BSOD error no matter what BCCode 1e

fireurza · 13 Jun 2013

I keep getting a BSOD error and cannot for the life of me figure out what it is. I ran a memtest x86 diagnostic on the memory for over 12 hours and each loop passed. I have updated my vid card drivers to the most current. Any help would be greatly appreciated. I have attached the SF diagnostic documents.

Arc · 14 Jun 2013

Your crash dumps are not showing any finite probable cause.

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

Scan the system for possible virus infection with the following programs.

In such a situation, it is better to enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

Tip

If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any.

Did you use PowerISO earlier? Some emaluators are failing at bootup, but not matching with the derives of MagicISO.

Let us know the results.
________________________________________________________________________________________
BSOD ANALYSIS:

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffffa800d8e33ef, 0, 7efa003c}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+487ed )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffffa800d8e33ef, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 000000007efa003c, Parameter 1 of the exception

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002eaf100
GetUlongFromAddress: unable to read from fffff80002eaf1c0
 0000000000000000 Nonpaged pool

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
+0
fffffa80`0d8e33ef 48635a3c        movsxd  rbx,dword ptr [rdx+3Ch]

BUGCHECK_STR:  0x1E_c0000005_R

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  chrome.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88003171390 -- (.trap 0xfffff88003171390)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa800df55400
rdx=000000007efa0000 rsi=0000000000000000 rdi=0000000000000000
rip=fffffa800d8e33ef rsp=fffff88003171520 rbp=fffff80002e1d2d8
 r8=fffffa800d7d7330  r9=00000000ffffffff r10=fffff880031712b8
r11=fffffa800cda6040 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
fffffa80`0d8e33ef 48635a3c        movsxd  rbx,dword ptr [rdx+3Ch] ds:00000000`7efa003c=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002cc2728 to fffff80002c77c00

STACK_TEXT:  
fffff880`03170b08 fffff800`02cc2728 : 00000000`0000001e ffffffff`c0000005 fffffa80`0d8e33ef 00000000`00000000 : nt!KeBugCheckEx
fffff880`03170b10 fffff800`02c77282 : fffff880`031712e8 fffff880`03171840 fffff880`03171390 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x487ed
fffff880`031711b0 fffff800`02c75dfa : 00000000`00000000 00000000`7efa003c fffff8a0`00001a00 fffff880`03171840 : nt!KiExceptionDispatch+0xc2
fffff880`03171390 fffffa80`0d8e33ef : fffff800`02e1d2d8 fffff880`031715a0 fffffa80`0d8e5400 fffffa80`0d8e63d0 : nt!KiPageFault+0x23a
fffff880`03171520 fffff800`02e1d2d8 : fffff880`031715a0 fffffa80`0d8e5400 fffffa80`0d8e63d0 00000000`00000000 : 0xfffffa80`0d8e33ef
fffff880`03171528 fffff880`031715a0 : fffffa80`0d8e5400 fffffa80`0d8e63d0 00000000`00000000 00000000`00000000 : nt!ExWorkerQueue+0x58
fffff880`03171530 fffffa80`0d8e5400 : fffffa80`0d8e63d0 00000000`00000000 00000000`00000000 fffff880`03171600 : 0xfffff880`031715a0
fffff880`03171538 fffffa80`0d8e63d0 : 00000000`00000000 00000000`00000000 fffff880`03171600 00000000`00000002 : 0xfffffa80`0d8e5400
fffff880`03171540 00000000`00000000 : 00000000`00000000 fffff880`03171600 00000000`00000002 00000000`00100000 : 0xfffffa80`0d8e63d0


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+487ed
fffff800`02cc2728 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+487ed

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  5147d9c6

FAILURE_BUCKET_ID:  X64_0x1E_c0000005_R_nt!_??_::FNODOBFM::_string_+487ed

BUCKET_ID:  X64_0x1E_c0000005_R_nt!_??_::FNODOBFM::_string_+487ed

Followup: MachineOwner
---------

fireurza · 14 Jun 2013

I ran memtest for about 16 hours. It completed at least 10 cycles and passed each one. I rand the windows defender offline and the anti rootkit and removed whatever they found which was some low threat infections. I also installed the driver verifier and will upload the next bsod dump. I used to have poweriso and magiciso on my pc but now have neither.

fireurza · 14 Jun 2013

I had another crash after restarting with the verifier enabled. Here are the dump files from those crashes on startup.

x BlueRobot · 14 Jun 2013

Code:

BugCheck C2, {9b, 0, 10, fffff880014d8503}

*** WARNING: Unable to verify timestamp for Neo_0126.sys
*** ERROR: Module load completed but symbols could not be loaded for Neo_0126.sys
Probably caused by : Neo_0126.sys ( Neo_0126+116d )

Code:

3: kd> lmvm Neo_0126
start             end                 module name
fffff880`053ed000 fffff880`053f2100   Neo_0126 T (no symbols)           
    Loaded symbol image file: Neo_0126.sys
    Image path: \SystemRoot\system32\DRIVERS\Neo_0126.sys
    Image name: Neo_0126.sys
    Timestamp:        Tue Dec 11 07:24:06 2012 (50C6DF96)
    CheckSum:         000108CB
    ImageSize:        00005100
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

The driver seems to be related to your VPN Client Adapter - VPN, please find a update for the driver, or remove the software for the program completely using Revo Uninstaller Pro - Uninstall Software, Remove Programs easily, Forced Uninstall, Leftovers Uninstaller

fireurza · 14 Jun 2013

I deleted that VPN from my pc. I will update you if it crashes again. I hope this is successful.

x BlueRobot · 14 Jun 2013

Thanks for the update :)