Random freezes and/or BSOD with general use

[cwburns32]

Ok, so if it has to do with system files, then I guess repair install is the best thing to do but before that, have you done malware scans recently? If yes, then do a Custom Scan with Malwarebytes and select all the drives. If it finds anything, quarantine it and post the log it makes. After that, do this.

http://www.sevenforums.com/tutorials/3413-repair-install.html

Oddly enough Malwarebytes won't install on my laptop. I have attached 2 screen captures of the errors I get while installing. After installation is complete and I go to launch the program it immediately crashes.

There is NO obvious need for a repair install - or worse, a clean install.

The SFC scan showed the following problem...

2014-07-21 11:37:53, Info                  CSI    00000304 [SR] Repairing 1 components
2014-07-21 11:37:53, Info                  CSI    00000305 [SR] Beginning Verify and Repair transaction
2014-07-21 11:37:53, Info                  CSI    00000306 Manifest hash for component [ml:280{140},l:184{92}]"amd64_a69ab2e06a57e0c36f0741338d888e44_31bf3856ad364e35_7.1.7601.18351_none_168d02fc611e1de8" does not match expected value. 
 Expected:{l:32 b:8571f9bcf4e096687cf1401f625f0e93afa381a54da316375ed2fad5290781ae}
 Found:{l:32 b:1c56c84448dec77bece6d3d7b129c32479b966d5d0d2187e52f63778750cda4e}.
2014-07-21 11:37:53, Info                  CSI    00000307 Unable to load manifest for component [ml:280{140},l:184{92}]"amd64_a69ab2e06a57e0c36f0741338d888e44_31bf3856ad364e35_7.1.7601.18351_none_168d02fc611e1de8"
2014-07-21 11:37:53, Info                  CSI    00000308 [SR] Cannot verify component files for a69ab2e06a57e0c36f0741338d888e44, Version = 7.1.7601.18351, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral, manifest is damaged (TRUE)
2014-07-21 11:37:53, Info                  CSI    00000309 Repair results created:
POQ 129 starts:
 
POQ 129 ends.
2014-07-21 11:37:53, Info                  CSI    0000030a [SR] Repair complete
2014-07-21 11:37:53, Info                  CSI    0000030b [SR] Committing transaction

This may be the tip of the iceberg -


Please download and save the CheckSUR tool from http://support.microsoft.com/kb/947821
(you'll need to look in the details for Windows 7, downloading from the Microsoft Download Center)

Run it - The tool can take anywhere from 5 mins to a couple of hours to run (or 'Install') depending on how much it has to do, and may exit silently - it may appear to freeze for most of that time, but be patient.
The result is logged in the C:\Windows\Logs\CBS\CheckSUR.log file - and an archive …\checksur.persist.log file

Then zip the CheckSUR.log and upload it to your reply.

I don't mind doing a repair/clean install but if you suggest it is soemthing else I will do this and report back shortly.

 

[aritra2116]

I think you should do what Noel has suggested you to do. He is more experienced in that field. And about your Malwarebytes problem, did the installer download correctly? Have you tried installing in Safe Mode? Your other problems might be conflicting with the MBAM installation. Best to run CheckSUR first.

 

[NoelDP]

From what I can make out the MBAM exception error is usually caused by a partial install which is getting in the way of a fresh install of MBAM.
Run the removal tool- TWICE, with a reboot in between - then reboot and try the install again.

Download MalwareBytes Removal Tool

 

[cwburns32]

I think you should do what Noel has suggested you to do. He is more experienced in that field. And about your Malwarebytes problem, did the installer download correctly? Have you tried installing in Safe Mode? Your other problems might be conflicting with the MBAM installation. Best to run CheckSUR first.

From what I can make out the MBAM exception error is usually caused by a partial install which is getting in the way of a fresh install of MBAM.
Run the removal tool- TWICE, with a reboot in between - then reboot and try the install again.

Download MalwareBytes Removal Tool

Thanks guys. Will report back with a MBAM scan log and a CheckSUR log very shortly here.

EDIT: Malwarebytes now installs with no issues after using removal tool twice with a reboot in between and then a reboot again before installation. It now opens but as soon as you go to update it or scan it crashes. Even attempted to redownload the file and install again after doing removal process to no avail. Running CheckSUR tool right now - will repot back with log shortly.

 

[cwburns32]

There is NO obvious need for a repair install - or worse, a clean install.

The SFC scan showed the following problem...

2014-07-21 11:37:53, Info                  CSI    00000304 [SR] Repairing 1 components
2014-07-21 11:37:53, Info                  CSI    00000305 [SR] Beginning Verify and Repair transaction
2014-07-21 11:37:53, Info                  CSI    00000306 Manifest hash for component [ml:280{140},l:184{92}]"amd64_a69ab2e06a57e0c36f0741338d888e44_31bf3856ad364e35_7.1.7601.18351_none_168d02fc611e1de8" does not match expected value. 
 Expected:{l:32 b:8571f9bcf4e096687cf1401f625f0e93afa381a54da316375ed2fad5290781ae}
 Found:{l:32 b:1c56c84448dec77bece6d3d7b129c32479b966d5d0d2187e52f63778750cda4e}.
2014-07-21 11:37:53, Info                  CSI    00000307 Unable to load manifest for component [ml:280{140},l:184{92}]"amd64_a69ab2e06a57e0c36f0741338d888e44_31bf3856ad364e35_7.1.7601.18351_none_168d02fc611e1de8"
2014-07-21 11:37:53, Info                  CSI    00000308 [SR] Cannot verify component files for a69ab2e06a57e0c36f0741338d888e44, Version = 7.1.7601.18351, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral, manifest is damaged (TRUE)
2014-07-21 11:37:53, Info                  CSI    00000309 Repair results created:
POQ 129 starts:
 
POQ 129 ends.
2014-07-21 11:37:53, Info                  CSI    0000030a [SR] Repair complete
2014-07-21 11:37:53, Info                  CSI    0000030b [SR] Committing transaction

This may be the tip of the iceberg -


Please download and save the CheckSUR tool from http://support.microsoft.com/kb/947821
(you'll need to look in the details for Windows 7, downloading from the Microsoft Download Center)

Run it - The tool can take anywhere from 5 mins to a couple of hours to run (or 'Install') depending on how much it has to do, and may exit silently - it may appear to freeze for most of that time, but be patient.
The result is logged in the C:\Windows\Logs\CBS\CheckSUR.log file - and an archive …\checksur.persist.log file

Then zip the CheckSUR.log and upload it to your reply.

Here is CheckSUR.log file

 

[NoelDP]

Great - CheckSUR fixed a few problems - all that it could find, anyhow.
Now run the SFC /SCANNOW again, and post the now CBS.log file (copy it to the desktop, then compress it before uploading it to your reply) - the sfcdetails file you posted earlier doesn't contain any of the background detail we may need.

 

[cwburns32]

Great - CheckSUR fixed a few problems - all that it could find, anyhow.
Now run the SFC /SCANNOW again, and post the now CBS.log file (copy it to the desktop, then compress it before uploading it to your reply) - the sfcdetails file you posted earlier doesn't contain any of the background detail we may need.

SFC /SCANNOW reported that nothing is wrong. Attached is the compressed CBS.log file.

EDIT: Malwarebytes still crashes upon opening.

 

[NoelDP]

The CBS.log looks fine to me.

If we're lucky, then that's fixed the underlying problem, and the BSOD guys can take over and sort the rest

Back to you, guys

 

[cwburns32]

The CBS.log looks fine to me.

If we're lucky, then that's fixed the underlying problem, and the BSOD guys can take over and sort the rest

Back to you, guys

Thanks a ton!! Everything seems to be working just fine for right now. No random freezes or lockups and haven't encountered any BSODs. Am going to run DV for another 24 hours straight to do some more testing. Will check back shortly.

 

[NoelDP]

You may want to uninstall and reinstall MBAM - and run scans while in Safe Mode, as they can find things that scans in normal mode may miss.

 

[cwburns32]

You may want to uninstall and reinstall MBAM - and run scans while in Safe Mode, as they can find things that scans in normal mode may miss.

I always run the scans in Safe Mode.... that's the SFC scans. As for the Malwarebytes removal tool I have not used that in Safe Mode which is what it recommends. I will try that and then reinstall MBAM and check back.

EDIT: Ran the removal tool in Safe mode per the suggestion twice with a reboot in between and Malwarebytes still crashes 5-10 seconds after it opens. I have redownloaded the setup file multiple times to see if it was just a bad download to no avail.

 

[NoelDP]

I'm very surprised by that screenshot - as far as I know, MBAM doesn't rely on the claimed Module (MSVCR100.dll) - which if I remember right belongs to the Visual C++ 2010 runtime.
Since MBAM is designed to run on Windows XP and up, I'd be surprised if it did.

This sounds like it may be a deeply-embedded malware.
Try running MBAM's Chameleon options while in Safe Mode - see if they will run without triggering the error

 

[cwburns32]

I'm very surprised by that screenshot - as far as I know, MBAM doesn't rely on the claimed Module (MSVCR100.dll) - which if I remember right belongs to the Visual C++ 2010 runtime.
Since MBAM is designed to run on Windows XP and up, I'd be surprised if it did.

This sounds like it may be a deeply-embedded malware.
Try running MBAM's Chameleon options while in Safe Mode - see if they will run without triggering the error

I booted into Safe mode with networking to run the MBAM Chameleon options and got myself my first BSOD in almost 48 hours. Will attempt to reboot into Safe mode again to run the MBAM Chameleon options. Attached is DM log collector file from last BSOD.

EDIT: Ran all 13 Chameleon tools tests and none of them resolved the issue because MBAM would crash during the update database process. I asked over at the MBAM forum as well as the BSOD is my main priority here.

EDIT 2: Oddly enough I did a little more digging and found that the net.conf file sometimes gets corrupted. Pulled a working net.conf file from my main PC and replaced it with the bad one on my laptop and voila MBAM updating right away and is scanning now. Thanks again for the help though!! Now just for the BSOD!

 

[Boozad]

Your Synaptic Touch Pad driver is the main problem.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {0, 0, 0, 0}

*** WARNING: Unable to verify timestamp for SynTP.sys
*** ERROR: Module load completed but symbols could not be loaded for SynTP.sys

It's old and needs updating. Check here for an updated version.

1: kd> lmvm SynTP
start             end                 module name
fffff880`042d5000 fffff880`04344000   SynTP    T (no symbols)           
    Loaded symbol image file: SynTP.sys
    Image path: SynTP.sys
    Image name: SynTP.sys
    Timestamp:        [B][COLOR=Red]Fri Mar 16 02:03:32 2012[/COLOR][/B] (4F629F74)
    CheckSum:         00075EC0
    ImageSize:        0006F000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Also your Intel Wireless WiFi Link adapter has been flagged.

fffff880`0201aa48  fffff880`036a3571Unable to load image NETwsw00.sys, Win32 error 0n2
[B][COLOR=Red]*** WARNING: Unable to verify timestamp for NETwsw00.sys
*** ERROR: Module load completed but symbols could not be loaded for NETwsw00.sys[/COLOR][/B]
 NETwsw00+0x4b571

Check here for an updated version.

1: kd> lmvm NETwsw00
start             end                 module name
fffff880`03658000 fffff880`041a7000   NETwsw00 T (no symbols)           
    Loaded symbol image file: NETwsw00.sys
    Image path: NETwsw00.sys
    Image name: NETwsw00.sys
    Timestamp:        [B][COLOR=Red]Sun Jan 26 14:52:40 2014[/COLOR][/B] (52E52138)
    CheckSum:         00B01723
    ImageSize:        00B4F000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

 

[cwburns32]

Your Synaptic Touch Pad driver is the main problem.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {0, 0, 0, 0}

*** WARNING: Unable to verify timestamp for SynTP.sys
*** ERROR: Module load completed but symbols could not be loaded for SynTP.sys

It's old and needs updating. Check here for an updated version.

1: kd> lmvm SynTP
start             end                 module name
fffff880`042d5000 fffff880`04344000   SynTP    T (no symbols)           
    Loaded symbol image file: SynTP.sys
    Image path: SynTP.sys
    Image name: SynTP.sys
    Timestamp:        [B][COLOR=Red]Fri Mar 16 02:03:32 2012[/COLOR][/B] (4F629F74)
    CheckSum:         00075EC0
    ImageSize:        0006F000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Also your Intel Wireless WiFi Link adapter has been flagged.

fffff880`0201aa48  fffff880`036a3571Unable to load image NETwsw00.sys, Win32 error 0n2
[B][COLOR=Red]*** WARNING: Unable to verify timestamp for NETwsw00.sys
*** ERROR: Module load completed but symbols could not be loaded for NETwsw00.sys[/COLOR][/B]
 NETwsw00+0x4b571

Check here for an updated version.

1: kd> lmvm NETwsw00
start             end                 module name
fffff880`03658000 fffff880`041a7000   NETwsw00 T (no symbols)           
    Loaded symbol image file: NETwsw00.sys
    Image path: NETwsw00.sys 
    Image name: NETwsw00.sys
    Timestamp:        [B][COLOR=Red]Sun Jan 26 14:52:40 2014[/COLOR][/B] (52E52138)
    CheckSum:         00B01723
    ImageSize:        00B4F000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Updated both the Synaptic and WiFi Link Adapter drivers and have been running DV since they were installed about 10 hours ago with no lock ups or BSODs. Will check back later today after.

 

[Boozad]

Sounds good, keep us posted.

 

[cwburns32]

Sounds good, keep us posted.

Just had a random lock up... no BSOD, no crash report upon reboot, etc. Had to hard reboot. Sadly I do not believe any dumps were created but I am still providing DM log collector zip.

EDIT: Now 3 random lock ups that require hard boot to recover from in last 2 hours. Don't know what is going on all of a sudden but I am beginning to wonder if a fresh install is becoming more and more imminent.

 

[cwburns32]

UPDATE: Almost 72 hours of DV running. 6 random lock ups/freezes and 1 BSOD whose log I posted in post #33 abaove.