Frequent BSOD at random times.

Seikan340 · 02 Nov 2015

Hello, lately I started having a few BSOD happening at rather random moments, I mostly remember them happening while browsing on firefox, I've got for example one while watching a youtube video, or earlier reading a blog post.
I can go on for a few days without any or have to in a single day like today.

I thank you all for your time.

ICIT2LOL · 02 Nov 2015

Hello and welcome Seikan mate there is dump file I don't fully understand or have seen before and I suggest you run in safe mode these for starters as it looks to be a system thing.

https://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

https://www.sevenforums.com/tutorials/433-disk-check.html< if necessary include the /f and /r in the command line as per Option2

As an afterthought could you run Speccy and post the temps too https://www.piriform.com/speccy/download * when you post back shots of the Speccy readouts it will display the activation code - best dealt with taking a snip then use paint to obliterate it before posting snips How to Use the Snipping Tool in Vista > save the pic to wherever and then click on where you saved it to then right click it and use paint to erase the info ( a small icon that looks like a pencil eraser see pic

Code:

ADDITIONAL_DEBUG_TEXT:  
You can run '.symfix; .reload' to try to fix the symbol path and load symbols.
MODULE_NAME: tcpip
FAULTING_MODULE: fffff8000304c000 nt
DEBUG_FLR_IMAGE_TIMESTAMP:  533f5bd4
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP: 
tcpip+127c1d
fffff880`01b28c1d 8b4128          mov     eax,dword ptr [rcx+28h]
CONTEXT:  fffff8800cf5d870 -- (.cxr 0xfffff8800cf5d870;r)
rax=fffffa800d5555a0 rbx=fffffa800d5556d0 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000010 rdi=0000000000000010
rip=fffff88001b28c1d rsp=fffff8800cf5e250 rbp=fffff88001b6e9a0
 r8=0000000000000006  r9=fffff8800cf5e3a0 r10=fffffa8006835020
r11=fffff8800cf5e100 r12=0000000000000012 r13=fffffa80074dfb40
r14=0000000000000000 r15=0000000000000002
iopl=0         nv up ei ng nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
tcpip+0x127c1d:
fffff880`01b28c1d 8b4128          mov     eax,dword ptr [rcx+28h] ds:002b:00000000`00000028=????????
Last set context:
rax=fffffa800d5555a0 rbx=fffffa800d5556d0 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000010 rdi=0000000000000010
rip=fffff88001b28c1d rsp=fffff8800cf5e250 rbp=fffff88001b6e9a0
 r8=0000000000000006  r9=fffff8800cf5e3a0 r10=fffffa8006835020
r11=fffff8800cf5e100 r12=0000000000000012 r13=fffffa80074dfb40
r14=0000000000000000 r15=0000000000000002
iopl=0         nv up ei ng nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
tcpip+0x127c1d:
fffff880`01b28c1d 8b4128          mov     eax,dword ptr [rcx+28h] ds:002b:00000000`00000028=????????
Resetting default scope
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
BUGCHECK_STR:  0x3B
CURRENT_IRQL:  0
ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre
LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff88001b28c1d
STACK_TEXT:  
fffff880`0cf5e250 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip+0x127c1d

FOLLOWUP_IP: 
tcpip+127c1d
fffff880`01b28c1d 8b4128          mov     eax,dword ptr [rcx+28h]
SYMBOL_STACK_INDEX:  0
SYMBOL_NAME:  tcpip+127c1d
FOLLOWUP_NAME:  MachineOwner
IMAGE_NAME:  tcpip.sys
STACK_COMMAND:  .cxr 0xfffff8800cf5d870 ; kb
BUCKET_ID:  WRONG_SYMBOLS
FAILURE_BUCKET_ID:  WRONG_SYMBOLS
ANALYSIS_SOURCE:  KM
FAILURE_ID_HASH_STRING:  km:wrong_symbols
FAILURE_ID_HASH:  {70b057e8-2462-896f-28e7-ac72d4d365f8}
Followup: MachineOwner

**axe0** · 03 Nov 2015

tcpip.sys is a driver from Windows related to the network, meaning either the network drivers or 3rd party drivers connecting to the network are causing issues.

The flagged drivers are Malwarebytes Web Access control and Acronis Storage Filter management.
Either update or reinstall Malwarebytes and Acronis.

Code:

*** WARNING: Unable to verify timestamp for mwac.sys
*** ERROR: Module load completed but symbols could not be loaded for mwac.sys

2: kd> lmvm mwac
start             end                 module name
fffff880`0c8d9000 fffff880`0c8eb000   mwac     T (no symbols)           
    Loaded symbol image file: mwac.sys
    Image path: \??\C:\Windows\system32\drivers\mwac.sys
    Image name: mwac.sys
    Timestamp:        Wed Jun 18 04:06:34 2014 (53A0F42A)
    CheckSum:         00010FDD
    ImageSize:        00012000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4


*** WARNING: Unable to verify timestamp for fltsrv.sys
*** ERROR: Module load completed but symbols could not be loaded for fltsrv.sys

2: kd> lmvm fltsrv
start             end                 module name
fffff880`01f51000 fffff880`01f6f000   fltsrv   T (no symbols)           
    Loaded symbol image file: fltsrv.sys
    Image path: \SystemRoot\system32\DRIVERS\fltsrv.sys
    Image name: fltsrv.sys
    Timestamp:        Mon May 13 11:40:09 2013 (5190B4F9)
    CheckSum:         00021D3A
    ImageSize:        0001E000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

A 0x3B(SYSTEM_SERVICE_EXCEPTION) could have a few options where I'll try to explain what happens according to what I understand.
In this case it is likely that Malwarebytes and Acronis are both trying to access the internet, so they give instructions to the related driver to request data from the internet. However the data is not in the correct way requested so the related driver gives a signal that it can't execute the data, an exception of a system service (part of a program or a program) which hasn't been catched (properly).
I hope I have made it a little bit clear of what could have happened with a really short explanation, there are quite a few scenario's of what could have happened.

Lastly Seikan340, you are running a Lenovo Product ID on an ASUS board.
This makes your installation counterfeit.
Troubleshooting a counterfeit installation is useless as it is not known what has been modified to your system.
A counterfeit installation contains heavily modified code which causes the system to behave in unexpected ways.
For this reason, analyzing counterfeit systems is unreliable and most analysts won't try it.

Code:

OS Manufacturer:           Microsoft Corporation
OS Configuration:          Standalone Workstation
OS Build Type:             Multiprocessor Free
Registered Owner:          Djalal
Registered Organization:   
Product ID:                00426-OEM-8992662-00497 <-- Lenovo PID on ASUS board
Original Install Date:     06/06/2014, 18:34:32
System Boot Time:          02/11/2015, 20:45:06
System Manufacturer:       ASUS

I recommend to install a genuine copy of Windows.
If, after you have installed a genuine copy of Windows, you still get BSOD's we'll be happy to assist you.

ICIT2LOL · 03 Nov 2015

Interesting axe I could see it was something to do with Windows but not the rest (am only a novice) it was aslo a good spot to the malware stuff too.

Now I wonder if the validation could be cleared up with running this for the OP? Genuine Windows - Windows Help

Seikan340 · 03 Nov 2015

It does make sense that it would be related to malwarebytes since I did install it recently, I'll check it up, thanks a lot.

And yeah, it's my brother's custom built computer but he's abroad, it says Windows is activated but wouldn't be surprised it isn't a genuine copy of it... but yeah since I'm in charge of it for now I think I should get a genuine windows for it, probably W10 though I'm still a little bit skeptical about getting it now.

Anyways thanks again!

ICIT2LOL · 03 Nov 2015

it says Windows is activated but wouldn't be surprised it isn't a genuine copy of it...

No nor would I mate because a lot of counterfeit stuff is very often Ultimate and people think they are getting the very best when for ordinary use even Home premium is more than adequate. Just check out that link I sent.