BSOD says Device Driver Attempting to Corrupt the system

bearcat22 · 18 Mar 2019

Thank you for taking a look. Running Win 7 64, using HP p6710f desktop.

Was getting BSOD with various errors. Replaced the RAM with new, and for a few
days it was better. BSOD began again.

Took the computer to professionals at MicroCenter, and they stated it was corrupt RAM
even though I told them it was brand new. They sold me replacement RAM. After I installed
it, all programs ran incredibly slowly.

I found that I could not launch Malwarebytes, and none of my browsers would launch, making me
suspect a virus.
I am currently doing everything in Safe Mode.
Hopefully I can figure out how to attach the Minidump files and other things needed
to analyze.

Currently it will only boot to BSOD saying "A problem has been detected. A device driver
attempting to corrupt the system has been caught. The faulty driver currently on the kernel stack must be replaced with a working version."

Unfortunately, I don't know how to identify or how to replace a faulty driver.

your help is greatly appreciated, I've been struggling with this for a whole week!

**axe0** · 18 Mar 2019

Hi bearcat22,

It looks like the crashes are caused by a driver from Avg Secure Search.
Have you had Avg installed in the past?

bearcat22 · 18 Mar 2019

axe0 said:

Hi bearcat22,

It looks like the crashes are caused by a driver from Avg Secure Search.
Have you had Avg installed in the past?

Thank God! Thank you for helping! Yes, I have long long ago used AVG.
Can you please tell me the name of the driver and how to remove it?

I notice that something called MsMpEng.exe uses up a huge amount
of RAM. When I was able to get Malwarebytes running a few days ago,
it also showed it was using a ridiculous amount of RAM.

I am currently in Safe Mode and am running Trend Micro free online
virus scan.

I've run Windows Update in Normal mode, and as far as I can tell,
it shows nothing about needing to replace any driver. So, I don't understand
the BSOD.

Update: Trend Micro results say that nothing was found.

billmcct · 18 Mar 2019

Try the AVG Removal tool.
Install AVG on your PC, Mac | AVG installation files

bearcat22 · 18 Mar 2019

billmcct said:

Try the AVG Removal tool.
Install AVG on your PC, Mac | AVG installation files

Thanks. Could you please be more specific? There appear to be several tools.

I ran "AVG Clear" and it is hung up on "Deleting file C:\defs\fffff\engsup.exe"

That is not the correct name. I'm an old man with bad eyes, and it is physically
impossible for me to tell how many "ffff" there are in that name.

There is something else, called "Universal AVG Removal Tool" Running that just gives
a rotating hourglass that never ends. How many hours should I run this before I know that
it is not working?

Update: These finished running, and I ran them both again.
As far as I can tell, there is no more AVG content on the machine.
Rebooted, and got the Exact Same BSOD as before, saying a
device driver is the problem.

I then went into device manager in Safe Mode, and checked every
item to see if there were updates needed. every single thing says
that the drivers are up to date.

Update: In Safe Mode I downloaded and ran Microsoft Malicious software removal tool. As it ran, it SAID that it had found 4 items, but when it finished the end screen said "No malicious software was detected"

**axe0** · 18 Mar 2019

Before doing anything below, please note that although some of what I posted is a bit extreme, it is just to be sure nothing will interfere with Malwarebytes as I suspect Malwarebytes should be able to handle this issue.

Please try the following:

Search msconfig and open it
- Go to the tab services
- Check 'hide microsoft services'
- Uncheck all other services
- Go to the tab startup
- Disable everything
Click apply and click ok
Reboot your pc to normal mode.

Next, please download Rkill by Grinler and save it to your desktop.

Link 1
Link 2
- Double-click on the Rkill desktop icon to run the tool.
- If using Vista/Windows7, right-click on it and Run As Administrator.
- A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
- If not, delete the file, then download and use the one provided in Link 2.
- If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs
- If the tool does not run from any of the links provided, please let me know.

Do not reboot the computer, you will need to run the application again.

Next, run Malwarebytes.

bearcat22 · 18 Mar 2019

axe0 said:

Before doing anything below, please note that although some of what I posted is a bit extreme, it is just to be sure nothing will interfere with Malwarebytes as I suspect Malwarebytes should be able to handle this issue.

Please try the following:

Search msconfig and open it
- Go to the tab services
- Check 'hide microsoft services'
- Uncheck all other services
- Go to the tab startup
- Disable everything
Click apply and click ok
Reboot your pc to normal mode.

Next, please download Rkill by Grinler and save it to your desktop.

Link 1
Link 2
- Double-click on the Rkill desktop icon to run the tool.
- If using Vista/Windows7, right-click on it and Run As Administrator.
- A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
- If not, delete the file, then download and use the one provided in Link 2.
- If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs
- If the tool does not run from any of the links provided, please let me know.

Do not reboot the computer, you will need to run the application again.

Next, run Malwarebytes.

Thank you for your help.

I am pretty desperate, and have been thinking that the only way to fix this
is to upgrade from Windows 7 to Windows 10.
Win 7 came preinstalled and I have no installation disk.

Right now, I am in Safe Mode. I cannot boot to Normal Mode at all.

Right now, I get a new BSOD that says "USBfilter.sys The driver is attempting to access memory after it has been freed STOP: 0x000000D5

When I tried to download the Windows 10 upgrade tool, it said Error: 0x8007042C-0x90017

I have not purchased Win 10, I'm assuming the upgrade is still for free

I will not follow your instructions until after you respond to this.

**axe0** · 18 Mar 2019

The upgrade isn't free anymore, technically the free upgrade shouldn't have been possible anymore for a long time (even though it still was), though I only know this theoretically and cannot say with certainty.

Could you upload the latest dump file, just copy it from Windows\Minidump to the desktop, then zip it and upload it here.
Note that you cannot do anything with it while it is in the Minidump folder, that's why you need to copy it to another location like the desktop.

bearcat22 · 18 Mar 2019

axe0 said:

The upgrade isn't free anymore, technically the free upgrade shouldn't have been possible anymore for a long time (even though it still was), though I only know this theoretically and cannot say with certainty.

Could you upload the latest dump file, just copy it from Windows\Minidump to the desktop, then zip it and upload it here.
Note that you cannot do anything with it while it is in the Minidump folder, that's why you need to copy it to another location like the desktop.

I am not sure I understand. Trying now to give you the Minidump.

bearcat22 · 18 Mar 2019

Is there any source that is both Cheap and Safe to get a LEGITIMATE copy of Windows?
A physical disk I can keep and use to repair with, like back in the good old days of XP?
For example, this seems cheap: Windows 10 Home 32/64bit download

But is it LEGAL and not pirated? How do I know?