SYSTEM_SERVICE_EXCEPTION BSOD after PC rebuild

Polygone · 02 Oct 2013

Hey,

I've recently rebuilt my PC and after booting to the desktop the next day, I got a SYSTEM_SERVICE_EXCEPTION BSOD. Its dump files are attached to this post.

As I've had stability issues before, I thought this would be a good time to identify the cause as it's so soon after a rebuild. My setup has been stable in the past but after rebuilding it after a suspected viral/malware infection I haven't been able to recreate this stability.

At the time of writing, Windows 7 64-bit has all of its important updates installed and my GPU, monitor and motherboard drivers are up to date. There may be an issue with my mobo's chipset drivers though. I can't seem to get them from the Intel website so I'm using the ones supplied by Gigabyte. I also installed them last, which I noticed was not recommended when I read the installer for one of the chipset installs. The chipset installs are from this site: GIGABYTE - Motherboard - Socket 1155 - GA-Z77-D3H (rev. 1.1)

Could someone help me and identify the cause of this instability issue, please? Any help is greatly appreciated!

YoYo155 · 02 Oct 2013

Hello and welcome to SF :) .
The system info file is missing from the attachment, please follow the steps below.

Download and save Info.bat to the desktop.

Open an elevated command prompt and then type the following command:

Code:

cd C:\Users\<Username>\Desktop

Then type:

Code:

Info.bat

The batch file will begin to run, the SystemInfo.txt file will be saved to your C:\ partition,
the MSINFO32 file will simply open, therefore click File and then Save.
Chose the save location as your Desktop, and then copy the two files into a zipped folder.

Upload the zipped folder in your next post.

Polygone · 03 Oct 2013

Hey,

Thanks for the reply. I've attached the files you've asked for to this post as well as another grab of the BSOD's dump files.

Please let me know what you make of them!

YoYo155 · 03 Oct 2013

Hi and thanks for the files :) .

The single dump file doesn't show much except that Microsoft Security Essentials was active at the time.

Code:

BugCheck 3B, {c0000005, fffff80002dc1a42, fffff88004699830, 0}

Probably caused by : memory_corruption ( nt!MmCreateSection+482 )

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  MsMpEng.exe

CURRENT_IRQL:  0

Not surprisingly MpFilter.sys is present in the stack.

Code:

fffff880`046996e0  fffff880`011d6730*** WARNING: Unable to verify timestamp for MpFilter.sys
*** ERROR: Module load completed but symbols could not be loaded for MpFilter.sys
 MpFilter+0x1a730
fffff880`046996e8  fffff800`02a4d000 nt!KiSelectNextThread <PERF> (nt+0x0)
fffff880`046996f0  fffff800`02ce5810 nt!BBTBuffer <PERF> (nt+0x298810)
fffff880`046996f8  fffff800`02a4d000 nt!KiSelectNextThread <PERF> (nt+0x0)
fffff880`04699700  fffff800`02cdde54 nt!BBTBuffer <PERF> (nt+0x290e54)
fffff880`04699708  fffff880`011bc000 MpFilter
fffff880`04699710  fffff880`011c67d4 MpFilter+0xa7d4
fffff880`04699718  fffff880`011bc000 MpFilter
fffff880`04699720  fffff880`011c651c MpFilter+0xa51c

Driver Reference Table - MpFilter.sys

Usually we recommend to remove any remains of an old anti virus/malware sofware install
but considering how young the system is I doubt you installed anything else of that nature
prior to MSSE, am I correct?

Now we need to think as to what might tripped it.
System event log say the file has recently updated it could be a factor.

Code:

Event[607]:
  Log Name: System
  Source: Service Control Manager
  Date: 2013-10-01T20:15:08.123
  Event ID: 7045
  Task: N/A
  Level: Information
  Opcode: N/A
  Keyword: Classic
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: My_Gaming_PC
  Description: 
A service was installed in the system.

Service Name:  Microsoft Malware Protection Driver
Service File Name:  system32\DRIVERS\MpFilter.sys
Service Type:  kernel mode driver
Service Start Type:  boot start

You said you have faced a virus / malware outbreak in the past, how were the files cleaned?

Your PC is overheating on a regular basis.

Code:

Event[2590]:
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2013-10-03T15:23:50.360
  Event ID: 89
  Task: N/A
  Level: Information
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: My_Gaming_PC
  Description: 
ACPI thermal zone ACPI\ThermalZone\TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 358K             
_AC1 = 328K             
_AC2 = 273K             
_AC3 = 273K             
_AC4 = 273K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 379K             
_HOT = 0K             
_PSL - see event data.

Download Speccy and upload a Screenshot of the summary tab.
Download TDSS-Killer and scan for rootkits.
Download Windows Defender Offline and scan for other types of infections.
Follow this tutorial on how to use the SFC/ SCANNOW tool in Windows.

You also mentioned you are experiencing instability, what form of instability?

The system event log shows several of these;

Code:

Event[1904]:
  Log Name: System
  Source: Disk
  Date: 2013-10-01T22:36:26.824
  Event ID: 51
  Task: N/A
  Level: Warning
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: My_Gaming_PC
  Description: 
An error was detected on device \Device\Harddisk1\DR1 during a paging operation.

Harddisk1 according to the msinfo32 file is a USB Thumb-Drive, is it connected all the time?

Disk Management - Post a Screen Capture Image

Polygone · 04 Oct 2013

Thanks for replying, YoYo155!

I installed Malware Bytes Anti-Malware as well as MSSE, but I only have the free version without the real-time protection. I could check to see if Windows Defender is disabled but I'm sure that when you install MSSE it prompts you to disable it anyway. I'll check though.

With the suspected malware/virus, I scanned my PC with Malware Bytes and it found an infection in an iTunes Backup Password cracker install. I'm not sure what that infection was though but I didn't actually run that installer, I only downloaded it. I deleted it soon afterwards. I did install a similar program before that though and after not paying attention when using the installer, I ended up with toolbars and adware on my PC. I removed those programs using Revo Uninstaller.

After finding the infection in the installer, I scanned with Windows Defender Offline as well as MSSE, MBAW (again) and TDSS-Killer in safe mode. I think TDSS-Killer flagged up 2 unsigned drivers when it scanned with a more thorough scan.

The only stability issue I've had with this build is the BSOD in this post. I've had numerous errors in other builds and they all seem to be MEMORY_MANAGEMENT or SYSTEM_SERVICE_EXCEPTION BSODs. The last build's problems are summarised here: BSODs after PC rebuild: MEMORY_MANAGEMENT, CACHE_MANAGER & DRIVER_IRQL It was a more established version of this one.

As for the USB thumb-drive, it's a flash drive that I use to transfer files between my PC and the laptop I use to write these posts. It's not always connected.

I'll do everything that you asked and get back to you.

Speak to you soon!

Polygone · 09 Oct 2013

Ok, I scanned my PC with TDSS-Killer and the SFC/ SCANNOW tool in safe mode and no rootkits or errors were detected. I got the same null result from my full scan with Windows Defender Offline.

I've attached a screen capture from Speccy after about an hour of browsing and looking at videos on the internet. I've also got the screenshot of the Disk Management screen.

According to the dump file for the BSOD that I posted, where did it indicate my PC is overheating?

I look forward to hearing from you!

YoYo155 · 10 Oct 2013

Thanks for the update :) .
Speccy doesn't show any abnormal temperatures at idle would you mind taking a screenshot of the summary
window while putting stress on the PC?

Test for thermals and stability:

Download Speccy and post a Screenshot of the summary window, one at idle and another while putting load on the PC using Prime95 for the CPU side and Furmark for the GPU.
- Before running Prime95 make sure to enable Round-off checking (see 1st post under the tutorial).

What I encapsulated in "code /code" containing ACPI\ThermalZone comes from the system event log
that recorded high temperatures, not from the dump file :) .

Code:

Event[2590]:
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2013-10-03T15:23:50.360
  Event ID: 89
  Task: N/A
  Level: Information
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: My_Gaming_PC
  Description: 
ACPI thermal zone ACPI\ThermalZone\TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 358K             
_AC1 = 328K             
_AC2 = 273K             
_AC3 = 273K             
_AC4 = 273K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 379K             
_HOT = 0K             
_PSL - see event data.

Now that you say that you installed malwarebytes as well it can be that malwarebytes "messed"
with MpFilter.sys, was it running at the same time?

Have you had any more crashes since?, it's been six days.
If you haven't I would conclude it as a one time occurrence.

Keep updating :) .

Polygone · 20 Oct 2013

Thanks

Unfortunately, I'm still having problems. Since we last spoke I've had two more BSODs. Their dumpfiles are attached to this post.

The first blue-screen was a MEMORY_MANAGEMENT BSOD that followed Windows Update and MSE's updater running after not using my PC for 7 days. Shortly after noticing that MSE updater had paused, the BSOD appeared and my PC auto-restarted.

The second blue-screen came after booting up, then browsing the internet for about 10 minutes. Firefox crashed and shortly afterwards a SYSTEM_SERVICE_EXCEPTION BSOD error message appeared. This time a cause was identified but my PC restarted before I had a chance to get a good look at it.

I'm still getting error messages saying that various Windows services have stopped working. One time, after Windows Updates were installed during bootup, I got to the desktop and individual messages popped up saying that the Host Process and Windows Media Player Network Sharing Services have stopped working. After accepting them and agreeing to send information to Microsoft, another error message appeared stating: Windows has encountered a critical problem and will restart automatically in one minute.

Upon reaching the desktop following the auto-restart, I was told that "Antimalware Service Executable has stopped working". A notification appeared saying that MSE's real-time protection was disabled. Even though MBAM wasn't running, I removed it with Revo Uninstaller in case there are any conflicts. Before restarting my PC, I saw the Windows Update symbol on the Shut Down button. I've mentioned this in case there's an issue with a recent update messing up PCs.

After my PC restarted, MSE's real-time protection was working and had no more problems on that occasion.
Other error messages saying that certain services have stopped working after booting up are: User Profile; Base Filtering Engine; Function Discovery Resource Publication.

As you asked, I have stress tested my PC.

I ran Furmark for 7 minutes and saw no artefacts during the test. The temp pretty much peaked after 2 minutes with the reading: GPU1 - 76*C (min: 37*C - max: 77*C)

I ran a Small FFTs scan with 4 workers on Prime95 for just over 2 hours. After 1 hour and 45 minutes, worker 2 stopped working due to a hardware failure. A screen cap of this error message is attached to this post as are the before and after screenshots of Speccy. Please note that before worker 2 stopped, the CPU temp was around 70*C - 74*C.

I hope this helps with your diagnosis!

YoYo155 · 21 Oct 2013

Thanks for the tidy organized files :) .
The temperatures are well within the normal range so that is not an issue, what I am worried about
are the things to follow.

1. The failing worker during Prime95, can you upload the stress.txt file?
2. Your Qualcomm Atheros AR8161/8165 PCI-E Gigabit Ethernet (L1C62x64.sys) driver,
not being the latest - Download and update here - .
3. All of the bugchecks are due to memory corruption, so it's best to test the RAM.

Testing the RAM:

koolkat77 said:

Test and Diagnose RAM Issues with Memtest86+:

RAM - Test with Memtest86+

Tip

Pay close attention to part 3 of the tutorial "If you have errors"
Test the RAM with Memtest86+ for at least 7-10 passes. It may take up to 22 passes to find problems. Make sure to run it once after the system has been on for a few hours and is warm, and then also run it again when the system has been off for a few hours and is cold.

When done with the testing procedure take a picture and upload it here.
Keep us posted :) .

Polygone · 21 Oct 2013

Thanks, I will do.

I've updated the ethernet controller driver and I'll run Memtest86+ during the next few days. I think I've attached the Prime95 files that you wanted.

And you're welcome about the tidy files