Solved BSOD error 0x0000009f (DUMP FILE)

Nazza · Jan 30, 2013

Hi all,
my PC has shown BSOD several times during last month (it never did in about 2 years).

My system is based on Seven Utimate 64, MSE installed and updated.

The error shown is 0x0000009f. It could be related to the fact that I use to hybernate ?

Programs running when I hybernate:

SkyDrive
Dropbox
Google Drive
Torrent
Skype
LogMeIn

The only changes in my configuration was that some weeks ago I installed SkyDrive and changed my mouse with a new one (by Microsoft), but I don't think it could be the cause.

Thank you for your support !
Nazza

x BlueRobot · Jan 30, 2013

Code:

[COLOR="red"]BugCheck 9F[/COLOR], {3, fffffa80076063f0, fffff80000b9c3d8, fffffa800af8d990}

*** WARNING: Unable to verify timestamp for asmthub3.sys
*** ERROR: Module load completed but symbols could not be loaded for asmthub3.sys
Probably caused by : [COLOR="Red"]asmthub3.sys[/COLOR]

Code:

0: kd> [COLOR="SeaGreen"]lmvm asmthub3[/COLOR]
start             end                 module name
fffff880`0829a000 fffff880`082bc000   asmthub3 T (no symbols)           
    Loaded symbol image file: asmthub3.sys
    Image path: \SystemRoot\system32\DRIVERS\asmthub3.sys
    Image name: asmthub3.sys
    Timestamp:        [COLOR="red"]Wed Dec 08 10:14:14 2010[/COLOR] (4CFF5A76)
    CheckSum:         0001E06C
    ImageSize:        00022000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Your ASMedia USB 3.0 Hub driver is rather outdated, and seems to be causing a few issues, it is best to update it from here:

ASMedia Technology Inc. ????

What is the brand of your computer? Where is your Windows 7 sourced from? Was it pre-installed or did you install it yourself?

Nazza · Jan 30, 2013

I assembled the PC and installed Seven (Microsoft download regularly licensed) by myself.

My hardware:

Asus P8H61-I (ASUS - - ASUS P8H61-I)
Intel i3-2100
RAM GSkill F3-10666CL7-4GBHX (X2)
HD Samsung Spinpoint F3

You are right, my USB3 driver was outdated, now I have updated (taken from ASUS website).

Recently I have connected an USB3 external HD, but the BSOD appears even if it is turned off...

x BlueRobot · Jan 31, 2013

Could you please upload the new dump file, using the same method as you did before?

Nazza · Jan 31, 2013

x BlueRobot said:
Could you please upload the new dump file, using the same method as you did before?

Hi, here my new dump file.
Thank you

x BlueRobot · Jan 31, 2013

Code:

[COLOR="red"]BugCheck 9F[/COLOR], {3, fffffa80076063f0, fffff80000b9c3d8, fffffa800af8d990}

*** WARNING: Unable to verify timestamp for asmthub3.sys
*** ERROR: Module load completed but symbols could not be loaded for asmthub3.sys
Probably caused by : [COLOR="Red"]asmthub3.sys[/COLOR]

Code:

0: kd> [COLOR="SeaGreen"]lmvm asmthub3[/COLOR]
start             end                 module name
fffff880`0829a000 fffff880`082bc000   asmthub3 T (no symbols)           
    Loaded symbol image file: asmthub3.sys
    Image path: \SystemRoot\system32\DRIVERS\asmthub3.sys
    Image name: asmthub3.sys
    Timestamp:        [COLOR="red"]Wed Dec 08 10:14:14 2010 (4CFF5A76)[/COLOR]
    CheckSum:         0001E06C
    ImageSize:        00022000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

I think the crash may have not been saved, make sure a Minidump has been configured to be saved:

http://www.sevenforums.com/tutorials/174459-dump-files-configure-windows-create-bsod.html

Uninstall Daemon Tools:

Code:

Start Menu\Programs\DAEMON Tools Lite

Daemon Tools uses a driver called sptd.sys, which is known to cause BSODs with Windows 7. It is recommend you remove this program, and use Windows own in-built features or MagicISO.

Anything associated with the manufacturer is usually just bloatware, which can slow down and corrupt your system, it's best to remove:

Code:

Start Menu\Programs\ASUS
Start Menu\Programs\ASUS\PC Diagnostics

I can't see any AV program installed either;

Install and perform full scans with:

:info: Remember to install the free version of Malwarebytes not the free trail; untick the free trial box during installation. MSE is the most lightweight and compatible with the Windows 7 operating system.

You can also view this thread for a complete free and lightweight security protection combination:

http://www.sevenforums.com/system-security/206705-good-free-system-security-combination.html

Nazza · Jan 31, 2013

x BlueRobot said:
I think the crash may have not been saved, make sure a Minidump has been configured to be saved:

My system is configured to create Kernel Memory Dump. It's necessary to create a Small Memory Dump ?
Anyway no BSOD since yesterday.

x BlueRobot said:
Uninstall Daemon Tools:

Uninstalled.

x BlueRobot said:
Anything associated with the manufacturer is usually just bloatware, which can slow down and corrupt your system, it's best to remove:

Code:

Start Menu\Programs\ASUS Start Menu\Programs\ASUS\PC Diagnostics

Uninstalled

x BlueRobot said:
I can't see any AV program installed either;

I use MSE, daily updated.

x BlueRobot said:
Install and perform full scans with:
Malwarebytes : Free anti-malware download

I'm going to do immediately.

x BlueRobot · Jan 31, 2013

A small Minidump should be adequate enough for your situation, and a Kernel Memory dump will not be able to be attached directly to this forum, it would have to be uploaded to a file sharing website, such as DropBox or SkyDrive.

Thanks for carrying out the other steps

Nazza · Jan 31, 2013

x BlueRobot said:
A small Minidump should be adequate enough for your situation, and a Kernel Memory dump will not be able to be attached directly to this forum, it would have to be uploaded to a file sharing website, such as DropBox or SkyDrive.

Thanks for carrying out the other steps

Thank you very much !

I have configured my system to save Minidump on BSOD.

x BlueRobot · Feb 1, 2013

Your welcome, what was the results of Malwarebytes?

Nazza · Feb 4, 2013

x BlueRobot said:
Your welcome, what was the results of Malwarebytes?

Hi, only 1 result:
PUP.FCTPlugin (it's a Registry Key).
I don't know what it is...

x BlueRobot · Feb 5, 2013

Could you please upload your Malwarebytes log file, which is created at the end of the test.

Start

rb: > Open Malwarebytes > Logs

I couldn't find anything regarding the registry key with Microsoft's Malware Encyclopedia, but one article suggested that PUP means Possibly Unwanted Program, and was linked to a registry key used by Google Chrome.

Scan with:

Anti-rootkit utility TDSSKiller

Nazza · Feb 5, 2013

x BlueRobot said:
Could you please upload your Malwarebytes log file, which is created at the end of the test.

Start rb: > Open Malwarebytes > Logs

I couldn't find anything regarding the registry key with Microsoft's Malware Encyclopedia, but one article suggested that PUP means Possibly Unwanted Program, and was linked to a registry key used by Google Chrome.

Scan with:

Anti-rootkit utility TDSSKiller

No threats with Anti-rootkit TDSSKiller

My Malwarebytes antimalware log:
Malwarebytes Anti-Malware 1.70.0.1100
Malwarebytes : Free anti-malware download

Versione database: v2013.01.31.09

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Nazareno :: DESKTOPZ1 [limitato]

31/01/2013 23:24:55
mbam-log-2013-01-31 (23-24-55).txt

Tipo di scansione: Scansione veloce
Opzioni di scansione attive: Memoria | Esecuzione automatica | Registro | File di sistema | Euristica/Extra | Euristica/Shuriken | PUP | PUM
Opzioni di scansione disattivate: P2P
Elementi esaminati: 209039
Tempo impiegato: 4 minuti, 23 secondi

Processi rilevati in memoria: 0
(non sono stati rilevati elementi nocivi)

Moduli di memoria rilevati: 0
(non sono stati rilevati elementi nocivi)

Chiavi di registro rilevate: 2
HKLM\SOFTWARE\Google\Chrome\Extensions\kincjchfokkeneeofpeefomkikfkiedl (PUP.FCTPlugin) -> Nessuna azione intrapresa.
HKCR\AppID\{186E19A3-B909-4F48-B687-BB81EB8BC7CE} (Trojan.BHO) -> Spostato in quarantena ed eliminato con successo.

Valori di registro rilevati: 0
(non sono stati rilevati elementi nocivi)

Voci rilevate nei dati di registro: 0
(non sono stati rilevati elementi nocivi)

Cartelle rilevate: 0
(non sono stati rilevati elementi nocivi)

File rilevati: 0
(non sono stati rilevati elementi nocivi)

(fine)

x BlueRobot · Feb 5, 2013

Considerable keys of register:
2 HKLM \ SOFTWARE \ Google \ Chrome \ Extensions \ kincjchfokkeneeofpeefomkikfkiedl (PUP. FCTPlugin) -> No action Undertaken.
HKCR \ AppID \ {186E19A3-B909-4F48-B687-BB81EB8BC7CE} (Trojan. BHO) -> Moved in quarantine and eliminated with success.

What extensions are using with Google Chrome? I also see, that you had a trojan too, I'm glad that has been removed.

Nazza · Feb 5, 2013

x BlueRobot said:
Considerable keys of register:
2 HKLM \ SOFTWARE \ Google \ Chrome \ Extensions \ kincjchfokkeneeofpeefomkikfkiedl (PUP. FCTPlugin) -> No action Undertaken.
HKCR \ AppID \ {186E19A3-B909-4F48-B687-BB81EB8BC7CE} (Trojan. BHO) -> Moved in quarantine and eliminated with success.

Click to expand...

What extensions are using with Google Chrome? I also see, that you had a trojan too, I'm glad that has been removed.

I don't have extensions in Chrome, I made a check in Chrome --> Tools --> Extensions

x BlueRobot · Feb 6, 2013

PUP. FCTPlugin is linked to Facetheme Toolbar, it's most probably a form of spyware which manged to get bundled or slip in with a download without you noticing, since you don't have extensions it's probably best to remove it.

Nazza · Feb 7, 2013

x BlueRobot said:
PUP. FCTPlugin is linked to Facetheme Toolbar, it's most probably a form of spyware which manged to get bundled or slip in with a download without you noticing, since you don't have extensions it's probably best to remove it.

Removed.

During last days there weren't BSODs. Probably it was the USB3 driver.

Thank you very much x BlueRobot !

x BlueRobot · Feb 8, 2013

Your welcome, leave this thread open for about a week, and if no problems occur within that time, then you can mark the thread as solved

Nazza · Feb 8, 2013

Ok,
I'll do.

Bye,
Nazza

Solved BSOD error 0x0000009f (DUMP FILE)

New member

My Computer

Closed by request

My Computer

New member

My Computer

Closed by request

My Computer

New member

My Computer

Closed by request

My Computer

New member

My Computer

Closed by request

My Computer

New member

My Computer

Closed by request

My Computer

New member

My Computer

Closed by request

My Computer

New member

My Computer

Closed by request

My Computer

New member

My Computer

Closed by request

My Computer

New member

My Computer

Closed by request

My Computer

New member

My Computer