BSOD at random times. " A driver has overrun a stack-based buffer"

lazarba · 14 Jun 2015

Hello .
So in the past 3 ( I think ) months I have been getting some random BSOD crashes. I believe to have made a connection between those crashes and my leaving my PC open for long durations of time unattended . By that, I mean that those crashes almost never happen while I am actually working, but when I leave my PC running and pay no attention to it ( when I am downloading a game for example). Auto Sleep Mode is turned off.
I do believe this has something to do with my GPU. When those crashes first started, or around the time anyway, I recall that I had trouble installing a program that had nothing to do with my GPU really ( Popcorn time). Still, every time I launched the installer my system gave me a BSOD crash. Being computer savvy , and having had a rich history of crashes caused by my GPU, I removed it from my Mobo and turned to my built-in Intel HD GPU. The installer worked fine, I shut down my PC, re-inserted my AMD GPU and everything was okay. The program now worked with the AMD GPU inserted , the problem appeared to occur while installing particularly . Anyway, here is a .zip file of the minidumb reports.
Thanks in advance!

Arc · 14 Jun 2015

Please give us a broader perspective. Post it following the Blue Screen of Death (BSOD) Posting Instructions so that we can check the origin and application of the failing module as determined (WinFLAdrv.sys); which will help us to help you better.

Attach the resulting zip with your reply post, dont create another thread for it. :)
___________________________________________________________________________

Code:

BugCheck F7, {ffff9e806bf46180, f88002ba01e5, ffff077ffd45fe1a, 0}

Probably caused by : WinFLAdrv.sys ( WinFLAdrv+3dde )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_OVERRAN_STACK_BUFFER (f7)
A driver has overrun a stack-based buffer.  This overrun could potentially
allow a malicious user to gain control of this machine.
DESCRIPTION
A driver overran a stack-based buffer (or local variable) in a way that would
have overwritten the function's return address and jumped back to an arbitrary
address when the function returned.  This is the classic "buffer overrun"
hacking attack and the system has been brought down to prevent a malicious user
from gaining complete control of it.
Do a kb to get a stack backtrace -- the last routine on the stack before the
buffer overrun handlers and bugcheck call is the one that overran its local
variable(s).
Arguments:
Arg1: ffff9e806bf46180, Actual security check cookie from the stack
Arg2: 0000f88002ba01e5, Expected security check cookie
Arg3: ffff077ffd45fe1a, Complement of the expected security check cookie
Arg4: 0000000000000000, zero

Debugging Details:
------------------


DEFAULT_BUCKET_ID:  GS_FALSE_POSITIVE_MISSING_GSFRAME

SECURITY_COOKIE:  Expected 0000f88002ba01e5 found ffff9e806bf46180

CUSTOMER_CRASH_COUNT:  1

BUGCHECK_STR:  0xF7

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre

LAST_CONTROL_TRANSFER:  from fffff88002b9ddde to fffff800032778c0

STACK_TEXT:  
fffff880`0df42e38 fffff880`02b9ddde : 00000000`000000f7 ffff9e80`6bf46180 0000f880`02ba01e5 ffff077f`fd45fe1a : nt!KeBugCheckEx
fffff880`0df42e40 00000000`000000f7 : ffff9e80`6bf46180 0000f880`02ba01e5 ffff077f`fd45fe1a 00000000`00000000 : WinFLAdrv+0x3dde
fffff880`0df42e48 ffff9e80`6bf46180 : 0000f880`02ba01e5 ffff077f`fd45fe1a 00000000`00000000 00000000`00000000 : 0xf7
fffff880`0df42e50 0000f880`02ba01e5 : ffff077f`fd45fe1a 00000000`00000000 00000000`00000000 00000000`00000000 : 0xffff9e80`6bf46180
fffff880`0df42e58 ffff077f`fd45fe1a : 00000000`00000000 00000000`00000000 00000000`00000000 fffff880`02b9d24d : 0x0000f880`02ba01e5
fffff880`0df42e60 00000000`00000000 : 00000000`00000000 00000000`00000000 fffff880`02b9d24d 00000000`00000000 : 0xffff077f`fd45fe1a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
WinFLAdrv+3dde
fffff880`02b9ddde ??              ???

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  WinFLAdrv+3dde

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: WinFLAdrv

IMAGE_NAME:  WinFLAdrv.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4fe33008

FAILURE_BUCKET_ID:  X64_0xF7_MISSING_GSFRAME_WinFLAdrv+3dde

BUCKET_ID:  X64_0xF7_MISSING_GSFRAME_WinFLAdrv+3dde

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_0xf7_missing_gsframe_winfladrv+3dde

FAILURE_ID_HASH:  {fba8cf81-b322-2e0b-ca5e-c65ee13fadec}

Followup: MachineOwner
---------

0: kd> lmvm WinFLAdrv
start             end                 module name
fffff880`02b9a000 fffff880`02ba6000   WinFLAdrv T (no symbols)           
    Loaded symbol image file: WinFLAdrv.sys
    Image path: \SystemRoot\SysWOW64\WinFLAdrv.sys
    Image name: WinFLAdrv.sys
    Timestamp:        Thu Jun 21 20:00:32 2012 (4FE33008)
    CheckSum:         00011598
    ImageSize:        0000C000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

lazarba · 14 Jun 2015

Sorry, hadnt seen those instructions. Here you go , and thank you for your time!

Arc · 14 Jun 2015

HMM.

The probleming driver is not found in your system. Neither in the msinfo32 file nor in the drivers list.

Attachment 362671

Attachment 362672

In that case we cannot say it is device driver that is causing the issue, but it is a malware.

STOP 0x000000F7: DRIVER_OVERRAN_STACK_BUFFER

Usual causes: Device driver, Malware

The best and most secure way to get rid of a malware is to perform a clean reinstall. I would suggest you to take this way.

lazarba · 14 Jun 2015

Arc said:

HMM.

The probleming driver is not found in your system. Neither in the msinfo32 file nor in the drivers list.

Attachment 362671

Attachment 362672

In that case we cannot say it is device driver that is causing the issue, but it is a malware.

STOP 0x000000F7: DRIVER_OVERRAN_STACK_BUFFER

Usual causes: Device driver, Malware

The best and most secure way to get rid of a malware is to perform a clean reinstall. I would suggest you to take this way.

Ouch. Heres the thing : I am quite fine with the idea of reinstalling. Thing is , I did reinstall no more than 5 months ago. And furthermore, I am very well aware( or I believe I am) of what I am installing on my system, which is why I am quite a bit shocked by the notion of this being caused by malware. Would a complete scan by an antivirus do the trick? I mean, I was kinda glad seeing how windows 10 would be introduced as an update and wouldnt need a fresh install , simply because because of a faulty SSD in the past, I have done so many reinstalls that the whole affair has started to bore me greatly, and given how I have been pretty satisfied with the state of my system these past 5 months , I was hoping I wouldnt have to reinstall until the end of the year.

Arc · 14 Jun 2015

So you have booked the 10 upgrade? Nice. :)

If you do a clean reinstall, you will be able to boo it again, and even if you dont book you will be able to upgrade to 10.

If you are really reluctant (I know your reason) to perform a clean reinstall, I would suggest you to start a thread in https://www.sevenforums.com/system-security/ about it. Persons like Jacee and Cottonball are active there who can nail a malware perfectly. If needed, put a link to this thread there.

I am not the right person to guide you in it, mate.

I can do BSODs. For any BSOD issue, just post back in this thread, I will be subscribed here.

lazarba · 14 Jun 2015

Well Arc , I will try my luck on the security thread, and will go for the reinstall if no solution is found.
I truly am grateful for your help.
Thank you again!

Arc · 14 Jun 2015

Welcome, mate.