BSOD while away from Computer. 1033

MoNeYsHoT · 06 Feb 2013

I got a computer about 5 months ago. It started giving me a blue screen issue. I restored my system. Then it was fine for a few months. now it started to come back. Hoping someone can help me with my problem. Here's the Blue Screen report:
Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.1.7601.2.1.0.768.3
Locale ID: 1033

Additional information about the problem:
BCCode: 1000009f
BCP1: 0000000000000004
BCP2: 0000000000000258
BCP3: FFFFFA80069F8660
BCP4: FFFFF80001DFA3D0
OS Version: 6_1_7601
Service Pack: 1_0
Product: 768_1

Files that help describe the problem:
C:\Windows\Minidump\013013-34601-01.dmp
C:\Users\Alex\AppData\Local\Temp\WER-12587814-0.sysdata.xml

Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.1.7601.2.1.0.768.3
Locale ID: 1033

Additional information about the problem:
BCCode: 1000009f
BCP1: 0000000000000004
BCP2: 0000000000000258
BCP3: FFFFFA80069F6B50
BCP4: FFFFF80001DFA3D0
OS Version: 6_1_7601
Service Pack: 1_0
Product: 768_1

Files that help describe the problem:
C:\Windows\Minidump\020613-28688-01.dmp
C:\Users\Alex\AppData\Local\Temp\WER-19896351-0.sysdata.xml

These are from two different occasions.
I got these from a computer restart. I don't normally shut down my computer at nights, I leave it plugged in and I close the lid. (makes the computer sleep, then hibernate after 5 hours) then the next morning I take it to class and When I open it my computer has been restarted and it gives me the error report. I attached the sf diagnostics zip file. If there's anything else necessary to help fix my issues please let me know. It's not a big problem now but may become one in the future and this laptop is all I can afford for a while and I really need it for school. Any help is appreciated.

koolkat77 · 07 Feb 2013

Welcome to SevenForums.

Please remove AVG: AVG | Download tools and utilities

Microsoft Security Essentials.

Recommended from a strict BSOD perspective, compatibility & stability compared to other antiviruses/internet security software. It is free and lightweight:-

Microsoft Security Essentials - Free Antivirus for Windows
- Malwarebytes : Malwarebytes Anti-Malware removes malware including viruses, spyware, worms and trojans, plus it protects your computer
  - Good and Free system security combination.
  - How to Scan Your Computer With Multiple Antivirus Programs - How-To Geek

Warning

Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.

Run a full scan with both (separately) once downloaded, installed and updated.

Perform a System File Check:

Click on the start
Type CMD on Search
Left click and Run as Administrator
Type SFC /scannow

Full tutorial here:

SFC /SCANNOW Command - System File Checker

Disk Check on your hard drive for file system errors and bad sectors on it:

Disk Check

Reduce items at start-up. Nothing except anti-virus is required plus improves the time for logging in windows.

This tutorial USB Selective Suspend - Turn On or Off may help you:

To Disable Selective Suspend:

open the control panel
go to power options (you may have to set view to small icons)
click change plan settings
in the window that opens:
click change plan settings
click change advanced power settings, expand usb and ensure usb selective suspend is disabled.

Let us know the results.

MoNeYsHoT · 07 Feb 2013

You are Amazing!!!
My computer is running way faster after completing all those steps. While I don't know whether the blue screen is fixed or not (as it has been sporadic), you have taught me the ways of computer defense and a good deal of optimization. I'm posting the SF diagnostic tool after all the steps listed. There were no viruses found my MSE nor malware removal, but superantispyware found a lot of cookies and a trojan. The system file check and disk check both turned up clean. USB suspend was enabled so I disabled that. I'll check back later to let you know if I get any more blue screens or not. Again, thanks so much!!!

koolkat77 · 08 Feb 2013

What external devices do you have plugged into your system?

Let's run driver verifier and see if it catches any misbehaving drivers:

Driver Verifier - Enable and Disable

MoNeYsHoT · 08 Feb 2013

I turned on verifier for an hour and got two blue screens. I turned it off after that as it gets pretty annoying. I got the SF report after the blue screens, but didn't get the report itself. I hope this information helps.

koolkat77 · 08 Feb 2013

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C4, {81, fffffa800bcee010, 8a, 0}

*** WARNING: Unable to verify timestamp for mcdbus.sys
*** ERROR: Module load completed but symbols could not be loaded for mcdbus.sys
Probably caused by : mcdbus.sys ( mcdbus+36823 )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 0000000000000081, MmMapLockedPages called without MDL_MAPPING_CAN_FAIL
Arg2: fffffa800bcee010, MDL address.
Arg3: 000000000000008a, MDL flags.
Arg4: 0000000000000000, 0.

Debugging Details:
------------------


BUGCHECK_STR:  0xc4_81

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff8000250f3dc to fffff80002088fc0

STACK_TEXT:  
fffff880`025b0408 fffff800`0250f3dc : 00000000`000000c4 00000000`00000081 fffffa80`0bcee010 00000000`0000008a : nt!KeBugCheckEx
fffff880`025b0410 fffff800`025227ea : fffffa80`0bcee010 00000000`00000002 fffffa80`0ba9d810 fffff880`025b1000 : nt!VerifierBugCheckIfAppropriate+0x3c
fffff880`025b0450 fffff880`03f0b823 : fffff980`223beee0 fffff980`221aefc0 fffffa80`0bd11a80 fffff800`000007ad : nt!VerifierMmMapLockedPages+0x4a
fffff880`025b0490 fffff980`223beee0 : fffff980`221aefc0 fffffa80`0bd11a80 fffff800`000007ad fffff980`223beee0 : mcdbus+0x36823
fffff880`025b0498 fffff980`221aefc0 : fffffa80`0bd11a80 fffff800`000007ad fffff980`223beee0 fffff980`223befb0 : 0xfffff980`223beee0
fffff880`025b04a0 fffffa80`0bd11a80 : fffff800`000007ad fffff980`223beee0 fffff980`223befb0 fffff880`025b0960 : 0xfffff980`221aefc0
fffff880`025b04a8 fffff800`000007ad : fffff980`223beee0 fffff980`223befb0 fffff880`025b0960 fffff980`221aefc0 : 0xfffffa80`0bd11a80
fffff880`025b04b0 fffff980`223beee0 : fffff980`223befb0 fffff880`025b0960 fffff980`221aefc0 fffffa80`0ba9d960 : 0xfffff800`000007ad
fffff880`025b04b8 fffff980`223befb0 : fffff880`025b0960 fffff980`221aefc0 fffffa80`0ba9d960 fffff880`025b0970 : 0xfffff980`223beee0
fffff880`025b04c0 fffff880`025b0960 : fffff980`221aefc0 fffffa80`0ba9d960 fffff880`025b0970 00000000`00000000 : 0xfffff980`223befb0
fffff880`025b04c8 fffff980`221aefc0 : fffffa80`0ba9d960 fffff880`025b0970 00000000`00000000 fffff980`221aefe8 : 0xfffff880`025b0960
fffff880`025b04d0 fffffa80`0ba9d960 : fffff880`025b0970 00000000`00000000 fffff980`221aefe8 fffffa80`07bad500 : 0xfffff980`221aefc0
fffff880`025b04d8 fffff880`025b0970 : 00000000`00000000 fffff980`221aefe8 fffffa80`07bad500 fffff800`02520f0d : 0xfffffa80`0ba9d960
fffff880`025b04e0 00000000`00000000 : fffff980`221aefe8 fffffa80`07bad500 fffff800`02520f0d fffff980`223beee0 : 0xfffff880`025b0970


STACK_COMMAND:  kb

FOLLOWUP_IP: 
mcdbus+36823
fffff880`03f0b823 ??              ???

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  mcdbus+36823

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: mcdbus

IMAGE_NAME:  mcdbus.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  49a3cd1f

FAILURE_BUCKET_ID:  X64_0xc4_81_VRF_mcdbus+36823

BUCKET_ID:  X64_0xc4_81_VRF_mcdbus+36823

Followup: MachineOwner
---------

4: kd> lmvm mcdbus
start             end                 module name
fffff880`03ed5000 fffff880`03f11880   mcdbus   T (no symbols)           
    Loaded symbol image file: mcdbus.sys
    Image path: \SystemRoot\system32\DRIVERS\mcdbus.sys
    Image name: mcdbus.sys
    Timestamp:        Tue Feb 24 16:34:07 2009 (49A3CD1F)
    CheckSum:         00041E84
    ImageSize:        0003C880
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Please uninstall MagicISO and see if that makes any difference.

MoNeYsHoT · 08 Feb 2013

So I unistalled MagicISO and turned verifier back on. so far I've had my laptop on for half the day and I haven't encountered any blue screens. I will update tomorrow but I think it'll be good :) just wondering if you knew of any program to mount ISOs that won't cause instability.

koolkat77 · 08 Feb 2013

Try Total Mounter

MoNeYsHoT · 09 Feb 2013

Alright I think My computer is good to go now! I had Verifier on for the day and night and I got no blue screens. And I didn't get a blue screen just leaving my laptop on (which occurred semi often). Must have been MagicISO. Thanks for your help!

koolkat77 · 09 Feb 2013

Thanks for letting us know.

Post if you still need help.