BSOD randomly with new computer - Last error code 3b

sheisel · 22 Jul 2015

I have disabled scheduled backups and will just do manually as needed. Found this on the Genie Backup Support Site.

GBM Causes Blue Screen of Death (BSOD) when running Backup

SYMPTOMS

When you run a backup Job and when “Preparing open files” stage occurs, you encounter Blue Screen of Death or automatic system reboot. This can also happen when running Disaster Recovery job or create a Disaster Recovery bootable disk.

CAUSE:

This problem is caused after cloning or creating an image restore to a hard drive using "Acronis True Image" which is used by Seagate/Maxtor and many other companies. The problem is that Acronis writes an incorrect signature to the hard drive's MBR causing windows to throw a BSOD when doing a Volume Shadow Copy. GBM uses Volume Shadow Copy to capture open files.

RESOLUTION

To write a new signature to a drive's MBR, you need "MBRFix" which can be downloaded here
Reboot your PC and start in "Windows Safe Mode with Command Prompt" or the Command Prompt in Windows.
Browse to the folder where you downloaded MBRFix to.
MBRFix requires a drive number. Usually your boot drive is drive 0. To make sure this is indeed the boot drive, at the command prompt, type:
MBRFix /drive 0 listpartitions
Examine the results to make sure that the drive has the boot partition and is the size you expect.
Just to be safe, create a copy of the current MBR by typing:
MBRFix /drive 0 savembr ORIGINAL_MBR.bin
Now create and save a new signature in the MBR by typing:
MBRFix /drive 0 generatesignature
Reboot your computer.
XP will detect and install a new "device" and prompts you to reboot your computer again. Reboot as requested.

OR

Go to windows Device Manage
Click "view" and select "show hidden devices"
Scroll down to "storage volumes"
Click on the plus to expand.
Click on each one listed and right click and uninstall. (you will get a message on some staying to reboot before it takes effect. Select no until you do them all.)
Reboot.
Wait till windows automatically reinstalls devices. Will prompt to reboot again.
Reboot.

Boozad · 22 Jul 2015

OK, let us know how the manual backups go. I've a feeling that it will solve the issue.

sheisel · 31 Jul 2015

I was out all week so did not use my computer, but it was on without backups. Used it a bit this morning and had a BSOD when I left for a minute so don't know exactly what was running except MS Security Essentials, Chrome and MS Word. Attached is the zip file from the dump. As I noted, Genie Backup were not running.

Boozad · 31 Jul 2015

This one seems to be blaming MS Anti Malware, it may well be a false positive. You don't happen to have MBAM running realtime protection do you?

Code:

fffff880`09243f48  fffff880`01176008
*** WARNING: Unable to verify timestamp for MpFilter.sys
*** ERROR: Module load completed but symbols could not be loaded for MpFilter.sys
 MpFilter+0xc008

sheisel · 31 Jul 2015

Yes, I just checked. MS Security Essentials was running real-time protection. Had run a scan on another computer earlier (from this computer, but that was done. I have disabled the real-time protection now.

Seems like everything causes problems. I am beginning to go back to memory issues. This is a new computer that came with 4 MB RAM and I added an identical 4 MB RAM module. Can not do it today, but next week should I removed the added memory? I know you had me test it earlier.

Thanks

Boozad · 31 Jul 2015

Mismatched memory modules can cause issues even if there's no fault with them if the timings or voltages don't correlate. Download Speccy linked in my sig, run it and expand the RAM tab on the left, then expand Slot #1 and Slot #2 to show the timings and voltages. Post a screenshot of what it shows.

Attachment 367688

sheisel · 03 Aug 2015

Had another shut down over the weekend. Attached is the zip with the new dmp file. Also ran the Speccy and attached the image of the screen shot.

Boozad · 03 Aug 2015

This dump is a 0xD1 which indicates a driver, but none are showing in the dump. What is showing is the Volume ShadowCopy service, whether that was definitely the issue or not I can't say, but it may be worth disabling it temproarily to rule it out.

Code:

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fffff8800131868c, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000008, value 0 = read operation, 1 = write operation
Arg4: fffff8800131868c, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800032c1100
GetUlongFromAddress: unable to read from fffff800032c11c0
 fffff8800131868c Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
Ntfs! ?? ::NNGAKEGL::`string'+6f60
fffff880`0131868c 55              push    rbp

IP_IN_PAGED_CODE: 
Ntfs! ?? ::NNGAKEGL::`string'+6f60
fffff880`0131868c 55              push    rbp

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  VSSVC.exe

If the crashes persist we may have to look at enabling Driver Verifier.

sheisel · 10 Aug 2015

I started Driver Verifier and it ran for a couple of days without a problem, but sometime over the weekend windows shut down. Attached is the zip file.

I set the Volume ShadowCopy service to manual, but was not sure how to disable it.

sheisel · 18 Aug 2015

Reposting

I started Driver Verifier and it ran for a couple of days without a problem, but sometime over the weekend windows shut down. Attached is the zip file.

I set the Volume ShadowCopy service to manual, but was not sure how to disable it.