Solved BSOD on a nearly new computer

[nickbuchanan]

38.0.5 it say's it is up to date

 

[Boozad]

Yep 38.0.5 is good, that's the latest one.

 

[nickbuchanan]

Here is the latest Boozad, seems to be happening when left overnight with sleep mode enabled.

 

[nickbuchanan]

2nd one today mate, I thought it was getting better!

 

[Boozad]

Right I'm looking at the latest one first, a 0x1A, these are usually down to bad RAM or a driver. We know the RAM's good as you've tested with MemTest86+ so we're looking at a driver again. None are showing (sod's law) so I think DV is called for again.

I'll outline the dump below just to explain briefly what's going on. The 41790 shows that a page table page has become corrupt.

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: [COLOR=Red]0000000000041790[/COLOR], A page table page has been corrupted. On a 64 bit OS, parameter 2
    contains the address of the PFN for the corrupted page table page.
    On a 32 bit OS, parameter 2 contains a pointer to the number of used
    PTEs, and parameter 3 contains the number of used PTEs.
Arg2: fffffa80047fff40
Arg3: 000000000000ffff
Arg4: 0000000000000000

There are quite a few Virtual Memory references in the stack too so a Driver Verifier run is going to be in order again.

Your earlier dump is a 0x1 which is an APC_INDEX_MISMATCH and usually points to a Checked Build but I'm presuming that's not the case here. A bit of info from the dump is below.

BugCheck 1, {76dddc2a, 0, ffff, fffff88020546b60}

Probably caused by : ntkrnlmp.exe ( nt!KiSystemServiceExit+245 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

APC_INDEX_MISMATCH (1)
This is a kernel internal error. The most common reason to see this
bugcheck is when a filesystem or a driver has a mismatched number of
calls to disable and re-enable APCs. The key data item is the
Thread->CombinedApcDisable field. This consists of two separate 16-bit
fields, the SpecialApcDisable and the KernelApcDisable. A negative value
of either indicates that a driver has disabled special or normal APCs
(respectively) without re-enabling them; a positive value indicates that
a driver has enabled special or normal APCs (respectively) too many times.
Arguments:
Arg1: 0000000076dddc2a, Address of system call function or worker routine
Arg2: 0000000000000000, Thread->ApcStateIndex
Arg3: 000000000000ffff, (Thread->SpecialApcDisable << 16) | Thread->KernelApcDisable
Arg4: fffff88020546b60, Call type (0 - system call, 1 - worker routine)

Maybe a driver is the issue again, I've not dealt with a 0x1 before personally so I can only presume it's possible. Again I think the best bet in this instance would be to run Driver Verifier again.

 

[nickbuchanan]

Thanks mate, will run Dv again now.

 

[nickbuchanan]

Here is the latest dump file mate

 

[Boozad]

Nothing showing in that one at all mate unfortunately. Keep DV running and post up any new logs as and when they happen.

 

[nickbuchanan]

no worries, here is another one!

 

[Boozad]

Still no driver showing, awkward little bugger this is. Nick, do you have Special Pool enabled in Driver Verifier?

 

[nickbuchanan]

Not sure what that means?
i followed all the insructions in the tut, all drivers are ticked except the microsoft ones.

 

[Boozad]

That's OK, I just wondered if it was enabled. It obviously isn't if you don't know about it. Carry on as per mate and I'll ask the BSOD Team to drop by and take a look to see if I'm missing anything. I'm 99% certain this is a driver causing the issue but a fresh set of eyes may see something different.

 

[essenbe]

hello, Nick. Boozad has pretty much covered all the bases. What brand SSD do you have. Could you check and make sure your Firmware is up to date and if you have a tool box, see if you can determine it's health. If you have benchmarked it before, try to run the same tests again and see if there is a drastic difference. Ther will be some minor differences, it is drastic ones we are concerned with.

If you would, could you run these online scanners

Scan with Kaspersky TDSSKiller:
Anti-rootkit utility TDSSKiller
Anti-rootkit utility TDSSKiller
ESET online scanner:
Free Virus Scan | Online Virus Scanner from ESET
Free Online Virus Scanner | ESET

If you have any Gigabytes Utilities installed, uninstall every one of them. They are known causes of BSODs.

 

[Boozad]

Thanks for dropping Steve, much appreciated as usual mucca.

 

[essenbe]

I don't know how much help I can be. You covered the bases pretty well.

 

[Boozad]

It's a baffling one Steve, if it wasn't for the MemTest86+ results I'd be calling a RAM problem nailed on. Everything seems to be pointing towards a driver but I'm buggered if it will show its head.

 

[nickbuchanan]

Thanks for your input into this matter essenbe, i will do as you advise above, will take me a day or so though.
In all seriousness though, if I where to reinstall windows do you think that would cure my problem?
i have attached the latest crash, it is deffinatley getting worse.

 

[Boozad]

Nick at the moment I'm of the mind that a clean install of Windows would more than likely solve the issue. I'm as sure as I can be that it's definitely not hardware related but finding out the offending software/driver is proving really difficult. If you do decide to go down that route let us know and we'll help you all you need.

I can't check the latest dump just yet as I'm on my phone but I'll take a look later.

 

[nickbuchanan]

Thanks Boozad, I think that is the way forward.
The system is only 3 /4 months so the hardware is still under warranty.

I am going to reinstall windows I have the install disc.
can you please direct me to a tutorial?
I have a ssd and hdd, do I have to reformat them?
I have the motherboard disk,do I need this?
there is a graphics card in, do I remove the card and reinstall later? I have install disc

So many questions, sorry but I am trying to do it right first time!

I have scanned system as assenbe advised. kasperscan did not find anything.
eset, which we removed it's antivirus also came back with no threats

SO REINSTALL IS THE WAY TO GO!!

 

[essenbe]

Nick, I looked at your dump file and found this

Use !analyze -v to get detailed debugging information.
BugCheck D1, {0, 2, 0, fffff88001a89a0a}
[COLOR=red]Probably caused by : tcpip.sys[/COLOR] ( tcpip!TtFireTimerEx+e3 )
Followup: MachineOwner

In further looking, I also found these errors blamed

fffff880`035a69b8  fffff880`08236318Unable to load image mbam.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for mbam.sys
*** [COLOR=red]ERROR: Module load completed but symbols could not be loaded for mbam.sys[/COLOR]
 mbam+0x5318

That is Malwarebytes

fffff880`035a6098  fffff880`00de1000*** WARNING: Unable to verify timestamp for MpFilter.sys
*** [COLOR=red]ERROR: Module load completed but symbols could not be loaded for MpFilter.sys[/COLOR]
 MpFilter+0x27000

That is a Windows Update, but it is also Microsoft Windows AntiMalware protection system.

fffff880`035a5af0  fffff880`04a52481Unable to load image bflwfx64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for bflwfx64.sys
[COLOR=red]*** ERROR: Module load completed but symbols could not be loaded for bflwfx64.sys[/COLOR]
 bflwfx64+0x2481

That is your Bigfoot Networks Bandwidth Control Wireless NDIS Light Weight Filter driver

I do find it curious that 2 of the 3 mentioned were anti virus/Malware related.

I would suggest you run these online scanners

Scan with Kaspersky TDSSKiller:
Anti-rootkit utility TDSSKiller
Anti-rootkit utility TDSSKiller
ESET online scanner:
Free Virus Scan | Online Virus Scanner from ESET
Free Online Virus Scanner | ESET

Also, please download and run a full scan with Superantispyware SUPERAntiSpyware | Remove Malware | Remove Spyware - AntiMalware, AntiSpyware, AntiAdware!
It is a free program and does a very good job with adware/tracking/malware programs we all get from cruising the net, as long as you can tolerate their nag popups. I use it often as an on demand scanner.

I would think if you are going to do a clean install, it would be best if you can find any Viruses/rootkits or other such programs first. Some have been known to live through a clean install.

When you get ready do a clean install, let us know and Boozad or I will guide you through it and give you a good tutorial. If you have any questions at all, feel free to ask. We don't mind a bit.