BSOD after updating all security programs

[RaidenRaccoon]

This is for my game server PC, not my main PC.

It's running

• Windows 7 Home Premium 64 bit
• emsisoft antimalware (1 yr license)
• Malwarebytes Premium (lifetime)
• (at the time of crash) Starbound and Terraria servers
• x2 160GB HDDs (one for back up)
• x2 2GB DDR3 RAM
• x1 1GB GeForce GT 430
• 2.9GHz Intel Pentium G850
• Tyan S5517 Motherboard
• Apevia 430W PSU

The night before the crash: Malwarebytes had just udated it's GUI, emsisoft updated and I installed 2 updates for Windows Defender. Only emsisoft required a restart, so I did and loaded the 2 game servers back up.


I awoke to find a message on the desktop about a BSOD that occurred and that my resolution went from 720p to 800x600 (geforce experience wasn't running).


I immediately came here and downloaded the DM Log Collector and turned off the 'Reboot on error'. In the middle of DM doing it's thing, another BSOD- I assume one similar to the previous one.

After rebooting, my resolution returned to normal and the PC has been doing fine for several hours.

I have a feeling one of the updates might have been the cause- specifically emsisoft as the .sys file mentioned on the BSOD seems related to the software upon google searching.

I would love for someone who better understands dump files and such to give me their input though. I really want to know what caused the crashes.

 

[Boozad]

 1: Emsisoft

:ar: Emsisoft is indeed causing issues. It could be that it's conflicting with MBAM and I'd suggest uninstalling the software, MBAM should more than have you covered with malware protection.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff880041c1f08, fffff88002e50c70, 0}

Probably caused by : [COLOR=Red][B]epp64.sys[/B][/COLOR] ( epp64+12f08 )

Followup: MachineOwner

 2: nVidia Driver

:ar: Your nVidia driver has been flagged. Look for an updated version here and follow http://www.sevenforums.com/tutorials/327414-nvidia-drivers-avoid-problems.html for the cleanest possible install.

fffff800`04305620  fffff880`04b57239Unable to load image \SystemRoot\system32\DRIVERS\nvlddmkm.sys, Win32 error 0n2
[COLOR=Red][B]*** WARNING: Unable to verify timestamp for nvlddmkm.sys
*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys[/B][/COLOR]
 nvlddmkm+0x108239

0: kd> lmvm nvlddmkm
start             end                 module name
fffff880`04a4f000 fffff880`05461000   nvlddmkm T (no symbols)           
    Loaded symbol image file: nvlddmkm.sys
    Image path: \SystemRoot\system32\DRIVERS\nvlddmkm.sys
    Image name: nvlddmkm.sys
    Timestamp:        [COLOR=Red][B]Thu Feb 05 18:01:37 2015[/B][/COLOR] (54D3B001)
    CheckSum:         009D4DDE
    ImageSize:        00A12000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

 3: Intel 82579V Gigabit Network Connection Driver

:ar: Your Intel 82579V Gigabit Network Connection driver has been flagged. It's pretty old and probably needs updating. Check here for an updated version.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {19a840f02a8, 2, 8, 19a840f02a8}

[COLOR=Red][B]*** WARNING: Unable to verify timestamp for e1c62x64.sys
*** ERROR: Module load completed but symbols could not be loaded for e1c62x64.sys[/B][/COLOR]
Probably caused by : e1c62x64.sys ( e1c62x64+27c85 )

Followup: MachineOwner

0: kd> lmvm e1c62x64
start             end                 module name
fffff880`044fc000 fffff880`04578000   e1c62x64 T (no symbols)           
    Loaded symbol image file: e1c62x64.sys
    Image path: \SystemRoot\system32\DRIVERS\e1c62x64.sys
    Image name: e1c62x64.sys
    Timestamp:        [COLOR=Red][B]Thu Feb 21 05:14:02 2013[/B][/COLOR] (5125AD1A)
    CheckSum:         0008277C
    ImageSize:        0007C000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e

 

[RaidenRaccoon]

Ah. Thank you so much! I shall update those and uninstall emsisoft.

 

[Boozad]

Let us know how you get on.

 

[RaidenRaccoon]

Bsod - memory_management

This is for my game server PC, not my main PC.

It's running

• Windows 7 Home Premium 64 bit
• emsisoft antimalware (1 yr license) [PRIOR TO CRASH- UNINSTALLED AFTERWARDS]
• Malwarebytes Premium (lifetime)
• (at the time of crash) Starbound and Terraria servers
• x2 160GB HDDs (one for back up)
• x2 2GB DDR3 RAM
• 2.9GHz Intel Pentium G850
• Tyan S5517 Motherboard
• Apevia 430W PSU

Hardware changes prior to crash:

• Removed DVD/CD Drive
• Removed video card (GeForce GT 430)

Thermal probes at the time of crash showed 19C for the CPU and 24C for the hard drives.



PC has crashed before, but from different errors


This particular crash messed up Windows a bit after rebooting normally. Nothing would load on the taskbar except the start button, windows explorer (folders) would crash before it even started up a folder, etc


I restarted into safe mode, backed up my server files and rebooted, everything started normally. Uninstalled Emsisoft, updated Windows Defender and Ethernet driver.



No player has logged into the servers for days and the 2 that are currently running (I have 3, but only run 2 at a time until I upgrade the RAM) which are the same ones that were up prior to the crash have the memory idling at 50-60%.


It is possible either Emsisoft or Malwarebytes was running a scheduled scan at the time of the crash. I usually schedule scans weekly to monthly at 3 to 5 AM on all my machines.

 

[Boozad]

Memory Diagnostics

 Run MemTest86+

Download and run MemTest86+ to test your RAM. http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

   Note

View attachment 354081

Run MemTest86+ for at least 8 passes. Ideally set it off before you go to bed and leave it overnight, we're looking for zero errors here. A single error will show something's going bad with your RAM.

 

[RaidenRaccoon]

Currently on Pass 9, no errors yet. Should I let it continue?

 

[Boozad]

I think that should be fine after nine passes.

 

[RaidenRaccoon]

Back again, same computer, another BSOD earlier today.

The BSOD didn't give much information so I have no idea what it was this time. Again, same 2 game servers were running.

Starting to suspect the motherboard as the hard drives show up as 'good' in CrystalDisk, Error Check doesn't seem to find anything, the OS was installed earlier this month and the RAM made it through 9 passes of MemTest86+. Plus the 2 game servers only seem to put the RAM usage at 75% max.

Going to leave them off until the next crash, if there will be one, to rule them out.

 

[RaidenRaccoon]

And another BSOD.

Just like the one before, not much information as well as the top part being cut off (error seemed large and the top and right were cut off on my monitor)

Only things running in the system tray were Malwarebytes, Hamachi, Team Viewer and Intel Rapid Storage Technology.

No game servers running this time.

 

[Boozad]

Bear with me, I'm at work at the moment. I'll take a look at these when I get home later.

 

[RaidenRaccoon]

Thanks for letting me know- also thanks for all the help you've provided thus far! Highly appreciated!

Currently the PC is off until I can get more info out of these last 2 crashes. My main suspects are the power supply or the motherboard at this point. I do have a known working PSU I can replace the current one with for troubleshooting thankfully...

 

[Boozad]

Only things running in the system tray were Malwarebytes, Hamachi, Team Viewer and Intel Rapid Storage Technology.

Are you running a RAID setup?

Also can you disable/uninstall Hamachi for testing purposes.

DRIVER_OVERRAN_STACK_BUFFER (f7)
A driver has overrun a stack-based buffer.

STACK_TEXT:  
fffff800`042f9888 fffff880`04517a9e : 00000000`000000f7 ff0202fa`ff0202f7 0000f880`0451b23c ffff077f`fbae4dc3 : nt!KeBugCheckEx
fffff800`042f9890 fffff880`044f1aa5 : 00000000`00000032 fffffa80`06a5ee34 00000000`00000032 fffffa80`072b6c02 : [COLOR=Red][B]netbt!_report_gsfailure+0x26[/B][/COLOR]
fffff800`042f98d0 fffff880`0408b325 : fffffa80`0729ea20 00000000`00000002 fffff800`042f9bd8 fffffa80`0729ea20 : netbt!TdiRcvNameSrvHandler+0x374
fffff800`042f9970 fffff880`01a84825 : fffffa80`072b6b80 00000000`00000000 fffffa80`072b6b80 fffff800`042f9bd0 : tdx!TdxEventReceiveMessagesTransportAddress+0x315
fffff800`042f9b60 fffff880`01a7f152 : 00000000`00000000 fffffa80`072b6b80 fffffa80`00000000 fffff800`042f9da0 : tcpip!UdpDeliverDatagrams+0x155
fffff800`042f9cf0 fffff880`01a5af97 : fffffa80`045eaab0 00000000`00000000 5e143a00`89008900 00000000`00000000 : tcpip!UdpReceiveDatagrams+0x132
fffff800`042f9d90 fffff880`01a5aaaa : 00000000`00000000 fffff880`01b6d9a0 fffff800`042f9f50 fffffa80`348dcd3e : tcpip!IppDeliverListToProtocol+0xf7
fffff800`042f9e50 fffff880`01a5a0a9 : fffff880`01b6d9a0 fffffa80`06aa0160 00000000`00000011 fffff800`042f9f40 : tcpip!IppProcessDeliverList+0x5a
fffff800`042f9ef0 fffff880`01a57d4f : 00000000`ff01a8c0 fffff880`01b6d9a0 fffff880`01b6d9a0 00000000`00000000 : tcpip!IppReceiveHeaderBatch+0x23a
fffff800`042f9fd0 fffff880`01a57322 : fffffa80`06acbc70 00000000`00000000 fffffa80`06ad9001 00000000`00000001 : tcpip!IpFlcReceivePackets+0x64f
fffff800`042fa1d0 fffff880`01a5674a : fffffa80`06ad9010 fffff800`042fa300 fffffa80`06ad9010 fffff800`02d20000 : tcpip!FlpReceiveNonPreValidatedNetBufferListChain+0x2b2
fffff800`042fa2b0 fffff800`02c927b8 : fffffa80`06aa0030 00000000`00004800 fffff800`02e10cc0 00000000`00000000 : tcpip!FlReceiveNetBufferListChainCalloutRoutine+0xda
fffff800`042fa300 fffff880`01a56e42 : fffff880`01a56670 fffff800`02e02e80 fffff800`02e29c02 fffff800`02c89e00 : nt!KeExpandKernelStackAndCalloutEx+0xd8
fffff800`042fa3e0 fffff880`019420eb : fffffa80`06ad88d0 00000000`00000000 fffffa80`067d71a0 fffff800`02c213db : tcpip!FlReceiveNetBufferListChain+0xb2
fffff800`042fa450 fffff880`0190bad6 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ndis!ndisMIndicateNetBufferListsToOpen+0xdb
fffff800`042fa4c0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ndis!ndisMDispatchReceiveNetBufferLists+0x1d6

 

[RaidenRaccoon]

Well, I had attempted a RAID 1 setup. Both hardware and software via the Intel RST (was a driver/program for the motherboard). Both the hardware and software never gave me the option for RAID 1 amongst my 2 drives (only difference between them is one is Western Digital and the other is not- supposing that's why)

As for Hamachi, I will disable it and see if the computer crashes again. (though I have it on all my computers, same OS- never caused problems)

 

[Boozad]

If you didn't successfully set up a RAID configuration then uninstall Intel Rapid Storage.

 

[RaidenRaccoon]

Uninstalled Intel RST and disabled Hamachi and it's services from start up/running. Rebooted and letting the PC idle to see if another BSOD occurs. (Only Team Viewer and Malwarebytes are running in the system tray)

If it crashes again, I can assume neither of those were the issue and I will replace the power supply with my known good one (current PSU came with the case (Apevia case, Apevia PSU) and I bought the PC used- both might be factors in the crashes)

If the crashes still occur then, I'll fully suspect the motherboard

 

[Boozad]

I don't believe this is a hardware fault.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck F7, {ff0202faff0202f7, f8800451b23c, ffff077ffbae4dc3, 0}

Probably caused by : netbt.sys ( netbt!_report_gsfailure+26 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_OVERRAN_STACK_BUFFER (f7)
A driver has overrun a stack-based buffer.  This overrun could potentially
allow a malicious user to gain control of this machine.
DESCRIPTION
A driver overran a stack-based buffer (or local variable) in a way that would
have overwritten the function's return address and jumped back to an arbitrary
address when the function returned.  This is the classic "buffer overrun"
hacking attack and the system has been brought down to prevent a malicious user
from gaining complete control of it.
Do a kb to get a stack backtrace -- the last routine on the stack before the
buffer overrun handlers and bugcheck call is the one that overran its local
variable(s).
Arguments:
Arg1: ff0202faff0202f7, Actual security check cookie from the stack
Arg2: 0000f8800451b23c, Expected security check cookie
Arg3: ffff077ffbae4dc3, Complement of the expected security check cookie
Arg4: 0000000000000000, zero

Debugging Details:
------------------


DEFAULT_BUCKET_ID:  GS_FALSE_POSITIVE_MISSING_GSFRAME

SECURITY_COOKIE:  Expected 0000f8800451b23c found ff0202faff0202f7

CUSTOMER_CRASH_COUNT:  1

BUGCHECK_STR:  0xF7

PROCESS_NAME:  System

CURRENT_IRQL:  2

ANALYSIS_VERSION: 6.3.9600.17029 (debuggers(dbg).140219-1702) amd64fre

DPC_STACK_BASE:  FFFFF80004300FB0

LAST_CONTROL_TRANSFER:  from fffff88004517a9e to fffff80002c85ec0

0: kd> lmvm netbt
start             end                 module name
fffff880`044ed000 fffff880`04532000   netbt      (pdb symbols)          c:\symbols\netbt.pdb\3D581F5A08614A7CB02D71638469228D2\netbt.pdb
    Loaded symbol image file: netbt.sys
    Mapped memory image file: c:\symbols\netbt.sys\4CE7938645000\netbt.sys
    Image path: \SystemRoot\System32\DRIVERS\netbt.sys
    Image name: netbt.sys
    Timestamp:        Sat Nov 20 09:23:18 2010 (4CE79386)
    CheckSum:         00041134
    ImageSize:        00045000
    File version:     6.1.7601.17514
    Product version:  6.1.7601.17514
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        3.7 Driver
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     netbt.sys
    OriginalFilename: netbt.sys
    ProductVersion:   6.1.7601.17514
    FileVersion:      6.1.7601.17514 (win7sp1_rtm.101119-1850)
    FileDescription:  MBT Transport driver
    LegalCopyright:   © Microsoft Corporation. All rights reserved.

 

[RaidenRaccoon]

Could it be possible that, being a server motherboard with 2 RJ45 ports, Windows Home Premium is having issues with that? I have an available 7 Professional COA I could use if necessary (I have installation media as well).

That's the only thing I can think of that is different from my other computers. None of them have a server MB with 2 LAN ports and are all running the same software this one is (except emsisoft- but they also run far more than this server PC in return)

 

[Boozad]

It's not the Windows version that is the problem, don't go using up a license that you don't need to. There's a driver in violation but there's no info as to what it is.

Diagnostic Test

 DRIVER VERIFIER

Driver Verifier will stress your drivers and cause BSODs if any fail. Follow this tutorial to enable/disable it. http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

Enable Driver Verifier but only enable these options:

• Standard settings and IRP logging step 3.
• Don't enable Force Pending I/O Requests

   Warning

Make a System Restore point before enabling Driver Verifier.

   Note

Your system will act very sluggishly while DV is enabled, this is normal as your drivers will be being subjected to heavy testing in order to make them crash.

Post any resulting dump files.

 

[RaidenRaccoon]

Ran the verifier (select all but Microsoft drivers as per the tutorial instructed) and only marked the options you suggested.

The system did fine for 12 hours, but when I checked this afternoon (about and hour after the 24 hour mark) I was met with a BSOD.

EDIT: After posting this reply, I installed about 50 optional updates for 7 (2 were 'kernel' based), re initiated Hamachi and it's services and disabled verifier and then rebooted. Checked back on the PC and yet another BSOD stating: PAGE_FAULT_IN_NONPAGED_AREA. The PC is off atm, but I will grab the .dmp file from this crash in a bit.