SERVICE_EXCEPTION and MEMORY_MANAGEMENT BSODs after PC rebuild

Polygone · 24 Jun 2013

Hey,

I've recently rebuilt my PC following an issue caused by a faulty PSU. It damaged the PC to the point where it wouldn't switch on. After trying a lot of fixes provided by the kind people on your sister site, EightForums, I RMA-ed the motherboard and processor. After installing their replacements, the PC booted up fine and Windows 7 installed without a problem.

However, yesterday I got two BSOD error messages which make me wonder whether any other components were damaged by the old PSU.

The first error message, SYSTEM_SERVICE_EXCEPTION_ERROR (I think), appeared after my PC froze during Norton 360's Update. I rebooted my PC thinking that would be it. I then installed Catalyst Control Centre for my graphics card and went on the internet. After a while Firefox crashed and kept crashing when I tried to restart it from the error reporting window. I then opened Internet Explorer for the first time since installing Windows 7 and received the following error message:

WerFault.exe - Application Error
The instruction at 0x0014d38 referenced memory at 0x0014d38. The memory could not be written. Click on OK to terminate the program.

After clicking on OK, the message repeated for the following referenced memories: 0x0022e650, 0x001ae5b0, 0x0019e2ac, 0x0015e31c, 0x000de6a8, 0x0022e1b0, 0x0010e4f8, 0x0009e5d4 and 0x0018e158.

The error message below appeared about halfway through the above messages.

WerFault.exe - Application Error
The exception privileged instruction (0xc0000096) occurred in the application at location 0x000fe060. Click on OK to terminate the program.

Thinking it was the memory, I ran Windows' Memory Diagnostic Utility. Once the test finished, my PC tried to restart but Windows said that start up had failed. Start Up Repair ran automatically and recommended System Restore. I followed the suggestion and System Restore succeeded. The confirmation window said that "An unspecified hardware change was to blame".

System Restore had taken my PC back to before Norton 360 had installed, so I re-installed it. I booted into the Repair Your Computer screen and ran the Windows Memory Diagnostic again as the original test's results weren't visible after System Restore had completed. After the test had ran again, my PC booted to the desktop. A grey window flashed up briefly but apart from that, there was no other sign of the memory test's results. So, I plugged in a USB stick to install memtest86+ when my PC froze and a MEMORY_MANAGEMENT BSOD appeared. I then turned off my computer.

I was able to install memtest86+ on to a USB stick using another computer and ran the test on my PC. It came back negative.

I've had MEMORY_MANAGEMENT BSODs before but always suspected it was down to my SSD. However, it's not connected to my PC at the minute and the possibility came up then that the RAM could be faulty.

I've attached both BSOD dump files to this post. Could someone please look at these files and tell me what they think caused these crashes? I hope this essay helps as well!

Thanks in advance!

Arc · 25 Jun 2013

The MEMORY_MANAGEMENT (1a) BSOD is showing Some random errors of tunnel.sys (related to network); and Ntfs.sys and fltmgr.sys (related to storage functioning).

The concurrent failure of these two are indicating to either a virus or an ambitious antivirus blocking things.

The SYSTEM_SERVICE_EXCEPTION (3b) BSOD are also showing those. So the previous assumption is correct, irrespective of the bugcheck code.

A deeper search in the SYSTEM_SERVICE_EXCEPTION (3b) BSOD revealed teh failing modules. Those are ....

Symantec Extended File Attributes ....

Code:

fffff880`075b42e8  fffff880`012f0cffUnable to load image \SystemRoot\system32\drivers\N360x64\1404000.028\SYMEFA64.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for SYMEFA64.SYS
*** ERROR: Module load completed but symbols could not be loaded for SYMEFA64.SYS
 SYMEFA64+0xe2cff

Description here: Driver Reference Table - SYMEFA64.SYS

Symantec Heuristics Driver ....

Code:

fffff880`075b3da8  fffff880`047279c1Unable to load image \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.4.0.40\Definitions\BASHDefs\20130531.001\BHDrvx64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for BHDrvx64.sys
*** ERROR: Module load completed but symbols could not be loaded for BHDrvx64.sys
 BHDrvx64+0xbc9c1

Description Here: Driver Reference Table - BHDrvx64.sys

Most common .... observed those errors numerous times.

Uninstall Norton and all Symentec products using Norton Removal tool. Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.
Download, install and update those, and then run full system scans with both of them, one by one.

Let us know the results.
_______________________________________________________________________________
BSOD ANALYSIS:

Code:

BugCheck 1A, {5002, fffff780c0000000, 32f1, 40032ebfffffffe}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+29ac1 )

Followup: MachineOwner
------------------------------------------------------------------------------------------
BugCheck 3B, {c0000005, fffff80002dae7ca, fffff880075b4010, 0}

Probably caused by : ntkrnlmp.exe ( nt!NtCreateSection+18d )

Followup: MachineOwner
---------

Polygone · 26 Jun 2013

Thanks for the reply, Arc.

I did as you asked and removed Norton 360. After scanning my PC in Safe Mode with MSE, and it not finding anything, I booted my PC normally before scanning with MBAM. Upon reaching the desktop, Windows automatically restarted. As it was booting up again, I got a message saying that Windows didn't start properly. After choosing the option to boot up normally, a window appeared saying that Windows had recovered from an unexpected error. Although I didn't see it at the time, it turns out it was a BSOD with the BBCode 1e. It's dump file is attached.

I managed to run MBAM in Safe Mode and it found a result! Namely: PUP.IBryte. The text log is also attached to this message. I was able to remove and quarantine whatever it is that I found.

I'm still having problems though. After booting up normally to update this thread from my PC, Firefox crashed like it did last time i.e. it kept crashing immediately after trying to restart it from error reporting window. Internet Explorer stopped working too, but no other error messages were created.

After this I went to check Windows Firewall through the Control Panel and the link wouldn't open. It did recognise the link was there though. Shortly after, I received a message that MSE's real-time protection was switched off. The pop-up window to restart either it or Windows Defender seemingly did nothing, so I closed it. I then clicked on the little arrow on the right-hand side of the taskbar and MSE's icon was green. When I opened MSE from here, it said it was fine.

I'm not quite sure what to make of this.

P.S. I transferred the attached text log and dump files from my PC to another laptop. I scanned the USB stick I used to port them over with Norton 360 and the scan came back negative. I just thought I'd let you know in case you think my PC is still infected with a virus.

Arc · 27 Jun 2013

The Qualcomm Atheros AR8161/8165 PCI-E Gigabit Ethernet Controller (NDIS 6.20) driver should be updated. Get the version 2.1.0.7 dated 2012/09/20 from GIGABYTE - Motherboard - Socket 1155 - GA-Z77-D3H (rev. 1.0)

Uninstall these bloatware:

Start Menu\Programs\GIGABYTE
Start Menu\Programs\GIGABYTE\AutoGreen
Start Menu\Programs\GIGABYTE\ET6

Scan the system for possible virus infection with the following programs.

Do some Disc checks.

Reseat the sata and power.
Run chkdsk /f/r, following the option two of the tutorial Disk Check
Seatool for dos: SeaTools | Seagate download
Burn it in a blank cd. boot from the CD, click on "Accept", wait for it to finish detecting the drives, then in the upper left corner select "Basic Tests", then select "Long Test" and let it run.
Post a screenshot of your HDD using CrystalDiskInfo - Software - Crystal Dew World

Let us know the results.

Polygone · 04 Jul 2013

Thanks Arc,

I did everything that you asked. All of the scan results came back negative. I did have a problem with SeaTools for DOS though. Once I burnt the .ISO to a blank DVD, I couldn't get it to run the long test. Each time I tried, the program would freeze. Sometimes it would freeze just after it detected the drives and before it said that my HDD may need a firmware update. (It doesn't though, I checked.) I've re-downloaded the .ISO again and burnt it to another blank DVD and had the same problem.

Is there a way to get it to run from a USB drive? Or could I use the Windows version instead?

RE: The screenshot of my HDD from Crystal Disc Info. I've seen that "Reallocated Sectors Count" warning before. I Googled it and it said that it was unusable parts of the HDD, most likely from manufacturing, that are similar to the dead pixels on LED/LCD screens. The amount of unusable sectors hasn't changed since I last checked it a few months ago.

Arc · 05 Jul 2013

You can use Seatools from a USB. Use Win32 Disk Imager | Free Development software downloads at SourceForge.net to burn the ISO to the USB.

The caution indication can be converted to good using CrystalDiscInfo. Click on the caution Button, you will get another window ....

In the resulting window, there are three sliders in the left. Drag them to the ultimate left, and notice the values at the right side are converting to zeros.

Now click the apply button, and notice that the caution is gone.

After these, observe the situation that it is causing more BSODs or not.

Polygone · 06 Jul 2013

I'm still not having much luck with getting Seagate Tools to run. I couldn't use Win32 Disk Imager because apparently it doesn't support ISO burning. I can't find where I read that now but it wouldn't let me burn the ISO.

I tried using ISOtoUSB to burn the ISO to the USB, but it didn't work. When booting up, it said something along the lines of "Remove media or device. Press any key to continue". I tried using both FAT32 and NTFS formats, but still nothing. I even quick formatted the drive before burning and re-downloaded the ISO file in case it was corrupted. I made sure to select the "bootable" option too.

Since we seem to have ruled out viruses, i've also tried to burn Seagate Tools with my PC but my BD-ROM doesn't recognise writeable DVDs as being writeable.

The drive is a LiteOn 4x IHOS104-32. I'm using ISO Recorder as the drive only came with PowerDVD 10. I've tried two brands of DVD-RW with no luck. I've tried the Microsoft Fixit for CD/DVD drives not reading or writing media and i've reinstalled the drive in Device Manager, but still nothing. The drive's firmware is up to date.

Can you help me with this too, please?

Arc · 07 Jul 2013

Use Win32 Disk Imager | Free Development software downloads at SourceForge.net to make a bootable USB using seatools ISO.

Step 1:
Attachment 275447

Step 2:
Attachment 275448

Step 3:
Attachment 275449

Step 4:
Attachment 275450

Polygone · 10 Jul 2013

I tried it again and the program says that the burn completed successfully. However, when it comes to booting from the USB stick, my PC just boots up normally.

I've checked Win32 Disk Imager's "Read Me" file and it says that it only writes img files. The link is here: http://heanet.dl.sourceforge.net/pro...ger/README.txt

I've started a thread for my DVD and CD writing problems. The link is here: BD-ROM doesn't recognise writeable discs

In the meantime, would a scan with the Windows version of Seatools in Safe Mode be as effective as the DOS version? If so, what type of scan would you recommend as there appears to be more variety with the Windows version.

Arc · 10 Jul 2013

You may try seatools for windows. But It is not very effective with problematic Discs, whereas I am thinking your HDD is problematic.

To boot from the USB, either you need to enter into the BIOS or you need to use the boot menu key to select the USB at boot device. In normal course it would not boot from the USB directly.