Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

USB Driver BSOD bugcode 0xfe(08,06,a,....)

Started by usb_wreck , Feb 20 2017 06:36 PM

Please log in to reply

#1
usb_wreck

Posted 20 February 2017 - 06:36 PM

New Member

Member
5 posts

Getting 0xfe bugcode with increasing regularity

they mostly seem to have these parameters

Bug Check String : BUGCODE_USB_DRIVER

Bug Check Code : 0x000000fe

Parameter 1 : 00000000`00000008

Parameter 2 : 00000000`00000006

Parameter 3 : 00000000`0000000a

Parameter 4 : fffffa80`125587a0

where parameter 4 changes

I can't find reference to Parameter 3 = a

I have already tried uninstalling all usb devices then reinstalling to get latest drivers

Thanks in advance for any suggestions

Here is a dump of the most recent crashes from Bluescreenview

==================================================

Dump File : 022017-7488-01.dmp

Crash Time : 2/20/2017 6:16:05 PM

Bug Check String : BUGCODE_USB_DRIVER

Bug Check Code : 0x000000fe

Parameter 1 : 00000000`00000008

Parameter 2 : 00000000`00000006

Parameter 3 : 00000000`0000000a

Parameter 4 : fffffa80`125587a0

Caused By Driver : Wdf01000.sys

Caused By Address : Wdf01000.sys+b1e6

File Description : Kernel Mode Driver Framework Runtime

Product Name : Microsoft® Windows® Operating System

Company : Microsoft Corporation

File Version : 1.11.9200.16384 (win8_rtm.120725-1247)

Processor : x64

Crash Address : ntoskrnl.exe+70400

Stack Address 1 :

Stack Address 2 :

Stack Address 3 :

Computer Name :

Full Path : C:\Windows\Minidump\022017-7488-01.dmp

Processors Count : 8

Major Version : 15

Minor Version : 7601

Dump File Size : 425,219

Dump File Time : 2/20/2017 6:45:02 PM

==================================================

Dump File : 022017-7675-01.dmp

Crash Time : 2/20/2017 7:23:09 AM

Bug Check String : BUGCODE_USB_DRIVER

Bug Check Code : 0x000000fe

Parameter 1 : 00000000`00000008

Parameter 2 : 00000000`00000006

Parameter 3 : 00000000`0000000a

Parameter 4 : fffffa80`1252a7a0

Caused By Driver : ntoskrnl.exe

Caused By Address : ntoskrnl.exe+70400

File Description : NT Kernel & System

Product Name : Microsoft® Windows® Operating System

Company : Microsoft Corporation

File Version : 6.1.7601.23572 (win7sp1_ldr.161011-0600)

Processor : x64

Crash Address : ntoskrnl.exe+70400

Stack Address 1 :

Stack Address 2 :

Stack Address 3 :

Computer Name :

Full Path : C:\Windows\Minidump\022017-7675-01.dmp

Processors Count : 8

Major Version : 15

Minor Version : 7601

Dump File Size : 425,987

Dump File Time : 2/20/2017 3:16:04 PM

==================================================

Dump File : 012117-7316-01.dmp

Crash Time : 1/20/2017 11:38:12 PM

Bug Check String : BUGCODE_USB_DRIVER

Bug Check Code : 0x000000fe

Parameter 1 : 00000000`00000008

Parameter 2 : 00000000`00000006

Parameter 3 : 00000000`0000000a

Parameter 4 : fffffa80`12e107a0

Caused By Driver : ntoskrnl.exe

Caused By Address : ntoskrnl.exe+70400

File Description : NT Kernel & System

Product Name : Microsoft® Windows® Operating System

Company : Microsoft Corporation

File Version : 6.1.7601.23572 (win7sp1_ldr.161011-0600)

Processor : x64

Crash Address : ntoskrnl.exe+70400

Stack Address 1 :

Stack Address 2 :

Stack Address 3 :

Computer Name :

Full Path : C:\Windows\Minidump\012117-7316-01.dmp

Processors Count : 8

Major Version : 15

Minor Version : 7601

Dump File Size : 424,707

Dump File Time : 1/21/2017 12:17:55 AM

==================================================

Dump File : 011817-7612-01.dmp

Crash Time : 1/18/2017 7:15:11 AM

Bug Check String : BUGCODE_USB_DRIVER

Bug Check Code : 0x000000fe

Parameter 1 : 00000000`00000008

Parameter 2 : 00000000`00000006

Parameter 3 : 00000000`0000000a

Parameter 4 : fffffa80`12e7f7a0

Caused By Driver : ntoskrnl.exe

Caused By Address : ntoskrnl.exe+70400

File Description : NT Kernel & System

Product Name : Microsoft® Windows® Operating System

Company : Microsoft Corporation

File Version : 6.1.7601.23572 (win7sp1_ldr.161011-0600)

Processor : x64

Crash Address : ntoskrnl.exe+70400

Stack Address 1 :

Stack Address 2 :

Stack Address 3 :

Computer Name :

Full Path : C:\Windows\Minidump\011817-7612-01.dmp

Processors Count : 8

Major Version : 15

Minor Version : 7601

Dump File Size : 424,835

Dump File Time : 1/18/2017 8:35:51 AM

==================================================

Dump File : 011717-6910-01.dmp

Crash Time : 1/16/2017 10:36:48 PM

Bug Check String : BUGCODE_USB_DRIVER

Bug Check Code : 0x000000fe

Parameter 1 : 00000000`00000008

Parameter 2 : 00000000`00000006

Parameter 3 : 00000000`0000000a

Parameter 4 : fffffa80`12a627a0

Caused By Driver : ntoskrnl.exe

Caused By Address : ntoskrnl.exe+70400

File Description : NT Kernel & System

Product Name : Microsoft® Windows® Operating System

Company : Microsoft Corporation

File Version : 6.1.7601.23572 (win7sp1_ldr.161011-0600)

Processor : x64

Crash Address : ntoskrnl.exe+70400

Stack Address 1 :

Stack Address 2 :

Stack Address 3 :

Computer Name :

Full Path : C:\Windows\Minidump\011717-6910-01.dmp

Processors Count : 8

Major Version : 15

Minor Version : 7601

Dump File Size : 424,707

Dump File Time : 1/17/2017 12:34:07 PM

==================================================

Dump File : 011617-38001-01.dmp

Crash Time : 1/16/2017 6:34:04 AM

Bug Check String : BUGCODE_USB_DRIVER

Bug Check Code : 0x000000fe

Parameter 1 : 00000000`00000008

Parameter 2 : 00000000`00000006

Parameter 3 : 00000000`0000000a

Parameter 4 : fffffa80`130397a0

Caused By Driver : tunnel.sys

Caused By Address : tunnel.sys+43fb14

File Description : Microsoft Tunnel Interface Driver

Product Name : Microsoft® Windows® Operating System

Company : Microsoft Corporation

File Version : 6.1.7600.16385 (win7_rtm.090713-1255)

Processor : x64

Crash Address : ntoskrnl.exe+70400

Stack Address 1 :

Stack Address 2 :

Stack Address 3 :

Computer Name :

Full Path : C:\Windows\Minidump\011617-38001-01.dmp

Processors Count : 8

Major Version : 15

Minor Version : 7601

Dump File Size : 424,963

Dump File Time : 1/16/2017 11:29:50 AM

==================================================

Dump File : 122516-7207-01.dmp

Crash Time : 12/25/2016 10:19:15 PM

Bug Check String : IRQL_NOT_LESS_OR_EQUAL

Bug Check Code : 0x0000000a

Parameter 1 : fffffa80`1fb74370

Parameter 2 : 00000000`00000002

Parameter 3 : 00000000`00000001

Parameter 4 : fffff800`02f954b6

Caused By Driver : ntoskrnl.exe

Caused By Address : ntoskrnl.exe+70400

File Description : NT Kernel & System

Product Name : Microsoft® Windows® Operating System

Company : Microsoft Corporation

File Version : 6.1.7601.23572 (win7sp1_ldr.161011-0600)

Processor : x64

Crash Address : ntoskrnl.exe+70400

Stack Address 1 :

Stack Address 2 :

Stack Address 3 :

Computer Name :

Full Path : C:\Windows\Minidump\122516-7207-01.dmp

Processors Count : 8

Major Version : 15

Minor Version : 7601

Dump File Size : 352,043

Dump File Time : 12/25/2016 10:20:30 PM

==================================================

Dump File : 120816-7129-01.dmp

Crash Time : 12/8/2016 4:16:53 PM

Bug Check String : BUGCODE_USB_DRIVER

Bug Check Code : 0x000000fe

Parameter 1 : 00000000`00000008

Parameter 2 : 00000000`00000006

Parameter 3 : 00000000`0000000a

Parameter 4 : fffffa80`0fbd07a0

Caused By Driver : usbccgp.sys

Caused By Address : usbccgp.sys+d69b14

File Description : USB Common Class Generic Parent Driver

Product Name : Microsoft® Windows® Operating System

Company : Microsoft Corporation

File Version : 6.1.7601.23529 (win7sp1_ldr.160816-0600)

Processor : x64

Crash Address : ntoskrnl.exe+70400

Stack Address 1 :

Stack Address 2 :

Stack Address 3 :

Computer Name :

Full Path : C:\Windows\Minidump\120816-7129-01.dmp

Processors Count : 8

Major Version : 15

Minor Version : 7601

Dump File Size : 424,651

Dump File Time : 12/8/2016 4:18:13 PM

==================================================

Dump File : 112516-9500-01.dmp

Crash Time : 11/25/2016 11:54:23 AM

Bug Check String : BUGCODE_USB_DRIVER

Bug Check Code : 0x000000fe

Parameter 1 : 00000000`00000008

Parameter 2 : 00000000`00000006

Parameter 3 : 00000000`0000000a

Parameter 4 : fffffa80`0f4e87a0

Caused By Driver : ntoskrnl.exe

Caused By Address : ntoskrnl.exe+70400

File Description : NT Kernel & System

Product Name : Microsoft® Windows® Operating System

Company : Microsoft Corporation

File Version : 6.1.7601.23572 (win7sp1_ldr.161011-0600)

Processor : x64

Crash Address : ntoskrnl.exe+70400

Stack Address 1 :

Stack Address 2 :

Stack Address 3 :

Computer Name :

Full Path : C:\Windows\Minidump\112516-9500-01.dmp

Processors Count : 8

Major Version : 15

Minor Version : 7601

Dump File Size : 424,651

Dump File Time : 11/25/2016 1:41:15 PM

==================================================

Dump File : 111516-9516-01.dmp

Crash Time : 11/14/2016 11:00:20 PM

Bug Check String : BUGCODE_USB_DRIVER

Bug Check Code : 0x000000fe

Parameter 1 : 00000000`00000008

Parameter 2 : 00000000`00000006

Parameter 3 : 00000000`0000000a

Parameter 4 : fffffa80`0f4eb7a0

Caused By Driver : ntoskrnl.exe

Caused By Address : ntoskrnl.exe+70400

File Description : NT Kernel & System

Product Name : Microsoft® Windows® Operating System

Company : Microsoft Corporation

File Version : 6.1.7601.23572 (win7sp1_ldr.161011-0600)

Processor : x64

Crash Address : ntoskrnl.exe+70400

Stack Address 1 :

Stack Address 2 :

Stack Address 3 :

Computer Name :

Full Path : C:\Windows\Minidump\111516-9516-01.dmp

Processors Count : 8

Major Version : 15

Minor Version : 7601

Dump File Size : 424,651

Dump File Time : 11/15/2016 2:56:11 PM

==================================================

#2
RKinner

Posted 20 February 2017 - 10:28 PM

Malware Expert

Expert
24,624 posts

Get the free version of Speccy:

http://www.filehippo...download_speccy (Look in the upper right for the Download

Latest Version button - Do NOT press the large Start Download button on the upper left!)

Download, Save and Install it. Tell it you do not need CCLEANER if it asks. Run Speccy. When it finishes (the little icon in the bottom left will stop moving),

File, Save as Text File, (to your desktop) note the name it gives. OK. Open the file in notepad and delete the line that gives the serial number of your Operating System.

(It will be near the top, 10-20 lines down.) Save the file. Attach the file to your next post. Attaching the log is the best option as it is too big for the forum. Attaching is a multi step process.

First click on More Reply Options

Then scroll down to where you see

Choose File and click on it. Point it at the file and hit Open.

Now click on Attach this file.

Get Process Explorer

http://live.sysinter...com/procexp.exe

Save it to your desktop then run it (Vista or Win7 - right click and Run As Administrator).

View, Select Column, check Verified Signer, OK

Options, Verify Image Signatures

Click twice on the CPU column header to sort things by CPU usage with the big hitters at the top.

Wait a full minute then:

File, Save As, Save. Note the file name. Open the file on your desktop and copy and paste the text to a reply.

#3
usb_wreck

Posted 22 February 2017 - 04:37 PM

New Member

Topic Starter
Member
5 posts

rkinner, thanks

here is text from procexp

sorry but can't find button to attach file to this msg - where is it?

PROCEXP

Process CPU Private Bytes Working Set PID Description Company Name VirusTotal Verified Signer

System Idle Process 97.43 0 K 24 K 0

System 0.55 140 K 728 K 4

procexp64.exe 0.34 44,744 K 70,880 K 3236 Sysinternals Process Explorer Sysinternals - www.sysinternals.com 0/56 (Verified) Microsoft Corporation

WmiPrvSE.exe 0.31 7,092 K 11,788 K 6212 WMI Provider Host Microsoft Corporation 0/59 (Verified) Microsoft Windows

Speccy64.exe 0.25 32,160 K 56,560 K 1536 Speccy Piriform Ltd 0/58 (Verified) Piriform Ltd

Interrupts 0.21 0 K 0 K n/a Hardware Interrupts and DPCs

taskmgr.exe 0.17 4,136 K 11,448 K 1652 Windows Task Manager Microsoft Corporation 0/59 (Verified) Microsoft Windows

svchost.exe 0.10 39,060 K 55,352 K 464 Host Process for Windows Services Microsoft Corporation 0/57 (Verified) Microsoft Windows

rf-chrome-nm-host.exe 0.07 16,168 K 25,576 K 7024 rf-chrome-nm-host Siber Systems Inc. 0/59 (Verified) Siber Systems

chrome.exe 0.06 150,232 K 166,132 K 6096 Google Chrome Google Inc. 0/59 (Verified) Google Inc

LCore.exe 0.06 33,392 K 48,008 K 4152 Logitech Gaming Framework Logitech Inc. 0/59 (Verified) Logitech Inc

chrome.exe 0.05 124,744 K 199,180 K 5412 Google Chrome Google Inc. 0/59 (Verified) Google Inc

mbam.exe 0.05 28,920 K 50,112 K 3584 Malwarebytes Anti-Malware Malwarebytes 0/58 (Verified) Malwarebytes Corporation

id_tray.exe 0.05 38,300 K 49,840 K 4916 IDrive Tray Prosoftnet 0/58 (Verified) Pro Softnet Corporation

explorer.exe 0.04 39,904 K 66,000 K 2732 Windows Explorer Microsoft Corporation 0/58 (Verified) Microsoft Windows

vpnui.exe 0.04 6,184 K 17,404 K 4788 Cisco AnyConnect User Interface Cisco Systems, Inc. 0/57 (Verified) Cisco Systems

csrss.exe 0.03 66,028 K 37,472 K 720 Client Server Runtime Process Microsoft Corporation 0/59 (Verified) Microsoft Windows

dllhost.exe 0.02 3,336 K 8,120 K 6708 COM Surrogate Microsoft Corporation 0/59 (Verified) Microsoft Windows

id_service.exe 0.02 69,388 K 50,468 K 5704 IDrive Service Prosoftnet 0/55 (Verified) Pro Softnet Corporation

WmiPrvSE.exe 0.02 26,188 K 32,480 K 4108 WMI Provider Host Microsoft Corporation 0/59 (Verified) Microsoft Windows

svchost.exe 0.02 6,496 K 8,132 K 2444 Host Process for Windows Services Microsoft Corporation 0/57 (Verified) Microsoft Windows

robotaskbaricon.exe 0.01 13,704 K 25,332 K 4860 RoboForm TaskBar Icon Siber Systems 0/58 (Verified) Siber Systems

CCleaner64.exe 0.01 9,228 K 16,744 K 4500 CCleaner Piriform Ltd 0/58 (Verified) Piriform Ltd

chrome.exe 0.01 131,828 K 217,064 K 7492 Google Chrome Google Inc. 0/59 (Verified) Google Inc

svchost.exe 0.01 6,368 K 10,308 K 172 Host Process for Windows Services Microsoft Corporation 0/57 (Verified) Microsoft Windows

nis.exe 0.01 125,540 K 29,840 K 3292 Norton Internet Security Symantec Corporation 0/59 (Verified) Symantec Corporation

GWX_control_panel.exe 0.01 2,356 K 7,784 K 3252 GWX Control Panel - Closes and configures the 'Get Windows 10' system tray application. UltimateOutsider 0/54 (Verified) Josh Mayfield

LCDClock.exe 0.01 4,876 K 9,948 K 4820 Logitech LCD Clock/Performance Monitor Logitech Inc. 0/56 (Verified) Logitech Inc

svchost.exe < 0.01 21,572 K 24,612 K 456 Host Process for Windows Services Microsoft Corporation 0/57 (Verified) Microsoft Windows

LCDMedia.exe < 0.01 8,000 K 10,240 K 4368 Logitech G-series Media Display Logitech Inc. 0/57 (Verified) Logitech Inc

chrome.exe < 0.01 35,180 K 40,376 K 6656 Google Chrome Google Inc. 0/59 (Verified) Google Inc

svchost.exe < 0.01 5,880 K 10,120 K 6084 Host Process for Windows Services Microsoft Corporation 0/57 (Verified) Microsoft Windows

WmiApSrv.exe < 0.01 2,740 K 6,972 K 6856 WMI Performance Reverse Adapter Microsoft Corporation 0/59 (Verified) Microsoft Windows

J2GDllCmd.exe < 0.01 1,136 K 4,172 K 4604 eFax Messenger - DLL Command Utility j2 Global, Inc. 2/57 (No signature was present in the subject) j2 Global, Inc.

chrome.exe < 0.01 111,344 K 78,676 K 4824 Google Chrome Google Inc. 0/59 (Verified) Google Inc

FSCAppServ.exe < 0.01 2,952 K 4,760 K 1576 Intel® Desktop Boards Fan Speed Control Instrumentation Service Intel Corporation 0/57 (Verified) Channel Innovations and Solutions Division

PDFProFiltSrvPP.exe < 0.01 2,968 K 7,696 K 2364 PDFPro IFilter Service Nuance Communications, Inc. 0/56 (Verified) Nuance Communications

cvpnd.exe < 0.01 2,984 K 7,416 K 1980 Cisco Systems VPN Client Cisco Systems, Inc. 0/59 (Verified) Cisco Systems

taskhost.exe < 0.01 21,700 K 13,644 K 3808 Host Process for Windows Tasks Microsoft Corporation 0/59 (Verified) Microsoft Windows

EvernoteClipper.exe < 0.01 2,012 K 6,228 K 4256 Evernote Clipper Evernote Corp., 305 Walnut Street, Redwood City, CA 94063 0/59 (Verified) EVERNOTE CORPORATION

svchost.exe < 0.01 9,900 K 17,468 K 564 Host Process for Windows Services Microsoft Corporation 0/57 (Verified) Microsoft Windows

svchost.exe < 0.01 25,684 K 18,676 K 1316 Host Process for Windows Services Microsoft Corporation 0/57 (Verified) Microsoft Windows

officeclicktorun.exe < 0.01 30,176 K 39,900 K 1884 Microsoft Office Click-to-Run Microsoft Corporation 0/59 (Verified) Microsoft Corporation

nis.exe < 0.01 26,936 K 10,724 K 4728 Norton Internet Security Symantec Corporation 0/59 (Verified) Symantec Corporation

SearchIndexer.exe < 0.01 54,032 K 48,196 K 5320 Microsoft Windows Search Indexer Microsoft Corporation 0/57 (Verified) Microsoft Windows

nvxdsync.exe < 0.01 13,068 K 25,816 K 1716 NVIDIA User Experience Driver Component NVIDIA Corporation 0/58 (Verified) NVIDIA Corporation

SearchProtocolHost.exe < 0.01 5,664 K 12,968 K 5780 Microsoft Windows Search Protocol Host Microsoft Corporation 0/59 (Verified) Microsoft Windows

explorer.exe < 0.01 130,400 K 56,660 K 6720 Windows Explorer Microsoft Corporation 0/58 (Verified) Microsoft Windows

svchost.exe < 0.01 10,960 K 22,208 K 628 Host Process for Windows Services Microsoft Corporation 0/57 (Verified) Microsoft Windows

spoolsv.exe < 0.01 9,396 K 15,840 K 1484 Spooler SubSystem App Microsoft Corporation 0/58 (Verified) Microsoft Windows

WUDFHost.exe 2,484 K 6,712 K 2476 Windows Driver Foundation - User-mode Driver Framework Host Process Microsoft Corporation 0/59 (Verified) Microsoft Windows

WmiPrvSE.exe 13,596 K 22,460 K 3328 WMI Provider Host Microsoft Corporation 0/59 (Verified) Microsoft Windows

winlogon.exe 4,212 K 8,708 K 1412 Windows Logon Application Microsoft Corporation 0/59 (Verified) Microsoft Windows

wininit.exe 2,084 K 5,196 K 696 Windows Start-Up Application Microsoft Corporation 0/59 (Verified) Microsoft Windows

vpnagent.exe 6,456 K 15,412 K 1288 VPN Agent Service Cisco Systems, Inc. 0/56 (Verified) Cisco Systems

taskeng.exe 2,724 K 6,216 K 7780 Task Scheduler Engine Microsoft Corporation 0/59 (Verified) Microsoft Windows

svchost.exe 21,296 K 15,904 K 5976 Host Process for Windows Services Microsoft Corporation 0/57 (Verified) Microsoft Windows

svchost.exe 6,420 K 12,056 K 888 Host Process for Windows Services Microsoft Corporation 0/57 (Verified) Microsoft Windows

svchost.exe 13,864 K 18,772 K 1564 Host Process for Windows Services Microsoft Corporation 0/57 (Verified) Microsoft Windows

svchost.exe 2,836 K 6,508 K 1384 Host Process for Windows Services Microsoft Corporation 0/57 (Verified) Microsoft Windows

svchost.exe 3,556 K 7,028 K 1132 Host Process for Windows Services Microsoft Corporation 0/57 (Verified) Microsoft Windows

svchost.exe 4,852 K 8,252 K 1260 Host Process for Windows Services Microsoft Corporation 0/57 (Verified) Microsoft Windows

smss.exe 784 K 1,492 K 368 Windows Session Manager Microsoft Corporation 0/59 (Verified) Microsoft Windows

services.exe 6,872 K 11,192 K 756 Services and Controller app Microsoft Corporation 0/59 (Verified) Microsoft Windows

SearchFilterHost.exe 2,984 K 6,224 K 7592 Microsoft Windows Search Filter Host Microsoft Corporation 0/59 (Verified) Microsoft Windows

rundll32.exe 2,200 K 1,380 K 5820 Windows host process (Rundll32) Microsoft Corporation 0/58 (Verified) Microsoft Windows

rundll32.exe 8,760 K 8,500 K 4564 Windows host process (Rundll32) Microsoft Corporation 0/58 (Verified) Microsoft Windows

RAVCpl64.exe 9,636 K 11,912 K 3140 Realtek HD Audio Manager Realtek Semiconductor 0/59 (Verified) Realtek Semiconductor Corp

procexp.exe 2,568 K 7,644 K 876 Sysinternals Process Explorer Sysinternals - www.sysinternals.com 0/57 (Verified) Microsoft Corporation

PrintIsolationHost.exe 1,968 K 5,016 K 1428 PrintIsolationHost Microsoft Corporation 0/58 (Verified) Microsoft Windows

prevhost.exe 4,308 K 9,956 K 3972 Preview Handler Surrogate Host Microsoft Corporation 0/58 (Verified) Microsoft Windows

pptd40nt.exe 2,960 K 7,892 K 4248 PaperPort Print to Desktop for NT Nuance Communications, Inc. 0/58 (Verified) Nuance Communications

ONENOTEM.EXE 5,556 K 1,568 K 4692 Send to OneNote Tool Microsoft Corporation 0/56 (Verified) Microsoft Corporation

nvvsvc.exe 3,848 K 8,836 K 960 NVIDIA Driver Helper Service, Version 372.90 NVIDIA Corporation 0/56 (Verified) NVIDIA Corporation

nvscpapisvr.exe 2,776 K 6,184 K 988 Stereo Vision Control Panel API Server NVIDIA Corporation 0/57 (Verified) NVIDIA Corporation

mbamservice.exe 411,712 K 321,248 K 2220 Malwarebytes Anti-Malware Malwarebytes 0/58 (Verified) Malwarebytes Corporation

mbamscheduler.exe 5,444 K 11,012 K 2116 Malwarebytes Anti-Malware Malwarebytes 0/59 (Verified) Malwarebytes Corporation

lsm.exe 3,344 K 5,292 K 788 Local Session Manager Service Microsoft Corporation 0/59 (Verified) Microsoft Windows

lsass.exe 8,472 K 15,348 K 780 Local Security Authority Process Microsoft Corporation 0/58 (Verified) Microsoft Windows

LogiRegistryService.exe 1,964 K 5,176 K 2064 Logitech Surround Sound Service Logitech Inc. 0/56 (Verified) Logitech Inc

jusched.exe 2,988 K 8,280 K 4448 Java Update Scheduler Oracle Corporation 0/56 (Verified) Oracle America

jucheck.exe 4,864 K 12,500 K 4928 Java Update Checker Oracle Corporation 0/59 (Verified) Oracle America

J2GTray.exe 3,388 K 7,700 K 5040 eFax Messenger - Tray j2 Global, Inc. 0/55 (No signature was present in the subject) j2 Global, Inc.

id_bglaunch.exe 25,872 K 25,084 K 4296 IDrive Background Prosoftnet 0/59 (Verified) Pro Softnet Corporation

GoogleUpdate.exe 2,360 K 1,632 K 1952 Google Installer Google Inc. 1/59 (Verified) Google Inc

dwm.exe 3,024 K 7,288 K 3956 Desktop Window Manager Microsoft Corporation 0/58 (Verified) Microsoft Windows

CTAudSvc.exe 1,436 K 4,684 K 1104 Creative Audio Service Creative Technology Ltd 0/56 (No signature was present in the subject) Creative Technology Ltd

csrss.exe 2,696 K 5,224 K 588 Client Server Runtime Process Microsoft Corporation 0/59 (Verified) Microsoft Windows

conhost.exe 1,884 K 4,480 K 6892 Console Window Host Microsoft Corporation 0/58 (Verified) Microsoft Windows

conhost.exe 1,876 K 4,472 K 6700 Console Window Host Microsoft Corporation 0/58 (Verified) Microsoft Windows

conathst.exe 3,060 K 7,388 K 7056 Web Browser (Norton Identity Safe native host) Symantec Corporation 0/59 (Verified) Symantec Corporation

cmd.exe 2,572 K 3,480 K 6620 Windows Command Processor Microsoft Corporation 0/59 (Verified) Microsoft Windows

cmd.exe 2,568 K 3,376 K 6864 Windows Command Processor Microsoft Corporation 0/59 (Verified) Microsoft Windows

chrome.exe 173,524 K 175,436 K 5328 Google Chrome Google Inc. 0/59 (Verified) Google Inc

chrome.exe 46,388 K 54,212 K 4664 Google Chrome Google Inc. 0/59 (Verified) Google Inc

chrome.exe 39,976 K 50,188 K 6500 Google Chrome Google Inc. 0/59 (Verified) Google Inc

chrome.exe 28,660 K 35,736 K 4288 Google Chrome Google Inc. 0/59 (Verified) Google Inc

chrome.exe 2,668 K 6,572 K 4516 Google Chrome Google Inc. 0/59 (Verified) Google Inc

chrome.exe 27,428 K 32,300 K 6336 Google Chrome Google Inc. 0/59 (Verified) Google Inc

chrome.exe 27,772 K 32,380 K 6176 Google Chrome Google Inc. 0/59 (Verified) Google Inc

chrome.exe 2,024 K 5,004 K 4996 Google Chrome Google Inc. 0/59 (Verified) Google Inc

chrome.exe 201,700 K 23,612 K 6896 Google Chrome Google Inc. 0/59 (Verified) Google Inc

audiodg.exe 15,984 K 17,488 K 1064 Windows Audio Device Graph Isolation Microsoft Corporation 0/59 (Verified) Microsoft Windows

armsvc.exe 1,324 K 4,208 K 1784 Adobe Acrobat Update Service Adobe Systems Incorporated 0/59 (Verified) Adobe Systems

Process: System Idle Process Pid: 0

Name Description Company Name Path VirusTotal Verified Signer

#4
usb_wreck

Posted 22 February 2017 - 05:01 PM

New Member

Topic Starter
Member
5 posts

finally found the attach option - not obvious (to me at least)

here is output from speccy

Attached Files

Speccy File.txt 145.17KB 403 downloads

#5
RKinner

Posted 22 February 2017 - 05:57 PM

Malware Expert

Expert
24,624 posts

Yes it's certainly not intuitive.

Speccy says it's running hot but lately speccy has been unreliable about temps so let's get a second opinion.

http://www.filehippo...nload_speedfan/

Download, save and Install it (Win 7+ or Vista right click and Run As Admin.) then run it (Win 7+ or Vista right click and Run As Admin.).

It will tell you your temps in real time tho the default is to show the hard drive temp in the systray. You can change it: Hit Configure then click on the highest temp and check Show in tray.

If it also says it over 50 at idle then I would shut it down. Leave it plugged in and open it up. Use a vacuum cleaner hose and a small brush to clean the interface between the heatsink and the fan. This usually gets clogged with dust. It's OK to remove the fan as long as you don't disturb the heatsink. If you remove the heatsink you have to replace the thermal fan. If you do remove the fan make sure you not which end is up.

Also clean any vents other fans.

With it still open. Fire it up and watch the CPU fan. IT should spin up to a good speed then it will usually slow down. It should not make any squeaky noises or be slow to start or you will need a new fan.

An overheating CPU will make mistakes and cause random blue screens so odds are that that's your problem.

#6
usb_wreck

Posted 23 February 2017 - 02:55 PM

New Member

Topic Starter
Member
5 posts

I have attached a png showing temps from SIW Pro which I have been using

It shows peak temps pretty high at 70-76 C but I thought that was well within the operating range for the 3770K

It's not overclocked but does have a low-profile cooler

I was focused on usb because that seems to be the culprit every time

Attached Thumbnails

#7
RKinner

Posted 23 February 2017 - 04:05 PM

Malware Expert

Expert
24,624 posts

More of your dumps are showing ntoskrnl.exe as the culprit. This is a Windows System file and usually when I see windows system files it's heat related. 71 isn't too bad but still could be a heat problem.

Could also be memory errors so you might want to run memtest86+ for 7 passes to rule out RAM errors: http://www.memtest.org/

Wouldn't hurt to do a full file system check:

1. Double-click My Computer, and then right-click the hard disk that you want to check. C:

2. Click Properties, and then click Tools.

3. Under Error-checking, click Check Now. A dialog box that shows the Check disk options is displayed,

4. Check both boxes and then click Start.

You will receive the following message:

The disk check could not be performed because the disk check utility needs exclusive access to some Windows files on the disk. These files can be accessed by restarting Windows. Do you want to schedule the disk check to occur the next time you restart the computer?

Click Yes to schedule the disk check, but don't restart yet.

Right click on (My) Computer and select Manage (Continue) Then the Event Viewer. Next select Windows Logs. Right click on System and Clear Log, Clear. Repeat for Application. Reboot. The disk check will run and will probably take an hour or more to finish.

Start, All Programs, Accessories then right click on Command Prompt and Run as Administrator. Then type (with an Enter after each line).

sfc /scannow

(SPACE after sfc. This will check your critical system files.

Copy the next two lines:

findstr  /c:"[SR]"  \windows\logs\cbs\cbs.log  >  \windows\logs\cbs\junk.txt

notepad \windows\logs\cbs\junk.txt

Start, All Programs, Accessories, right click on Command Prompt and Run as Administrator, Continue. Right click and Paste or Edit then Paste and the copied line should appear.

Hit Enter if notepad does not open. Copy and paste the text from notepad into a reply. Close notepad. Close the Command Window.

1. Please download the Event Viewer Tool by Vino Rosso

http://images.malwar...om/vino/VEW.exe

and save it to your Desktop:

2. Right-click VEW.exe and Run AS Administrator

3. Under 'Select log to query', select:

* System

4. Under 'Select type to list', select:

* Error

* Warning

Then use the 'Number of events' as follows:

1. Click the radio button for 'Number of events'

Type 20 in the 1 to 20 box

Then click the Run button.

Notepad will open with the output log.

Please post the Output log in your next reply then repeat but select Application. (Each time you run VEW it overwrites the log so copy the first one to a Reply or rename it before running it a second time.)