM.

[phillpower2]

Best Answer

Thanks for the update and the included fix 

 

Hopefully there will be no further problems but if there are dont hesitate to come back here, either way please do let us know how things go.

[TheArtieChoke]

I am going to assume this is now solved, as there has been no crashes since after 24/7 uptime.

Thanks heaps phillpower2 for all your help! 

[phillpower2]

You are most welcome and thank you for concluding your thread TheArtieChoke, the information that you have provided may help others