Daily BSODs in last week or so - STOP:0x0000001E

MisterTwister · 24 Mar 2015

Hi all

1st time poster, recent BSOD sufferer. Zip file attached. This has been happening for maybe a week, not sure. Only change to anything I'm aware of was updating my McAfee subscription from a CD. I'm also running composing software called Finale 2010 and it chugs to a halt and crashes. It's not exclusive to that, it just did it on the desktop yesterday with nothing running.

Thanks for your help!

koolkat77 · 25 Mar 2015

Welcome.

McAfee is known to cause BSOD's. Please remove it for testing purpose.

Code:

Start Menu\Programs\McAfee	Public:Start Menu\Programs\McAfee	Public

Revo Uninstaller:

Use Revo Uninstaller to uninstall stubborn software.

Download and install the software
Opt for Advance Mode while uninstalling which allows you to remove leftover registry.
Download Revo Uninstaller Freeware - Free and Full Download - Uninstall software, remove programs, solve uninstall problems

Microsoft Security Essentials is recommended from a strict BSOD perspective, compatibility & stability compared to other internet security software. Malwarebytes is a great combo to MSE. They are free and lightweight.

Also uninstall your existing Antivirus software before you install MSE.

Good and Free system security combination.

Warning

Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.

Clean boot

Troubleshoot Application Conflicts by Performing a Clean Startup

Reduce items at start-up. No software except anti-virus is required plus doing this improves the time for logging into windows:

How to Change, Add, or Remove Startup Programs in Windows 7

Run the System File Checker that scans the of all protected Windows 7 system files and replaces incorrect corrupted, changed/modified, or damaged versions with the correct versions if possible:

Click on the
Type CMD on Search
Left click and Run as Administrator
Type SFC /scannow

Full tutorial here:

SFC /SCANNOW Command - System File Checker

Code:

Microsoft (R) Windows Debugger Version 6.3.9600.16384 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\YUSSI\Downloads\Compressed\IAIN-PC-24_03_2015_210604_52\032415-5647-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.18741.amd64fre.win7sp1_gdr.150202-1526
Machine Name:
Kernel base = 0xfffff800`0284c000 PsLoadedModuleList = 0xfffff800`02a90890
Debug session time: Wed Mar 25 02:54:13.263 2015 (UTC + 6:00)
System Uptime: 0 days 3:15:41.153
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
................................................................
.....................................
Loading User Symbols
Loading unloaded module list
.................................................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff880036ad360, 1, 971}

*** WARNING: Unable to verify timestamp for RapportCerberus64_80128.sys
*** ERROR: Module load completed but symbols could not be loaded for RapportCerberus64_80128.sys
Probably caused by : RapportCerberus64_80128.sys ( RapportCerberus64_80128+80360 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff880036ad360, The address that the exception occurred at
Arg3: 0000000000000001, Parameter 0 of the exception
Arg4: 0000000000000971, Parameter 1 of the exception

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002afa100
GetUlongFromAddress: unable to read from fffff80002afa1c0
 0000000000000000 Nonpaged pool

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
RapportCerberus64_80128+80360
fffff880`036ad360 c681d104000000  mov     byte ptr [rcx+4D1h],0

BUGCHECK_STR:  0x1E_c0000005_R

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  chrome.exe

CURRENT_IRQL:  0

ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre

TRAP_FRAME:  fffff8800f1b4220 -- (.trap 0xfffff8800f1b4220)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=00000000000004a0
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff880036ad360 rsp=fffff8800f1b43b8 rbp=fffffa800a398930
 r8=0000000000000000  r9=0000000000000001 r10=0000000000000001
r11=fffff8800f1b41a0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
RapportCerberus64_80128+0x80360:
fffff880`036ad360 c681d104000000  mov     byte ptr [rcx+4D1h],0 ds:00000000`00000971=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000290c698 to fffff800028c0ec0

STACK_TEXT:  
fffff880`0f1b3998 fffff800`0290c698 : 00000000`0000001e ffffffff`c0000005 fffff880`036ad360 00000000`00000001 : nt!KeBugCheckEx
fffff880`0f1b39a0 fffff800`028c0542 : fffff880`0f1b4178 00000000`00000000 fffff880`0f1b4220 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x487ed
fffff880`0f1b4040 fffff800`028bf0ba : 00000000`00000001 00000000`00000971 00000001`20707200 00000000`00000000 : nt!KiExceptionDispatch+0xc2
fffff880`0f1b4220 fffff880`036ad360 : fffff880`036caf86 fffff8a0`12e3d410 fffff880`036ed4e0 00000000`00000000 : nt!KiPageFault+0x23a
fffff880`0f1b43b8 fffff880`036caf86 : fffff8a0`12e3d410 fffff880`036ed4e0 00000000`00000000 00000000`00000000 : RapportCerberus64_80128+0x80360
fffff880`0f1b43c0 fffff8a0`12e3d410 : fffff880`036ed4e0 00000000`00000000 00000000`00000000 00000000`000004a0 : RapportCerberus64_80128+0x9df86
fffff880`0f1b43c8 fffff880`036ed4e0 : 00000000`00000000 00000000`00000000 00000000`000004a0 fffff880`0368eb47 : 0xfffff8a0`12e3d410
fffff880`0f1b43d0 00000000`00000000 : 00000000`00000000 00000000`000004a0 fffff880`0368eb47 00000000`00000ff0 : RapportCerberus64_80128+0xc04e0


STACK_COMMAND:  kb

FOLLOWUP_IP: 
RapportCerberus64_80128+80360
fffff880`036ad360 c681d104000000  mov     byte ptr [rcx+4D1h],0

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  RapportCerberus64_80128+80360

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: RapportCerberus64_80128

IMAGE_NAME:  RapportCerberus64_80128.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  54ca0a95

FAILURE_BUCKET_ID:  X64_0x1E_c0000005_R_RapportCerberus64_80128+80360

BUCKET_ID:  X64_0x1E_c0000005_R_RapportCerberus64_80128+80360

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_0x1e_c0000005_r_rapportcerberus64_80128+80360

FAILURE_ID_HASH:  {59c10f5c-d40a-1841-01e6-f21a3ab43cb7}

Followup: MachineOwner
---------

0: kd> lmvm RapportCerberus64_80128
start             end                 module name
fffff880`0362d000 fffff880`036f95c0   RapportCerberus64_80128 T (no symbols)           
    Loaded symbol image file: RapportCerberus64_80128.sys
    Image path: RapportCerberus64_80128.sys
    Image name: RapportCerberus64_80128.sys
    Timestamp:        Thu Jan 29 16:25:25 2015 (54CA0A95)
    CheckSum:         000D2CE0
    ImageSize:        000CC5C0
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Make scans with the following:

Kaspersky TDSSKiller

Anti-rootkit utility TDSSKiller

ESET online scanner:

Free Online Virus Scanner | ESET

Run Disk Check on your Hard Drive for file system errors and bad sectors on it.

Hard Drive Diagnostics

Double click and open my computer.
Right click on desired drive and hit properties.
Click on tools tab and Check now.

Read complete instructions on the tutorial: Disk Check

Other Tests:

MisterTwister · 28 Mar 2015

Hi! Thanks so much for this. I've had no problems at all with McAfee until I extended my subscription by buying a disc and installing it. Anyway:

1. Revo uninstalled McAfee;
2. I installed MS Sec Essentials and Malwarebytes;
3. I CANNOT do the Clean System Startup step. When I "Disable All" and click "OK", it just hangs for an age and has to be shut using ctrl-alt-del. The PC then doesn't funciton at all and has to be shut down physically, weird;
4. I think I've reduced my start up programmes using CCCleaner;
5. SFC - no integrity violations;
6. Kaspersky - no threats found;
7. ESET, all OK;
8. Run disk check, C drive only, no issues;
9. I've attached the image obtained from Crystal Disk.

So should I not reinstall McAfee then? Just wait and see what happens now? Thanks again, very much appreciated!

koolkat77 · 29 Mar 2015

MisterTwister said:

So should I not reinstall McAfee then? Just wait and see what happens now?

Yes, for some time :)