Random BSOD, error 0x101

[Maesen]

Hi.

Came here a few months ago with a Windows problem and received great help. So here I am again with another issue.

First thing first, yesterday I reinstalled Malwarebyte's Anti-Malware. Computer ran great all day. I started having BSOD's this morning. About 5 crashes in 10 hours. I used WhoCrashed trying to see what it was but it says it appeared to be typical software driver bug and not likely to be caused by a hardware problem. So there's that. I downloaded Driver Reviver as pointed on a thread in here and ran it. Downloaded and updated the bad drivers. Ran Windows Update and installed them correctly. Updated GPU driver along with mouse and monitor, because I was there. Rebooted a couple of times while doing so.

Then I got another Blue Screen. So I Googled 0x101 troubleshootings. I tried downloading the Windows Debugging Tools from Microsoft but for some reason it fails the installation everytime.

I then ran the SFC /SCANNOW in Elevated Command Prompt which resulted in perfect shape. So I downloaded and ran the SF Diag Tools and ran it. Checked components temperatures with CPUID and everything is fine.

I would like some Guru help with the dump files in order to see what is happening.

I attached the zip file from the SF Diag Tool. Computer specs are as follow:

• Windows 7 Ultimate 64bits SP1
• Asus Sabertooth 990FX R2.0
• AMD FX-8350
• 16gb of RAM
• nVidia GeForce GTX 660
• 1TB Caviar Black
• 2TB Caviar Black

I believe everything is there. Thanks for your help, I am off for the night and will read your replies in the morning.

 

[Golden]

Based on entries in your HOSTS file, please do the following:

1. Download and save this tool to your desktop:
http://go.microsoft.com/fwlink/?linkid=52012

2. Run the tool, and then click Copy - ignore any errors if they appear

3. Use CTRL+V to paste the unedited results of the tool here in your next reply

 

[Maesen]

Here it is (I lied, I am not yet going to sleep).

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-MQYRM-B9BK4-RTTDF
Windows Product Key Hash: Cf76KjisuP+wnd5crWnBaIbCLz4=
Windows Product ID: 00426-OEM-9154216-39349
Windows Product ID Type: 3
Windows License Type: OEM System Builder
Windows OS version: 6.1.7601.2.00010100.1.0.001
ID: {70154BBA-6AB6-4519-A5CC-32199F22CFC9}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Ultimate
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.130828-1532
TTS Error:
Validation Diagnostic:
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: F:\Programmes\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{70154BBA-6AB6-4519-A5CC-32199F22CFC9}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.001</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-RTTDF</PKey><PID>00426-OEM-9154216-39349</PID><PIDType>3</PIDType><SID>S-1-5-21-1293902068-4282505607-1195329872</SID><SYSTEM><Manufacturer>To be filled by O.E.M.</Manufacturer><Model>To be filled by O.E.M.</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>1503</Version><SMBIOSVersion major="2" minor="7"/><Date>20130111000000.000000+000</Date></BIOS><HWID>663C3807018400F2</HWID><UserLCID>0C0C</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>

Spsys.log Content: 0x80070002

Licensing Data-->
Software licensing service version: 6.1.7601.17514

Name: Windows(R) 7, Ultimate edition
Description: Windows Operating System - Windows(R) 7, OEM_COA_NSLP channel
Activation ID: cfb3e52c-d707-4861-af51-11b27ee6169c
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00426-00182-542-139349-02-3084-7601.0000-1262013
Installation ID: 012420832221035212102233388010083304473792565413278131
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: RTTDF
License Status: Licensed
Remaining Windows rearm count: 3
Trusted time: 2013-12-23 01:31:40

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: N/A
HealthStatus: 0x0000000000000000
Event Time Stamp: N/A
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: MAAAAAEAAwABAAEAAAACAAAAAQABAAEAHKL6N6p2ZMdGUnTEktEavxZDysQKqW51

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC ALASKA A M I
FACP ALASKA A M I
HPET ALASKA A M I
MCFG ALASKA A M I
FPDT ALASKA A M I
SSDT AMD POWERNOW
BGRT ALASKA A M I

 

[Golden]

Looks OK to me. Clean up those dodgy Adobe activation lines in your HOSTS file, and I'll have a look at your dmp files in the next hour or so and make some suggestions.

 

[Maesen]

Looks OK to me. Clean up those dodgy Adobe activation lines in your HOSTS file, and I'll have a look at your dmp files in the next hour or so and make some suggestions.

May I ask for the correct way to remove them? I simply deleted the lines from the Hosts for now and I will continue with you in the morning. Thank you so far Golden.

 

[Arc]

Hi Maesen.

Are you overclocking? As you are getting BSODs, you should stop overclocking and run all the hardware components like CPU, GPU and RAM to their default settings.

Check if the Power Supply Unit (PSU) supplying adequate power to the computer or not.
eXtreme Power Supply Calculator
Also let us know the wattage of your PSU.

Is the computer hot? Report us the heat of the computer after a couple of hours of your normal usage. Upload a screenshot of the summery tab of Speccy. Alternatively, you can publish a Speccy snapshot too: http://www.sevenforums.com/tutorials/311593-speccy-publish-snapshot-your-system-specs.html .

Do some hardware tests like:

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.
If it start showing errors/red lines, stop testing. A single error is enough to determine that something is going bad there.

Stress test the Graphics Card using Furmark.
Video Card - Stress Test with Furmark
Let us see a screenshot of furmark window before you close it.

Stress test the CPU.
Hardware - Stress Test With Prime95

There is very frequent BIOS update for this board. There must be some good reason for it. Update the BIOS to Version 2104 dated 2013.12.11 from ASUSTeK Computer Inc. -Support- Drivers and Download SABERTOOTH 990FX R2.0

And, update Asmedia SATA Controller Driver V1.3.4.0 from the same page.

Finally, Free up the startup. Windows does not need any other program to auto start with it, but the auto start programs often conflicts and causes various problems including BSODs.

1. Click on the Start button
2. Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window.
3. Select the “Startup” tab.
4. Deselect all items other than the antivirus.
5. Apply > OK
6. Accept then restart.

Let us know the results.

_______________________________________________________________________________________

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 101, {19, 0, fffff88002f65180, 2}

Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CLOCK_WATCHDOG_TIMEOUT (101)
An expected clock interrupt was not received on a secondary processor in an
MP system within the allocated interval. This indicates that the specified
processor is hung and not processing interrupts.
Arguments:
Arg1: 0000000000000019, Clock interrupt time out interval in nominal clock ticks.
Arg2: 0000000000000000, 0.
Arg3: fffff88002f65180, The PRCB address of the hung processor.
Arg4: 0000000000000002, 0.

Debugging Details:
------------------


BUGCHECK_STR:  CLOCK_WATCHDOG_TIMEOUT_8_PROC

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  mbamservice.ex

CURRENT_IRQL:  d

STACK_TEXT:  
fffff880`09b1dd08 fffff800`03121a4a : 00000000`00000101 00000000`00000019 00000000`00000000 fffff880`02f65180 : nt!KeBugCheckEx
fffff880`09b1dd10 fffff800`030d46f7 : 00000000`00000000 fffff800`00000002 00000000`000186a0 fffff880`012b3607 : nt! ?? ::FNODOBFM::`string'+0x4e3e
fffff880`09b1dda0 fffff800`03016895 : fffff800`0303c460 fffff880`09b1df50 fffff800`0303c460 00000000`00000000 : nt!KeUpdateSystemTime+0x377
fffff880`09b1dea0 fffff800`030c7113 : 00000000`30101f95 fffff800`03245e80 fffff800`03245e80 00000000`00000000 : hal!HalpHpetClockInterrupt+0x8d
fffff880`09b1ded0 fffff800`030cf9f0 : fffff800`03245e80 fffff800`00000001 00000000`00000000 fffff880`09b1e168 : nt!KiInterruptDispatchNoLock+0x163
fffff880`09b1e060 fffff800`030ea251 : 00000000`00000000 00000000`00000004 00000000`00000001 fffffa80`120d0c70 : nt!KeFlushMultipleRangeTb+0x260
fffff880`09b1e130 fffff800`030ecc98 : 00000000`00000004 fffff880`09b1e280 fffff8a0`0cd96000 00000000`00000001 : nt!MiFlushTbAsNeeded+0x1d1
fffff880`09b1e240 fffff800`031fbf86 : 00000000`00003ab0 fffffa80`0c6db000 00000000`00000001 00000000`00000000 : nt!MiAllocatePagedPoolPages+0x4cc
fffff880`09b1e360 fffff800`030ea9b0 : 00000000`00003ab0 fffffa80`0c6db000 00000000`00000001 00000000`000000a3 : nt!MiAllocatePoolPages+0x906
fffff880`09b1e4a0 fffff800`031ff43e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00003ab0 : nt!ExpAllocateBigPool+0xb0
fffff880`09b1e590 fffff800`0338b6e7 : 00000000`10000000 00000000`10000000 00000000`00000001 00000000`00000000 : nt!ExAllocatePoolWithTag+0x82e
fffff880`09b1e680 fffff800`033c855c : fffff8a0`0cd6ea30 fffff880`09b1e878 00000000`0000011d 00000000`00000000 : nt!MiRelocateImage+0x347
fffff880`09b1e7f0 fffff800`033a4c2e : fffff880`09b1ea40 fffff880`09b1eb60 00000000`00000000 00000000`00000001 : nt!MmCreateSection+0x8bc
fffff880`09b1e9f0 fffff800`030c9e53 : fffffa80`120ae750 00000000`03f0e4e8 fffff880`09b1ea88 00000000`00000000 : nt!NtCreateSection+0x171
fffff880`09b1ea70 00000000`7794175a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`03f0e4c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7794175a


STACK_COMMAND:  kb

SYMBOL_NAME:  ANALYSIS_INCONCLUSIVE

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Unknown_Module

IMAGE_NAME:  Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP:  0

FAILURE_BUCKET_ID:  X64_CLOCK_WATCHDOG_TIMEOUT_8_PROC_ANALYSIS_INCONCLUSIVE

BUCKET_ID:  X64_CLOCK_WATCHDOG_TIMEOUT_8_PROC_ANALYSIS_INCONCLUSIVE

Followup: MachineOwner
---------

http://pcsupport.about.com/od/fixtheproblem/tp/clearcmos.htm

 

[Golden]

Thanks Arc...very detailed reply for Maesen to follow

 

[Arc]

Thanks Arc...very detailed reply for Maesen to follow

 

[Maesen]

Wow nicely written post. I'll try all pf that during the day and run a memtest overnight if the problem still occurs. I'll update the post by tomorrow.

Thank you both.

PS: I see in the quote that it says mbam (Malwarebytes) seems to cause the BSOD. Is it possible or do I misinterprete the log?

 

[Arc]

PS: I see in the quote that it says mbam (Malwarebytes) seems to cause the BSOD. Is it possible or do I misinterprete the log?

The "Process Name" field?

PROCESS_NAME:  mbamservice.exe

That is not the reason behind the BSOD, but the victim.

It might indicate to any malware. So for a safety reason, scan the system for possible virus infection with the following programs.

• Anti-rootkit utility TDSSKiller
• Windows Defender Offline

 

[Maesen]

Alright. Computer is not overclocked. I started by calculating the wattage and I am within the specs (needs 716w and have a 750w PSU).

I then downloaded Speccy and snapshot'd the temps (all were fine).

I decided to try updating the BIOS and Sata. Downloaded both but installed the Sata first. Rebooted. Computer stuck on Welcome screen for 15mins. Rebooted. Windows loads the desktop but no icon and mouse is "loading" for 10mins. Rebooted. Got to desktop only to crash with a BSOD a couple of seconds later. Rebooted again but only got a black screen after the Welcome screen.

Now I am in safe mode and will try clearing the startup menu.

 

[Maesen]

Alright. Computer is not overclocked. I started by calculating the wattage and I am within the specs (needs 716w and have a 750w PSU).

I then downloaded Speccy and snapshot'd the temps (all were fine).

I decided to try updating the BIOS and Sata. Downloaded both but installed the Sata first. Rebooted. Computer stuck on Welcome screen for 15mins. Rebooted. Windows loads the desktop but no icon and mouse is "loading" for 10mins. Rebooted. Got to desktop only to crash with a BSOD a couple of seconds later. Rebooted again but only got a black screen after the Welcome screen.

Now I am in safe mode and will try clearing the startup menu.

OK, managed to boot. Had a message in the corner. Took a picture in case it crashes again, here it is:

Failed to connect to a windows service.
Windows could not connect to the Group Policy Client service. This problem prevents standard users from logging on to the system. As an administrative user, you can review the System Event Log for details about why the service didn't respond.

Went to the Event Log, but I am not sure where to look so I can show you guys what happened (if it ever helps).

I will now download both security programs Arc told me to run.

 

[Arc]

If needed, you may click this button ....
View attachment 298477

And upload the result to us.

Let us know about your advancements.

 

[Maesen]

If needed, you may click this button ....
View attachment 298477

And upload the result to us.

Let us know about your advancements.

Here is the Event Log along with TDSSKiller report (in Notepad). I am currently downloading Windows Defender Offline and will boot on it as soon as I can. I have to leave the house for a couple of hours but will update this post when I come back.

I appreciate the help.

 

[Maesen]

Currently running a full scan with WDO and it says it found some malware. It is far from being done and I am going to sleep so I'll check the results tomorrow.

Do I have the possibility of cleaning the malwares with this program?

 

[Golden]

It depends on the malware......post the log file when its done, or note the malware it finds.

 

[Maesen]

Heres what it found.

Trojan:Win32/Orsam!rts
VirTool:Win32/Obfuscator.XZ
HackTool:Win32/KeyGen

 

[Maesen]

Is it safe to delete them? I am still on the Windows Defender Offline boot waiting instructions.

 

[Arc]

Those are obviously safe to delete, delete them.

 

[Maesen]

Those are obviously safe to delete, delete them.

Done. Back on the desktop now, still have the Failure to connect to Group Policy Client service though. Now I would like to update my BIOS as stated before, but I would like to know the correct way to do it. I downloaded it through the link given to me. Its a .CAP file.