BSOD — Seemingly random

Joshua277456 · 12 Sep 2015

Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.1.7601.2.1.0.256.48
Locale ID: 1033

Additional information about the problem:
BCCode: 1e
BCP1: FFFFFFFFC0000005
BCP2: FFFFF88001446418
BCP3: 0000000000000000
BCP4: FFFFFFFFFFFFFFFF
OS Version: 6_1_7601
Service Pack: 1_0
Product: 256_1

Files that help describe the problem:
C:\Windows\Minidump\091115-23181-01.dmp
C:\Users\Joshua\AppData\Local\Temp\WER-49623-0.sysdata.xml

Read our privacy statement online:
Windows 7 Privacy Statement - Microsoft Windows

If the online privacy statement is not available, please read our privacy statement offline:
C:\Windows\system32\en-US\erofflps.txt

I've attached the logs

Thanks for any help

ICIT2LOL · 13 Sep 2015

Hello and welcome Joshua mate there is something in the files that are to do with the ndis.sys and it is possible that the machine has got infected and the sys being used as cover for that malware

Code:

ADDITIONAL_DEBUG_TEXT:  
You can run '.symfix; .reload' to try to fix the symbol path and load symbols.
MODULE_NAME: ndis
FAULTING_MODULE: fffff80001c59000 nt
DEBUG_FLR_IMAGE_TIMESTAMP:  5034f6b2
READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPagedPoolEnd
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
 0000000000000000 
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP: 
ndis+1418
fffff880`0148c418 c3              ret
BUGCHECK_STR:  0x1E_c0000005_R
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
CURRENT_IRQL:  0
ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre
LAST_CONTROL_TRANSFER:  from fffff80001d4d832 to fffff80001ccc5c0
STACK_TEXT:  
fffff800`01ad7a08 fffff800`01d4d832 : 00000000`0000001e ffffffff`c0000005 fffff880`0148c418 00000000`00000000 : nt+0x735c0
fffff800`01ad7a10 00000000`0000001e : ffffffff`c0000005 fffff880`0148c418 00000000`00000000 ffffffff`ffffffff : nt+0xf4832
fffff800`01ad7a18 ffffffff`c0000005 : fffff880`0148c418 00000000`00000000 ffffffff`ffffffff fffff800`01ad7b01 : 0x1e
fffff800`01ad7a20 fffff880`0148c418 : 00000000`00000000 ffffffff`ffffffff fffff800`01ad7b01 fffff800`01ad7bf0 : 0xffffffff`c0000005
fffff800`01ad7a28 00000000`00000000 : ffffffff`ffffffff fffff800`01ad7b01 fffff800`01ad7bf0 00000000`00000008 : ndis+0x1418

STACK_COMMAND:  kb
FOLLOWUP_IP: 
ndis+1418
fffff880`0148c418 c3              ret
SYMBOL_STACK_INDEX:  4
SYMBOL_NAME:  ndis+1418
FOLLOWUP_NAME:  MachineOwner
IMAGE_NAME:  ndis.sys
BUCKET_ID:  WRONG_SYMBOLS
FAILURE_BUCKET_ID:  WRONG_SYMBOLS
ANALYSIS_SOURCE:  KM
FAILURE_ID_HASH_STRING:  km:wrong_symbols
FAILURE_ID_HASH:  {70b057e8-2462-896f-28e7-ac72d4d365f8}
Followup: MachineOwner

What I would do first up would be to run these

https://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

https://www.sevenforums.com/tutorials/433-disk-check.html< if necessary include the /f and /r in the command line as per Option2 (insafe mode is a wise way to go)

then these

http://www.superantispyware.com/

https://www.malwarebytes.org/lp/sem/5/?gclid=CJTmq6iGpscCFYqCvQodbfMN1A(free version and untick the trial option when it comes up

http://www.bleepingcomputer.com/download/adwcleaner/

ADW download from bleeping computerdelete any rubbish found with the malware scans

(Anyone running Kasperskyinternet security will find it rants about ADW - ignore it or disable Kasperskywhile running ADW)
You could do the malware scans first if you like .

I am suggesting this because of one of the many links I got for that issue http://answers.microsoft.com/en-us/windows/forum/windows_xp-hardware/what-is-ndissys/406ef722-05c6-4b47-961f-fa9f4e6db8d8?auth=1

Joshua277456 · 13 Sep 2015

Okay so I ran a full system scan with Avast. I set the parameters to scan:

all harddisks
CD/DVD drives
all removable media
memory loaded modules
auto-start programs
rootkits

The scan found nothing.

I then ran SFC in cmd using "VerifyOnly" and it said "Windows Resource Protection did not find and integrity violations"

I then ran CHKDSK (at boot) here are the results (taken from Event Viewer)

Checking file system on C:
The type of the file system is NTFS.
Volume label is OS.

A disk check has been scheduled.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 5)...
216576 file records processed. File verification completed.
1662 large file records processed. 0 bad file records processed. 2 EA records processed. 47 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)...
278130 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)...
216576 file SDs/SIDs processed. Cleaning up 350 unused index entries from index $SII of file 0x9.
Cleaning up 350 unused index entries from index $SDH of file 0x9.
Cleaning up 350 unused security descriptors.
Security descriptor verification completed.
30778 data files processed. CHKDSK is verifying Usn Journal...
34000288 USN bytes processed. Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
216560 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
71137435 free clusters processed. Free space verification is complete.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
CHKDSK discovered free space marked as allocated in the volume bitmap.
Windows has made corrections to the file system.

468874239 KB total disk space.
183861300 KB in 167269 files.
131872 KB in 30779 indexes.
0 KB in bad sectors.
331323 KB in use by the system.
65536 KB occupied by the log file.
284549744 KB available on disk.

4096 bytes in each allocation unit.
117218559 total allocation units on disk.
71137436 allocation units available on disk.

Internal Info:
00 4e 03 00 ab 05 03 00 60 e0 05 00 00 00 00 00 .N......`.......
22 27 00 00 2f 00 00 00 00 00 00 00 00 00 00 00 "'../...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

Windows has finished checking your disk.
Please wait while your computer restarts.

I didn't download and run Adware Cleaner because I don't feel the need to. I know I don't have any PUPs, malicious toolbars, or adware. I check startup programs on a regular basis and I also have never seen any signs of adware. I also keep my toolbars in Firefox to a minimum. I know what programs are installed on a computer, and I consistently maintain what's installed and what's on my computer.

I haven't had another BSOD so I'll have to see...

Perhaps it's a certain program that triggers my BSOD.

ICIT2LOL · 13 Sep 2015

That maybe so Joshua and yes lets see what happens.

If things do go off the rails again then keep this scan in mind as this will scan the machine from back to front without involving Windows. In the texts it does describe what you need to do and that is just making a bootable disk - which of course you boot from not Windows after setting the BIOS to first boot from the optical or USB source. I prefer disk the choice is yours - if you have to use that is.

Joshua277456 · 14 Sep 2015

ICIT2LOL said:

That maybe so Joshua and yes lets see what happens.

If things do go off the rails again then keep this scan in mind as this will scan the machine from back to front without involving Windows. In the texts it does describe what you need to do and that is just making a bootable disk - which of course you boot from not Windows after setting the BIOS to first boot from the optical or USB source. I prefer disk the choice is yours - if you have to use that is.

Are you refering to AdwCleaner?

AdwCleaner doesn't need to be ran from a boot device though. I just downloaded it and ran it. Here are the results (nothing as I suspected)

Code:

# AdwCleaner v5.007 - Logfile created 14/09/2015 at 03:21:50
# Updated 08/09/2015 by Xplode
# Database : 2015-09-10.1 [Server]
# Operating system : Windows 7 Professional Service Pack 1 (x64)
# Username : Joshua - JOSHUA-DELL
# Running from : C:\Users\Joshua\Downloads\AdwCleaner.exe
# Option : Cleaning
# Support : http://toolslib.net/forum

***** [ Services ] *****


***** [ Folders ] *****


***** [ Files ] *****


***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****


***** [ Registry ] *****


***** [ Web browsers ] *****


*************************

:: Winsock settings cleared

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [628 bytes] ##########

ICIT2LOL · 14 Sep 2015

Sorry Joshua mate I thought I had attached the link for this for the other scan I was referring to.
Download Kaspersky Rescue Disk 10 just read the info and then make a bootable disk or USB stick > set the BIOS to optical or the USB > then insert whichever you are going to use and power on .

It will boot to the Kaspersky application and doesn't involve Windows at all so it is totally unbiased as it were.

Joshua277456 · 14 Sep 2015

ICIT2LOL said:

Sorry Joshua mate I thought I had attached the link for this for the other scan I was referring to.
Download Kaspersky Rescue Disk 10 just read the info and then make a bootable disk or USB stick > set the BIOS to optical or the USB > then insert whichever you are going to use and power on .

It will boot to the Kaspersky application and doesn't involve Windows at all so it is totally unbiased as it were.

I'm still a bit confused.

Are you suggesting that I should go ahead and run Rescue Disk even though my system is currently stable? Will Rescue Disk allow me to just scan for issues? Or will it automatically try to fix them?

ICIT2LOL · 14 Sep 2015

No mate you don't have to run it but you can it doesn't do any harm if you do - but if like you say the machine stable right now leave it alone .
Just keep this in mind incase the problems come back. Anyway lets leave well alone for now:)