BSOD - Random - Last occured when copying files to a USB drive

[blackstryker]

Hello all,

I'm new to the forum and trying to become better at BSOD analysis. I have a client who has reported BSOD that occur randomly. I was able to login in safe mode with no issues and copy his data to an external drive. But when in normal mode, it crashed when attempting to copy data.

Attached is a dm log collector

Also wondering what tools you are using to open these logs. When I use word or notepad, they look garbled.

View attachment 373661

 

[axe0]

Hi blackstryker,

Welcome to the 7forums.

We use Windbg for opening dump files.

McAfee drivers have been flagged multiple times in multiple crashes and there are multiple 0x1A(MEMOR_MANAGEMENT) crashes meaning memory problems.
The other crashes are 0xA(IRQL_NOT_LESS_OR_EQUAL) with the following

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
[COLOR="Red"]Arg1: fffffa8011cc3010, memory referenced[/COLOR]
Arg2: 0000000000000002, IRQL
Arg3: [COLOR="red"]0000000000000001[/COLOR], bitfield :
	bit 0 : value 0 = read operation, [COLOR="red"]1 = write operation[/COLOR]
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8000318f136, address which referenced memory

Meaning a driver wanted to write to an invalid memory address.

Looking at 1 of the flagged drivers date, McAfee could use software updating.

2: kd> lmvm mfehidk
start             end                 module name
fffff880`014d5000 fffff880`01591180   mfehidk    (deferred)             
    Image path: \SystemRoot\system32\drivers\mfehidk.sys
    Image name: [U]mfehidk.sys[/U]
    Timestamp:        [COLOR="red"][U]Fri Dec 13 22:44:36 2013[/U][/COLOR] (52AB7FC4)
    CheckSum:         000C2B52
    ImageSize:        000BC180
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Please check McAfee for software updates or uninstall it and use Microsoft Security Essentials as alternative.

If the crashes persist after removing/updating McAfee it is recommended to test the memory with MemTest86+

Diagnostic Test

 RAM TEST

Run MemTest86+ to analyse your RAM. MemTest86+ - Test RAM - Windows 7 Forums

   Note

MemTest86+ needs to be run for at least 8 passes for conclusive results. Set it running before you go to bed and leave it overnight. We're looking for zero errors here. Even a single error will indicate RAM failure.

Please let me know how it goes

 

[blackstryker]

Hey Axe0,

Thanks for the response.

This device is within an enterprise, so I don't have the option of changing out this software we use. I'll see if I can update it as this device communicates to an ePO server that monitors and checks that the workstation is up to date. Since the machine crashes often, it may not have done so recently.