SYSTEM_SERVICE_EXCEPTION BSOD after PC rebuild

Page 1 of 8 123 ... LastLast

  1. Posts : 63
    Windows 7 Home Premium 64-bit
       #1

    SYSTEM_SERVICE_EXCEPTION BSOD after PC rebuild


    Hey,

    I've recently rebuilt my PC and after booting to the desktop the next day, I got a SYSTEM_SERVICE_EXCEPTION BSOD. Its dump files are attached to this post.

    As I've had stability issues before, I thought this would be a good time to identify the cause as it's so soon after a rebuild. My setup has been stable in the past but after rebuilding it after a suspected viral/malware infection I haven't been able to recreate this stability.

    At the time of writing, Windows 7 64-bit has all of its important updates installed and my GPU, monitor and motherboard drivers are up to date. There may be an issue with my mobo's chipset drivers though. I can't seem to get them from the Intel website so I'm using the ones supplied by Gigabyte. I also installed them last, which I noticed was not recommended when I read the installer for one of the chipset installs. The chipset installs are from this site: GIGABYTE - Motherboard - Socket 1155 - GA-Z77-D3H (rev. 1.1)

    Could someone help me and identify the cause of this instability issue, please? Any help is greatly appreciated!
      My Computer


  2. Posts : 3,056
    Windows 10
       #2

    Hello and welcome to SF :) .
    The system info file is missing from the attachment, please follow the steps below.

    Download and save Info.bat to the desktop.

    Open an elevated command prompt and then type the following command:

    Code:
    cd C:\Users\<Username>\Desktop
    Then type:

    Code:
    Info.bat
    The batch file will begin to run, the SystemInfo.txt file will be saved to your C:\ partition,
    the MSINFO32 file will simply open, therefore click File and then Save.
    Chose the save location as your Desktop, and then copy the two files into a zipped folder.

    Upload the zipped folder in your next post.
      My Computer


  3. Posts : 63
    Windows 7 Home Premium 64-bit
    Thread Starter
       #3

    Hey,

    Thanks for the reply. I've attached the files you've asked for to this post as well as another grab of the BSOD's dump files.

    Please let me know what you make of them!
      My Computer


  4. Posts : 3,056
    Windows 10
       #4

    Hi and thanks for the files :) .

    The single dump file doesn't show much except that Microsoft Security Essentials was active at the time.

    Code:
    BugCheck 3B, {c0000005, fffff80002dc1a42, fffff88004699830, 0}
    
    Probably caused by : memory_corruption ( nt!MmCreateSection+482 )
    
    DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
    
    BUGCHECK_STR:  0x3B
    
    PROCESS_NAME:  MsMpEng.exe
    
    CURRENT_IRQL:  0
    Not surprisingly MpFilter.sys is present in the stack.

    Code:
    fffff880`046996e0  fffff880`011d6730*** WARNING: Unable to verify timestamp for MpFilter.sys
    *** ERROR: Module load completed but symbols could not be loaded for MpFilter.sys
     MpFilter+0x1a730
    fffff880`046996e8  fffff800`02a4d000 nt!KiSelectNextThread <PERF> (nt+0x0)
    fffff880`046996f0  fffff800`02ce5810 nt!BBTBuffer <PERF> (nt+0x298810)
    fffff880`046996f8  fffff800`02a4d000 nt!KiSelectNextThread <PERF> (nt+0x0)
    fffff880`04699700  fffff800`02cdde54 nt!BBTBuffer <PERF> (nt+0x290e54)
    fffff880`04699708  fffff880`011bc000 MpFilter
    fffff880`04699710  fffff880`011c67d4 MpFilter+0xa7d4
    fffff880`04699718  fffff880`011bc000 MpFilter
    fffff880`04699720  fffff880`011c651c MpFilter+0xa51c

    Usually we recommend to remove any remains of an old anti virus/malware sofware install
    but considering how young the system is I doubt you installed anything else of that nature
    prior to MSSE, am I correct?

    Now we need to think as to what might tripped it.
    System event log say the file has recently updated it could be a factor.
    Code:
    Event[607]:
      Log Name: System
      Source: Service Control Manager
      Date: 2013-10-01T20:15:08.123
      Event ID: 7045
      Task: N/A
      Level: Information
      Opcode: N/A
      Keyword: Classic
      User: S-1-5-18
      User Name: NT AUTHORITY\SYSTEM
      Computer: My_Gaming_PC
      Description: 
    A service was installed in the system.
    
    Service Name:  Microsoft Malware Protection Driver
    Service File Name:  system32\DRIVERS\MpFilter.sys
    Service Type:  kernel mode driver
    Service Start Type:  boot start
    You said you have faced a virus / malware outbreak in the past, how were the files cleaned?

    Your PC is overheating on a regular basis.
    Code:
    Event[2590]:
      Log Name: System
      Source: Microsoft-Windows-Kernel-Power
      Date: 2013-10-03T15:23:50.360
      Event ID: 89
      Task: N/A
      Level: Information
      Opcode: Info
      Keyword: N/A
      User: S-1-5-18
      User Name: NT AUTHORITY\SYSTEM
      Computer: My_Gaming_PC
      Description: 
    ACPI thermal zone ACPI\ThermalZone\TZ00 has been enumerated.             
    _PSV = 0K             
    _TC1 = 0             
    _TC2 = 0             
    _TSP = 0ms             
    _AC0 = 358K             
    _AC1 = 328K             
    _AC2 = 273K             
    _AC3 = 273K             
    _AC4 = 273K             
    _AC5 = 0K             
    _AC6 = 0K             
    _AC7 = 0K             
    _AC8 = 0K             
    _AC9 = 0K             
    _CRT = 379K             
    _HOT = 0K             
    _PSL - see event data.



    You also mentioned you are experiencing instability, what form of instability?


    The system event log shows several of these;
    Code:
    Event[1904]:
      Log Name: System
      Source: Disk
      Date: 2013-10-01T22:36:26.824
      Event ID: 51
      Task: N/A
      Level: Warning
      Opcode: N/A
      Keyword: Classic
      User: N/A
      User Name: N/A
      Computer: My_Gaming_PC
      Description: 
    An error was detected on device \Device\Harddisk1\DR1 during a paging operation.
    Harddisk1 according to the msinfo32 file is a USB Thumb-Drive, is it connected all the time?

      My Computer


  5. Posts : 63
    Windows 7 Home Premium 64-bit
    Thread Starter
       #5

    Thanks for replying, YoYo155!

    I installed Malware Bytes Anti-Malware as well as MSSE, but I only have the free version without the real-time protection. I could check to see if Windows Defender is disabled but I'm sure that when you install MSSE it prompts you to disable it anyway. I'll check though.

    With the suspected malware/virus, I scanned my PC with Malware Bytes and it found an infection in an iTunes Backup Password cracker install. I'm not sure what that infection was though but I didn't actually run that installer, I only downloaded it. I deleted it soon afterwards. I did install a similar program before that though and after not paying attention when using the installer, I ended up with toolbars and adware on my PC. I removed those programs using Revo Uninstaller.

    After finding the infection in the installer, I scanned with Windows Defender Offline as well as MSSE, MBAW (again) and TDSS-Killer in safe mode. I think TDSS-Killer flagged up 2 unsigned drivers when it scanned with a more thorough scan.

    The only stability issue I've had with this build is the BSOD in this post. I've had numerous errors in other builds and they all seem to be MEMORY_MANAGEMENT or SYSTEM_SERVICE_EXCEPTION BSODs. The last build's problems are summarised here: BSODs after PC rebuild: MEMORY_MANAGEMENT, CACHE_MANAGER & DRIVER_IRQL It was a more established version of this one.

    As for the USB thumb-drive, it's a flash drive that I use to transfer files between my PC and the laptop I use to write these posts. It's not always connected.

    I'll do everything that you asked and get back to you.

    Speak to you soon!
      My Computer


  6. Posts : 63
    Windows 7 Home Premium 64-bit
    Thread Starter
       #6

    Ok, I scanned my PC with TDSS-Killer and the SFC/ SCANNOW tool in safe mode and no rootkits or errors were detected. I got the same null result from my full scan with Windows Defender Offline.

    I've attached a screen capture from Speccy after about an hour of browsing and looking at videos on the internet. I've also got the screenshot of the Disk Management screen.

    According to the dump file for the BSOD that I posted, where did it indicate my PC is overheating?

    I look forward to hearing from you!
      My Computer


  7. Posts : 3,056
    Windows 10
       #7

    Thanks for the update :) .
    Speccy doesn't show any abnormal temperatures at idle would you mind taking a screenshot of the summary
    window while putting stress on the PC?

    Test for thermals and stability:

    • Download Speccy and post a Screenshot of the summary window, one at idle and another while putting load on the PC using Prime95 for the CPU side and Furmark for the GPU.
      • Before running Prime95 make sure to enable Round-off checking (see 1st post under the tutorial).




    What I encapsulated in "code /code" containing ACPI\ThermalZone comes from the system event log
    that recorded high temperatures, not from the dump file :) .
    Code:
    Event[2590]:
      Log Name: System
      Source: Microsoft-Windows-Kernel-Power
      Date: 2013-10-03T15:23:50.360
      Event ID: 89
      Task: N/A
      Level: Information
      Opcode: Info
      Keyword: N/A
      User: S-1-5-18
      User Name: NT AUTHORITY\SYSTEM
      Computer: My_Gaming_PC
      Description: 
    ACPI thermal zone ACPI\ThermalZone\TZ00 has been enumerated.             
    _PSV = 0K             
    _TC1 = 0             
    _TC2 = 0             
    _TSP = 0ms             
    _AC0 = 358K             
    _AC1 = 328K             
    _AC2 = 273K             
    _AC3 = 273K             
    _AC4 = 273K             
    _AC5 = 0K             
    _AC6 = 0K             
    _AC7 = 0K             
    _AC8 = 0K             
    _AC9 = 0K             
    _CRT = 379K             
    _HOT = 0K             
    _PSL - see event data.
    Now that you say that you installed malwarebytes as well it can be that malwarebytes "messed"
    with MpFilter.sys, was it running at the same time?

    Have you had any more crashes since?, it's been six days.
    If you haven't I would conclude it as a one time occurrence.

    Keep updating :) .
      My Computer


  8. Posts : 63
    Windows 7 Home Premium 64-bit
    Thread Starter
       #8

    Thanks

    Unfortunately, I'm still having problems. Since we last spoke I've had two more BSODs. Their dumpfiles are attached to this post.

    The first blue-screen was a MEMORY_MANAGEMENT BSOD that followed Windows Update and MSE's updater running after not using my PC for 7 days. Shortly after noticing that MSE updater had paused, the BSOD appeared and my PC auto-restarted.

    The second blue-screen came after booting up, then browsing the internet for about 10 minutes. Firefox crashed and shortly afterwards a SYSTEM_SERVICE_EXCEPTION BSOD error message appeared. This time a cause was identified but my PC restarted before I had a chance to get a good look at it.

    I'm still getting error messages saying that various Windows services have stopped working. One time, after Windows Updates were installed during bootup, I got to the desktop and individual messages popped up saying that the Host Process and Windows Media Player Network Sharing Services have stopped working. After accepting them and agreeing to send information to Microsoft, another error message appeared stating: Windows has encountered a critical problem and will restart automatically in one minute.

    Upon reaching the desktop following the auto-restart, I was told that "Antimalware Service Executable has stopped working". A notification appeared saying that MSE's real-time protection was disabled. Even though MBAM wasn't running, I removed it with Revo Uninstaller in case there are any conflicts. Before restarting my PC, I saw the Windows Update symbol on the Shut Down button. I've mentioned this in case there's an issue with a recent update messing up PCs.

    After my PC restarted, MSE's real-time protection was working and had no more problems on that occasion.
    Other error messages saying that certain services have stopped working after booting up are: User Profile; Base Filtering Engine; Function Discovery Resource Publication.

    As you asked, I have stress tested my PC.

    I ran Furmark for 7 minutes and saw no artefacts during the test. The temp pretty much peaked after 2 minutes with the reading: GPU1 - 76*C (min: 37*C - max: 77*C)

    I ran a Small FFTs scan with 4 workers on Prime95 for just over 2 hours. After 1 hour and 45 minutes, worker 2 stopped working due to a hardware failure. A screen cap of this error message is attached to this post as are the before and after screenshots of Speccy. Please note that before worker 2 stopped, the CPU temp was around 70*C - 74*C.

    I hope this helps with your diagnosis!
      My Computer


  9. Posts : 3,056
    Windows 10
       #9

    Thanks for the tidy organized files :) .
    The temperatures are well within the normal range so that is not an issue, what I am worried about
    are the things to follow.

    1. The failing worker during Prime95, can you upload the stress.txt file?
    2. Your Qualcomm Atheros AR8161/8165 PCI-E Gigabit Ethernet (L1C62x64.sys) driver,
    not being the latest - Download and update here - .
    3. All of the bugchecks are due to memory corruption, so it's best to test the RAM.

    Testing the RAM:

    koolkat77 said:
    Test and Diagnose RAM Issues with Memtest86+:

       Tip

    • Pay close attention to part 3 of the tutorial "If you have errors"
    • Test the RAM with Memtest86+ for at least 7-10 passes. It may take up to 22 passes to find problems. Make sure to run it once after the system has been on for a few hours and is warm, and then also run it again when the system has been off for a few hours and is cold.

    When done with the testing procedure take a picture and upload it here.
    Keep us posted :) .
      My Computer


  10. Posts : 63
    Windows 7 Home Premium 64-bit
    Thread Starter
       #10

    Thanks, I will do.

    I've updated the ethernet controller driver and I'll run Memtest86+ during the next few days. I think I've attached the Prime95 files that you wanted.

    And you're welcome about the tidy files
      My Computer


 
Page 1 of 8 123 ... LastLast

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd
All times are GMT -5. The time now is 19:38.
Find Us