BSOD Bug Check Code: 0x100000b8

[Omais]

Hello everyone,
I wan't help to resolve BSOD issue for Bug Check Code: 0x100000b8. I don't know much about BSOD. Well here is what BlueScreenView says:

Dump FIle: 112414-17425-01.dmp
Crash Time: 11/24/2014 4:47:09 PM
Bug Check String: ATTEMPTED_SWITCH_FROM_DPC
Bug Check code: 0x100000b8
Parameter 1: 0x8fdef030
Parameter 2: 0x8a0f8030
Parameter 3: 0x98cb7fd0
Parameter 4: 0x00000000
Caused By Driver: ntoskrnl.exe
Caused By Address: ntoskrnl.exe+76c26
File Description: NT Kernel & System
Product Name: Microsoft® Windows® Operating System
Commpany: Microsoft Corporation
File Version: 6.1.7601.18409 (win7sp1_gdr.140303-2144)
Processor: 32-bit
Crash Address: ntoskrnl.exe+76c26
Stack Address 1: ntoskrnl.exe+7cb9b
Stack Address 2: ntoskrnl.exe+7658f
Stack Address 3: ntoskrnl.exe+3517e
Computer Name:
Full Path: C:\Windows\Minidump\112414-17425-01.dmp
Processor Count: 2
Major Version: 15
Minor Version : 7601
Dump File Size: 131,072
Dump File Time: 11/24/2014 4:48:06 PM

If anyone has any information for this issue kindly reply. Thanks!

 

[Arc]

The zip you uploaded is of 22 bytes only, contains nothing.

You need to re-run the tool and upload the data again.

 

[Omais]

This is the new file

 

[Arc]

BugCheck 100000B8, {98059a58, 89a62398, 9bd5cfd0, 0}

*** WARNING: Unable to verify timestamp for PHQ3919.tmp
*** ERROR: Module load completed but symbols could not be loaded for PHQ3919.tmp
Unable to load image \SystemRoot\system32\DRIVERS\epfwwfp.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for epfwwfp.sys
*** ERROR: Module load completed but symbols could not be loaded for epfwwfp.sys
[COLOR=Red]Probably caused by : PHQ3919.tmp[/COLOR] ( PHQ3919+cd52 )

Followup: MachineOwner
---------

    Image name: PHQ3919.tmp
[COLOR=Red]    Timestamp:        Sun Feb 11 01:27:03 2007[/COLOR] (45CE238F)

Download and install CCleaner. Run the cleaner to clean up all the temps and junks.

I know that you have ESET installed. Forget it for now. Scan the system for possible virus infection with the following programs only.

• Anti-rootkit utility TDSSKiller
• Windows Defender Offline

Let us know the results, and let us know for any further BSOD.

 

[Omais]

Hi Arc, I have done all of the above mentioned steps and found no threads. However today I got BSOD two times. Here is the newly generated file by DM Log Collector.

 

[Arc]

The same thing is causing the issue.

BugCheck A, {12, 2, 0, 82a3e9db}

*** WARNING: Unable to verify timestamp for PHQC9D5.tmp
*** ERROR: Module load completed but symbols could not be loaded for PHQC9D5.tmp
[COLOR=Red]Probably caused by : PHQC9D5.tmp[/COLOR] ( PHQC9D5+cd52 )

Followup: MachineOwner
---------

And it is running from the same location, temp.

  [COLOR=Red]  Image path: \??\C:\Users\Omais\AppData\Local\Temp\PHQC9D5.tmp[/COLOR]
    Image name: PHQC9D5.tmp
    Timestamp:      [COLOR=Red]  Sun Feb 11 01:27:03 2007[/COLOR] (45CE238F)

Such an old file should not be there even after running ccleaner. Specially when it is not a virus.

Press the windows key and R at the same time. It will open the run box.
Type %temp% and hit enter.
Select all and delete all. It should go now.

If you still get the same BSOD, then you must have not taken proper care for virus scanning. At that situation it would be better for you to perform a clean reinstall.

 

[Omais]

I have cleaned my computer with the new version of ccleaner (v5.00.50500). I'll let you know if I have any other BSOD.

 

[Omais]

Got one more BSOD right now.

 

[Omais]

One more BSOD after about 1 and a half hour from my previous post.

 

[essenbe]

Omais, sorry for the delay, but arc has been out of touch recently. I will try to help until he is able to return.
It seems you are having the same problem still

Use !analyze -v to get detailed debugging information.
BugCheck 100000B8, {89157868, 898ac960, 969c4fd0, 0}
*** WARNING: Unable to verify timestamp for PHQD91F.tmp
*** ERROR: Module load completed but symbols could not be loaded for PHQD91F.tmp
Unable to load image \SystemRoot\system32\DRIVERS\epfwwfp.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for epfwwfp.sys
*** ERROR: Module load completed but symbols could not be loaded for epfwwfp.sys
Probably caused by : [COLOR=red]PHQD91F.tmp ([/COLOR] PHQD91F+cdc9 )

Please see Arc's post #6

 

[Omais]

Hi, thank you for replying essenbe. Here is the new file after the last BSOD.

 

[Arc]

The exact same issue is continuing here. Probably you could manage a clean install better.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000B8, {9df0f750, 8922b390, a0d33fd0, 0}

*** WARNING: Unable to verify timestamp for PHQF6CC.tmp
*** ERROR: Module load completed but symbols could not be loaded for PHQF6CC.tmp
Unable to load image \SystemRoot\system32\DRIVERS\epfwwfp.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for epfwwfp.sys
*** ERROR: Module load completed but symbols could not be loaded for epfwwfp.sys
[COLOR=Red]Probably caused by : PHQF6CC.tmp[/COLOR] ( PHQF6CC+cd52 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

ATTEMPTED_SWITCH_FROM_DPC (b8)
A wait operation, attach process, or yield was attempted from a DPC routine.
This is an illegal operation and the stack track will lead to the offending
code and original DPC routine.
Arguments:
Arg1: 9df0f750, Original thread which is the cause of the failure
Arg2: 8922b390, New thread
Arg3: a0d33fd0, Stack address of the original thread
Arg4: 00000000

Debugging Details:
------------------


FAULTING_THREAD:  9df0f750

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR:  0xB8

PROCESS_NAME:  ekrn.exe

CURRENT_IRQL:  2

ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre

DPC_STACK_BASE:  FFFFFFFF8078B000

LAST_CONTROL_TRANSFER:  from 82c92d3d to 82c8bc26

STACK_TEXT:  
8078a960 82c92d3d 9df0f750 00000000 82d3fd20 nt!KiSwapContext+0x26
8078a998 82c91b9b 9df0f810 9df0f750 863fb1a8 nt!KiSwapThread+0x266
8078a9c0 82c8b58f 9df0f750 9df0f810 0000008a nt!KiCommitThreadWait+0x1df
8078aa3c 82c4a17e 863fb1a8 0000001b 00000000 nt!KeWaitForSingleObject+0x393
8078aa94 82c95b35 863fb1a8 9df39f28 9b766f48 nt!ExpWaitForResource+0x16f
8078aae4 a023cd52 a023f014 00000001 9df39f28 nt!ExAcquireResourceExclusiveLite+0x1cf
WARNING: Stack unwind information not available. Following frames may be wrong.
8078ab00 82f466c3 9dfbaf08 9b766f48 9b766f48 PHQF6CC+0xcd52
8078ab24 82c4bbd5 00000000 9b0e2ce0 9dfbaf08 nt!IovCallDriver+0x258
8078ab38 8c238aef 8302b800 89245598 8078abe0 nt!IofCallDriver+0x1b
8078aba4 8c245f6e 000e2cc0 8078ad2c 8b2b27a8 afd!AfdBeginAbort+0x337
8078abe0 8bfb0c69 89245598 9b0e2cc0 00000c20 afd!AfdBReceiveEventHandler+0x621
8078acc0 852661a9 8b2b27a8 8078ad2c 8078ae20 tdx!TdxEventReceiveConnection+0x23f
8078ad50 8526271c 93758064 000070c1 8078ae20 tcpip!TcpIndicateData+0x203
8078ade4 85264603 892d9428 892d9520 8078ae20 tcpip!TcpDeliverDataToClient+0x2fa
8078ae38 852a9faa 892d9428 892d9520 871333e8 tcpip!TcpDeliverReceive+0x96
8078aea4 852a1c2e 892d9428 00000000 871333e8 tcpip!TcpInjectReceive+0x279
8078aec4 851879ff 00000006 892d9428 00000000 tcpip!InetInspectInjectReceive+0x20
8078aefc 85187bc8 892d9428 871333e8 9c9cff40 NETIO!StreamInjectReceiveToStack+0x58
8078af18 85187c56 9c9cec30 892d9428 9c9cff40 NETIO!StreamPermitDataHelper+0x4e
8078af48 82c8c675 9c9cff40 9c9cec30 892d9428 NETIO!StreamPermitRemoveDataDpc+0x61
8078afa4 82c8c4d8 82d3fd20 9df0f750 00000000 nt!KiExecuteAllDpcs+0xf9
8078aff4 82c8bc9c a0d338fc 00000000 00000000 nt!KiRetireDpcList+0xd5
a0d33918 8302db29 00000002 00000000 9c9c0022 nt!KiDispatchInterrupt+0x2c
a0d33930 8302dba9 82d3fd20 00000000 a0d33970 hal!HalpCheckForSoftwareInterrupt+0x83
a0d33940 82c92013 a0d33a58 9c9cff40 00000000 hal!KfLowerIrql+0x61
a0d33970 8518ca99 9c9cff40 892d9428 00000000 nt!KeInsertQueueDpc+0x235
a0d33984 85187dfd 9c9cff40 85187bf5 9c9cff40 NETIO!StreamQueueDpc+0x23
a0d339bc 85189b54 9c9cff40 892d9428 00000001 NETIO!StreamPermitData+0xe4
a0d33a3c 8518b33b 000049cf 00000014 89384508 NETIO!StreamInternalClassify+0xfd
a0d33a98 85186c85 00000014 9df151f8 871333e8 NETIO!StreamInject+0x13f
a0d33adc 8535cc71 00000428 00000000 0000011c NETIO!FwppStreamInject+0xde
a0d33b14 85388c49 8a2bbd08 00000000 00000000 fwpkclnt!FwpsStreamInjectAsync0+0x93
a0d33b68 85389099 00000000 00000011 865dec20 epfwwfp+0x2c49
a0d33b94 8538a6d8 8538fdd0 00000428 00000000 epfwwfp+0x3099
a0d33bc0 8538a00a 8cac69d8 865dec08 0000004d epfwwfp+0x46d8
a0d33c28 82e42a18 8cac69d8 00000001 035edc08 epfwwfp+0x400a
a0d33cd0 82e89789 8a2bbd88 00000000 00000000 nt!IopXxxControlFile+0x2d0
a0d33d04 82c528c6 000003e4 00000000 00000000 nt!NtDeviceIoControlFile+0x2a
a0d33d04 779170f4 000003e4 00000000 00000000 nt!KiSystemServicePostCall
035edb78 00000000 00000000 00000000 00000000 0x779170f4


STACK_COMMAND:  .thread 0xffffffff9df0f750 ; kb

FOLLOWUP_IP: 
PHQF6CC+cd52
a023cd52 ??              ???

SYMBOL_STACK_INDEX:  6

SYMBOL_NAME:  PHQF6CC+cd52

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: PHQF6CC

IMAGE_NAME:  PHQF6CC.tmp

DEBUG_FLR_IMAGE_TIMESTAMP:  45ce238f

FAILURE_BUCKET_ID:  0xB8_VRF_PHQF6CC+cd52

BUCKET_ID:  0xB8_VRF_PHQF6CC+cd52

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:0xb8_vrf_phqf6cc+cd52

FAILURE_ID_HASH:  {8c491ac5-0e63-4b38-57c6-0b05d7cafce8}

Followup: MachineOwner
---------

0: kd> lmvm PHQF6CC
start    end        module name
a0230000 a0345000   PHQF6CC  T (no symbols)           
    Loaded symbol image file: PHQF6CC.tmp
    Image path: \??\C:\Users\Omais\AppData\Local\Temp\PHQF6CC.tmp
[COLOR=Red]    Image name: PHQF6CC.tmp
    Timestamp:        Sun Feb 11 01:27:03 2007[/COLOR] (45CE238F)
    CheckSum:         00110F93
    ImageSize:        00115000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

 

[Omais]

One more but now it is a different one. Check this out.

 

[Arc]

Different bugcheck code, but same thing.

BugCheck A, {12, 2, 0, 82c2d9db}

*** WARNING: Unable to verify timestamp for PHQ9FF.tmp
*** ERROR: Module load completed but symbols could not be loaded for PHQ9FF.tmp
[COLOR=Red]Probably caused by : PHQ9FF.tmp[/COLOR] ( PHQ9FF+cd52 )

Followup: MachineOwner
---------

    Image name: PHQ9FF.tmp
[COLOR=Red]    Timestamp:        Sun Feb 11 01:27:03 2007[/COLOR]

I dont know what is this. No info is available about it. It is not present in anywhere in your system other than in temps.

If temp cleaning does not remove it, scan the system for possible virus infection with the following programs.

• Anti-rootkit utility TDSSKiller
• Windows Defender Offline

If still it BSODs, go for a clean install.