Blue screen :( please help (log attached)

[John12]

Blue screen of death logged is attached to the thread. To whoever that can help me fix myself I'd gladly pay a small fee of $10 through PayPal. This computer was a gift to me so I really don't want it to break so soon.

2 extra notes

- My windows is using the latest updates so there are no new updates to download.
- I have no viruses I scan my computer almost every 2 days.

Thank you for your help guys!

 

[Golden]

John, no payment is necessary - all advice is free of charge.

Please re-run DM Log Collector again, waiting for it to finish completely before uploading the new ZIP file that it creates on your desktop - the current ZIP file is incomplete of all the files need to analyse the BSOD and provide a solution.

1. Download the DM Log Collector application to your desktop by clicking the link below

DM Log Collector.exe

2. Run it by double-clicking the icon on your desktop, and follow the prompts.
3. Locate the .ZIP file that is created on your desktop, and upload it here in your next reply.

 

[Golden]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {20, fffffa800a9676a0, fffffa800a9676c0, 4020015}

*** WARNING: Unable to verify timestamp for mwac.sys
*** ERROR: Module load completed but symbols could not be loaded for mwac.sys
Probably caused by : fwpkclnt.sys ( fwpkclnt!FwpsConstructIpHeaderForTransportPacket0+20a )

Followup: MachineOwner
---------

1: kd> !thread
GetPointerFromAddress: unable to read from fffff80003511000
THREAD fffffa800ba07200  Cid 0b74.9418  Teb: 000000007ef5c000 Win32Thread: 0000000000000000 RUNNING on processor 1
IRP List:
    Unable to read nt!_IRP @ fffffa8008955340
Not impersonating
GetUlongFromAddress: unable to read from fffff80003450ba8
Owning Process            fffffa8008383610       Image:        [B][COLOR="Red"] mbamservice.ex[/COLOR][/B]
Attached Process          N/A            Image:         N/A
fffff78000000000: Unable to get shared data
Wait Start TickCount      9803393      
Context Switch Count      3092           IdealProcessor: 1             
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime                  00:00:00.000
KernelTime                00:00:00.000
Win32 Start Address 0x0000000000343d70
Stack Init fffff8800618fc70 Current fffff8800618ee80
Base fffff88006190000 Limit fffff8800618a000 Call 0
Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffff880`0618f1e8 fffff800`0340ccae : 00000000`00000019 00000000`00000020 fffffa80`0a9676a0 fffffa80`0a9676c0 : nt!KeBugCheckEx
fffff880`0618f1f0 fffff880`01727d2d : 00000000`00000008 00000000`0000000c 00000000`676e7049 fffffa80`0952a11c : nt!ExDeferredFreePool+0x12da
fffff880`0618f2a0 fffff880`0140a066 : 00000000`00000000 fffff880`014060c3 00000000`00000000 fffffa80`0782ec70 : [B][COLOR="red"]tcpip[/COLOR][/B]!IppInspectBuildHeaders+0x65d
fffff880`0618f580 fffff880`077e212d : 00000000`00000008 00000000`00000014 00000000`00000000 fffffa80`0b49f7e0 : fwpkclnt!FwpsConstructIpHeaderForTransportPacket0+0x20a
fffff880`0618f620 00000000`00000008 : 00000000`00000014 00000000`00000000 fffffa80`0b49f7e0 fffffa80`0b49f7f4 : mwac+0x612d
fffff880`0618f628 00000000`00000014 : 00000000`00000000 fffffa80`0b49f7e0 fffffa80`0b49f7f4 fffffa80`00000011 : 0x8
fffff880`0618f630 00000000`00000000 : fffffa80`0b49f7e0 fffffa80`0b49f7f4 fffffa80`00000011 00000000`00000000 : 0x14

John, at first glance the Malwarebytes service seems to be the issue, but thats a red-herring. I think the problem lies with your ethernet/wifi adapter driver.

Please do the following:
1. Run Windows Update, make a note of all updates including Oprional Updates, that are offered and install then all.
2. In the Start Search bar, type MSINFO and double click the entry that appears.

Once MSINFO open, click File > Save As, and name it John.nfo, then upload that .nfo file here please.

 

[John12]

I ran it again and wait till the prompt says the analysis is dump and ready to be uploaded to the forum. Attached to this post.

 

[Golden]

Thats better - thanks John. Ignore the request for MSINFO - its in your new ZIP file, but please double check Windows Update.

 

[John12]

I did the MSINFO but it's a .txt file with all the information. It's attached to this post.

 

[Golden]

You can ignore the MSINFO request John. Can you confirm there are no Windows Updates (incl. Optional Updates) available?

 

[John12]

I see 5 optional updates and I'm going to download them now.

 

[Golden]

Please list them here too, so I can cross check with what I'm seeing in the .dmp files.

 

[John12]

Here is a screenshot of all 5 updates:
http://i.imgur.com/jX5SgUX.png

 

[Golden]

OK. After installation of those, reboot and do the following please:

Please do the following:

Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.
http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

Driver Verifier will cause your computer to run very sluggishly - this is normal. What it is trying to do is force your system to BSOD and isolate the offending driver/s. When it does, reboot, disable driver verifier, reboot as normal and upload the new dmp file/s here.

I recommend creating a system restore point before turning on driver verifier:
http://www.sevenforums.com/tutorials/697-system-restore-point-create.html

If your system fails to boot to desktop once driver verifier is enabled, turn it off by booting into Safe Mode:
http://www.sevenforums.com/tutorials/69585-safe-mode.html

 

[John12]

Okay got it so I run this Driver Verifier now and when the next blue screen happens I can get the log and post it here?

 

[Golden]

Correct

 

[John12]

I enabled driver verifier for all non-microsoft drivers and restarted pc for it to take effect. As soon as windows start (i can't even get to login screen) it blue screens. I restarted my computer again thinking it was just a one time thing but it blue screen again before it got to login screen. I went to safe mode to disable driver verifier and I can log in fine again so its definitely related to a driver. Where can I find the dump for the result of the BSOD? I can't seem to find it.

 

[Golden]

Just re-run DM Log Collector again, and upload the new ZIP file it creates. It automatically gathers the BSOD .dmp files.

 

[John12]

New BSOD log is attached to this post.

 

[Golden]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffff80000003, fffff8000326fcf8, 2, 0}

*** WARNING: Unable to verify timestamp for avgmfx64.sys
*** ERROR: Module load completed but symbols could not be loaded for avgmfx64.sys
Probably caused by : [COLOR="Red"][B]avgmfx64.sys[/B][/COLOR] ( avgmfx64+3902 )

Followup: MachineOwner
---------

AVG seems to be the issue here. Uninstall it using this tool, reboot, then install MSE and monitor for further BSOD's.

 

[John12]

Hey Golden I uninstalled AVG, rebooted, and tried to install MSE. But every time I try to run the installer for MSE I get "corrupt file" error. I tried running both 32 bit and 64 bit and running them as admin no luck. So I resorted to installing Avast free anti virus. Re-enabled the driver verifier, restarted and this time I don't get blue screen when I get to login page. Going to leave it the verifier on for the next 24 hours to see if it comes up again. But just wondering do you have any idea to fix this file is corrupt error for the MSE installer? AVAST is really slow and I know MSE runs much better.

 

[Golden]

Try to download it again.

 

[John12]

I tried it again just now i've redownloaded it like 10 times but heres a screenshot of error
http://i.imgur.com/LQbAQSG.png