SERVICE_EXCEPTION and MEMORY_MANAGEMENT BSODs after PC rebuild

[Polygone]

Hey,

I've recently rebuilt my PC following an issue caused by a faulty PSU. It damaged the PC to the point where it wouldn't switch on. After trying a lot of fixes provided by the kind people on your sister site, EightForums, I RMA-ed the motherboard and processor. After installing their replacements, the PC booted up fine and Windows 7 installed without a problem.

However, yesterday I got two BSOD error messages which make me wonder whether any other components were damaged by the old PSU.

The first error message, SYSTEM_SERVICE_EXCEPTION_ERROR (I think), appeared after my PC froze during Norton 360's Update. I rebooted my PC thinking that would be it. I then installed Catalyst Control Centre for my graphics card and went on the internet. After a while Firefox crashed and kept crashing when I tried to restart it from the error reporting window. I then opened Internet Explorer for the first time since installing Windows 7 and received the following error message:

WerFault.exe - Application Error
The instruction at 0x0014d38 referenced memory at 0x0014d38. The memory could not be written. Click on OK to terminate the program.

After clicking on OK, the message repeated for the following referenced memories: 0x0022e650, 0x001ae5b0, 0x0019e2ac, 0x0015e31c, 0x000de6a8, 0x0022e1b0, 0x0010e4f8, 0x0009e5d4 and 0x0018e158.

The error message below appeared about halfway through the above messages.

WerFault.exe - Application Error
The exception privileged instruction (0xc0000096) occurred in the application at location 0x000fe060. Click on OK to terminate the program.

Thinking it was the memory, I ran Windows' Memory Diagnostic Utility. Once the test finished, my PC tried to restart but Windows said that start up had failed. Start Up Repair ran automatically and recommended System Restore. I followed the suggestion and System Restore succeeded. The confirmation window said that "An unspecified hardware change was to blame".

System Restore had taken my PC back to before Norton 360 had installed, so I re-installed it. I booted into the Repair Your Computer screen and ran the Windows Memory Diagnostic again as the original test's results weren't visible after System Restore had completed. After the test had ran again, my PC booted to the desktop. A grey window flashed up briefly but apart from that, there was no other sign of the memory test's results. So, I plugged in a USB stick to install memtest86+ when my PC froze and a MEMORY_MANAGEMENT BSOD appeared. I then turned off my computer.

I was able to install memtest86+ on to a USB stick using another computer and ran the test on my PC. It came back negative.

I've had MEMORY_MANAGEMENT BSODs before but always suspected it was down to my SSD. However, it's not connected to my PC at the minute and the possibility came up then that the RAM could be faulty.

I've attached both BSOD dump files to this post. Could someone please look at these files and tell me what they think caused these crashes? I hope this essay helps as well!

Thanks in advance!

 

[Arc]

The MEMORY_MANAGEMENT (1a) BSOD is showing Some random errors of tunnel.sys (related to network); and Ntfs.sys and fltmgr.sys (related to storage functioning).

The concurrent failure of these two are indicating to either a virus or an ambitious antivirus blocking things.

The SYSTEM_SERVICE_EXCEPTION (3b) BSOD are also showing those. So the previous assumption is correct, irrespective of the bugcheck code.

A deeper search in the SYSTEM_SERVICE_EXCEPTION (3b) BSOD revealed teh failing modules. Those are ....

Symantec Extended File Attributes ....

fffff880`075b42e8  fffff880`012f0cffUnable to load image \SystemRoot\system32\drivers\N360x64\1404000.028\[URL="http://www.carrona.org/drivers/driver.php?id=SYMEFA64.SYS"]SYMEFA64.SYS[/URL], Win32 error 0n2
*** WARNING: Unable to verify timestamp for [URL="http://www.carrona.org/drivers/driver.php?id=SYMEFA64.SYS"]SYMEFA64.SYS[/URL]
*** ERROR: Module load completed but symbols could not be loaded for [URL="http://www.carrona.org/drivers/driver.php?id=SYMEFA64.SYS"]SYMEFA64.SYS[/URL]
 SYMEFA64+0xe2cff

Description here: Driver Reference Table - SYMEFA64.SYS

Symantec Heuristics Driver ....

fffff880`075b3da8  fffff880`047279c1Unable to load image \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.4.0.40\Definitions\BASHDefs\20130531.001\[URL="http://www.carrona.org/drivers/driver.php?id=BHDrvx64.sys"]BHDrvx64.sys[/URL], Win32 error 0n2
*** WARNING: Unable to verify timestamp for [URL="http://www.carrona.org/drivers/driver.php?id=BHDrvx64.sys"]BHDrvx64.sys[/URL]
*** ERROR: Module load completed but symbols could not be loaded for [URL="http://www.carrona.org/drivers/driver.php?id=BHDrvx64.sys"]BHDrvx64.sys[/URL]
 BHDrvx64+0xbc9c1

Description Here: Driver Reference Table - BHDrvx64.sys

Most common .... observed those errors numerous times.

Uninstall Norton and all Symentec products using Norton Removal tool. Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.
Download, install and update those, and then run full system scans with both of them, one by one.

Let us know the results.
_______________________________________________________________________________
BSOD ANALYSIS:

BugCheck 1A, {5002, fffff780c0000000, 32f1, 40032ebfffffffe}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+29ac1 )

Followup: MachineOwner
------------------------------------------------------------------------------------------
BugCheck 3B, {c0000005, fffff80002dae7ca, fffff880075b4010, 0}

Probably caused by : ntkrnlmp.exe ( nt!NtCreateSection+18d )

Followup: MachineOwner
---------

 

[Polygone]

Thanks for the reply, Arc.

I did as you asked and removed Norton 360. After scanning my PC in Safe Mode with MSE, and it not finding anything, I booted my PC normally before scanning with MBAM. Upon reaching the desktop, Windows automatically restarted. As it was booting up again, I got a message saying that Windows didn't start properly. After choosing the option to boot up normally, a window appeared saying that Windows had recovered from an unexpected error. Although I didn't see it at the time, it turns out it was a BSOD with the BBCode 1e. It's dump file is attached.

I managed to run MBAM in Safe Mode and it found a result! Namely: PUP.IBryte. The text log is also attached to this message. I was able to remove and quarantine whatever it is that I found.

I'm still having problems though. After booting up normally to update this thread from my PC, Firefox crashed like it did last time i.e. it kept crashing immediately after trying to restart it from error reporting window. Internet Explorer stopped working too, but no other error messages were created.

After this I went to check Windows Firewall through the Control Panel and the link wouldn't open. It did recognise the link was there though. Shortly after, I received a message that MSE's real-time protection was switched off. The pop-up window to restart either it or Windows Defender seemingly did nothing, so I closed it. I then clicked on the little arrow on the right-hand side of the taskbar and MSE's icon was green. When I opened MSE from here, it said it was fine.

I'm not quite sure what to make of this.

P.S. I transferred the attached text log and dump files from my PC to another laptop. I scanned the USB stick I used to port them over with Norton 360 and the scan came back negative. I just thought I'd let you know in case you think my PC is still infected with a virus.

 

[Arc]

The Qualcomm Atheros AR8161/8165 PCI-E Gigabit Ethernet Controller (NDIS 6.20) driver should be updated. Get the version 2.1.0.7 dated 2012/09/20 from GIGABYTE - Motherboard - Socket 1155 - GA-Z77-D3H (rev. 1.0)

Uninstall these bloatware:

• Start Menu\Programs\GIGABYTE
• Start Menu\Programs\GIGABYTE\AutoGreen
• Start Menu\Programs\GIGABYTE\ET6

Scan the system for possible virus infection with the following programs.

• Anti-rootkit utility TDSSKiller
• Windows Defender Offline

Do some Disc checks.

1. Reseat the sata and power.
   
   
2. Run chkdsk /f/r, following the option two of the tutorial Disk Check
3. Seatool for dos: SeaTools | Seagate download
   Burn it in a blank cd. boot from the CD, click on "Accept", wait for it to finish detecting the drives, then in the upper left corner select "Basic Tests", then select "Long Test" and let it run.
4. Post a screenshot of your HDD using CrystalDiskInfo - Software - Crystal Dew World

Let us know the results.

 

[Polygone]

Thanks Arc,

I did everything that you asked. All of the scan results came back negative. I did have a problem with SeaTools for DOS though. Once I burnt the .ISO to a blank DVD, I couldn't get it to run the long test. Each time I tried, the program would freeze. Sometimes it would freeze just after it detected the drives and before it said that my HDD may need a firmware update. (It doesn't though, I checked.) I've re-downloaded the .ISO again and burnt it to another blank DVD and had the same problem.

Is there a way to get it to run from a USB drive? Or could I use the Windows version instead?

RE: The screenshot of my HDD from Crystal Disc Info. I've seen that "Reallocated Sectors Count" warning before. I Googled it and it said that it was unusable parts of the HDD, most likely from manufacturing, that are similar to the dead pixels on LED/LCD screens. The amount of unusable sectors hasn't changed since I last checked it a few months ago.

 

[Arc]

You can use Seatools from a USB. Use Win32 Disk Imager | Free Development software downloads at SourceForge.net to burn the ISO to the USB.

The caution indication can be converted to good using CrystalDiscInfo. Click on the caution Button, you will get another window ....

In the resulting window, there are three sliders in the left. Drag them to the ultimate left, and notice the values at the right side are converting to zeros.

Now click the apply button, and notice that the caution is gone.

After these, observe the situation that it is causing more BSODs or not.

 

[Polygone]

I'm still not having much luck with getting Seagate Tools to run. I couldn't use Win32 Disk Imager because apparently it doesn't support ISO burning. I can't find where I read that now but it wouldn't let me burn the ISO.

I tried using ISOtoUSB to burn the ISO to the USB, but it didn't work. When booting up, it said something along the lines of "Remove media or device. Press any key to continue". I tried using both FAT32 and NTFS formats, but still nothing. I even quick formatted the drive before burning and re-downloaded the ISO file in case it was corrupted. I made sure to select the "bootable" option too.

Since we seem to have ruled out viruses, i've also tried to burn Seagate Tools with my PC but my BD-ROM doesn't recognise writeable DVDs as being writeable.

The drive is a LiteOn 4x IHOS104-32. I'm using ISO Recorder as the drive only came with PowerDVD 10. I've tried two brands of DVD-RW with no luck. I've tried the Microsoft Fixit for CD/DVD drives not reading or writing media and i've reinstalled the drive in Device Manager, but still nothing. The drive's firmware is up to date.

Can you help me with this too, please?

 

[Arc]

Use Win32 Disk Imager | Free Development software downloads at SourceForge.net to make a bootable USB using seatools ISO.

Step 1:
View attachment 275447

Step 2:
View attachment 275448

Step 3:
View attachment 275449

Step 4:
View attachment 275450

 

[Polygone]

I tried it again and the program says that the burn completed successfully. However, when it comes to booting from the USB stick, my PC just boots up normally.

I've checked Win32 Disk Imager's "Read Me" file and it says that it only writes img files. The link is here: http://heanet.dl.sourceforge.net/project/win32diskimager/README.txt

I've started a thread for my DVD and CD writing problems. The link is here: http://www.sevenforums.com/hardware...nt-recognise-writeable-discs.html#post2458405

In the meantime, would a scan with the Windows version of Seatools in Safe Mode be as effective as the DOS version? If so, what type of scan would you recommend as there appears to be more variety with the Windows version.

 

[Arc]

You may try seatools for windows. But It is not very effective with problematic Discs, whereas I am thinking your HDD is problematic.

To boot from the USB, either you need to enter into the BIOS or you need to use the boot menu key to select the USB at boot device. In normal course it would not boot from the USB directly.

 

[Polygone]

I did try it from the motherboard's boot menu. It was after I selected the "u disk" entry that it booted to the desktop. How would I do it from the BIOS?

 

[Arc]

Fill up your system specs.
See your system specs and fill it up here.

The process to access boot menu key and enter to BIOS key depends on make/model of the computer.

 

[Polygone]

Done!

 

[Arc]

Connect the USB to the computer and restart.
Tap the F12 key on the keyboard during booting, and press it frequently. It will give you the boot menu key ... like this one.

Select the USB stick using the up/down arrow key and hit enter. It will boot from the USB stick.

 

[Polygone]

Actually, that's the way that I tried. I'm sorry for getting it wrong. Is it worth changing the boot order in Windows?

 

[Arc]

You can change the boot order for the time being. But the boot menu key works all the times, and it is the easier option.

 

[Polygone]

Ok, so I managed to get SeaTools for DOS to boot off a USB stick using this method: NowhereLAN » Boot SeaTools off of a USB Drive

I've updated my chipset drivers from the Gigabyte website as I've heard that can be a reason for the test not running. However, the test still won't run as it should do. The status bar just says "Testing" and the clock freezes.

I'm assuming that the SeaTools scan always looks like it does in the link below:

Seatools for DOS - YouTube

Do you have any ideas why it might not be working for me?

 

[Arc]

Yes, the seatools scan should look like the video you pointed. It it is doing something different, that should mean that it is detecting some problem and so it cannot pass a particular point where the clock freezes.

Try long test. It has a mechanism to recover the bad sectors after the test is done. Though t takes a few hours to be completed.

If the long test also fails, better you replace the HDD.

 

[Polygone]

Yeh, the long test freezes at start up as well. SeaTools for Windows' Long Generic Test ran fine and didn't find any problems. I know that you said that the Windows version wasn't very effective at finding faulty drives but as it managed to run, does that change your diagnosis?

 

[Arc]

It is not a good indicator that the Seatools for DOS is not working properly. But, as the Seatools for Windows passed, it is apparently good.

Have you had more BSODS after this post? http://www.sevenforums.com/bsod-hel...ement-bsods-after-pc-rebuild.html#post2446984

If so, let us see the dumps.